A relay protection account information anomaly detection method and device based on graph embedding

Abstract

This invention discloses a method and apparatus for detecting anomalies in relay protection ledger information based on graph embedding. The method includes: associating primary equipment topology data with relay protection ledger data to form a standard dataset; constructing a heterogeneous graph of the relay protection ledger based on the standard dataset, and performing representation learning on the heterogeneous graph based on a graph embedding model to generate node embedding vectors; performing ledger anomaly detection based on the node embedding vectors, combined with primary equipment topology features and relay protection business rules, obtaining a comprehensive anomaly score, and determining anomalies according to a comprehensive anomaly score threshold; classifying anomalies into multiple preset levels based on the primary equipment topology structure, tracing the causes of anomalies, and outputting an anomaly detection report; periodically collecting new primary equipment topology data and relay protection ledger data, adding them to the standard dataset, fine-tuning the graph embedding model, and updating the comprehensive anomaly score threshold and weight coefficients.

Description

Technical Field

[0001] This invention relates to the field of power system relay protection technology, and more specifically, to a method and apparatus for detecting anomalies in relay protection ledger information based on graph embedding. Background Technology

[0002] Relay protection ledger information is the most fundamental data for relay protection professional management and the most important basic data for carrying out all advanced applications. Errors in relay protection ledger information directly affect the full lifecycle management of relay protection equipment and prevent the implementation of various advanced applications for relay protection operation analysis. Research and engineering applications for verifying relay protection ledger information are limited, relying mostly on rule-based or statistical analysis. This makes it difficult to effectively model the complex relationships between primary equipment topology and secondary protection devices, especially with poor adaptability to business rules such as dual configuration, channel matching, and model-manufacturer adaptation, indicating room for improvement in the quality of relay protection ledger data. With the expansion of the power grid and the surge in the number of protection devices, manual review of ledger anomalies is inefficient and error-prone. There is an urgent need for an anomaly detection method that can automatically integrate primary equipment topology, protection ledgers, and standard specifications, and possess strong generalization capabilities. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a method and apparatus for detecting anomalies in relay protection ledger information based on graph embedding.

[0004] According to one aspect of the present invention, a method for detecting anomalies in relay protection ledger information based on graph embedding is provided, comprising: Collect primary equipment topology data and relay protection ledger data of the power system, associate the primary equipment topology data and relay protection ledger data, clarify the corresponding relationship between protection devices and primary equipment and substations, and form a standard dataset; Based on the standard dataset, a heterogeneous graph of relay protection ledgers is constructed, and representation learning is performed on the heterogeneous graph of relay protection ledgers based on graph embedding model to generate node embedding vectors. Based on node embedding vectors, combined with primary equipment topology features and relay protection business rules, anomaly detection is performed in the ledger to obtain a comprehensive anomaly score, and anomalies are determined according to the comprehensive anomaly score threshold. Based on the primary equipment topology, anomalies are classified into multiple preset levels. Based on the primary equipment topology, abnormal nodes and their relationships are located, the causes of anomalies are traced, and an anomaly detection report is output. Regularly collect new primary equipment topology data and relay protection ledger data, add them to the standard dataset, fine-tune the graph embedding model, and update the comprehensive anomaly score threshold and weight coefficients.

[0005] Optionally, primary equipment topology data and relay protection ledger data of the power system are collected, and the primary equipment topology data and relay protection ledger data are correlated to clarify the corresponding relationship between protection devices and primary equipment and substations, forming a standard dataset, including: Collect primary equipment topology data for the power system, including substation information, primary equipment entity information, and primary equipment topology relationship information. Substation information includes the highest voltage level and nature of the substation. Primary equipment entity information includes the name, number, voltage level, and dispatching unit of lines, substations, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. Primary equipment topology relationship information includes the connection relationship between lines and busbars of substations on both sides, the ownership relationship between substations and busbars, the connection relationship between busbars and transformers, the connection relationship between busbars and high-voltage reactors, low-voltage reactors, and low-voltage capacitors, and the connection relationship between circuit breakers and lines, busbars, transformers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. Collect relay protection ledger data, including physical information of protection devices and protection configuration information; physical information of protection devices includes physical ID of protection device, dispatch name, channel type, model, manufacturer, software version, and operation and maintenance unit; protection configuration information includes the correspondence between protection devices and primary equipment; Link primary equipment topology data with relay protection ledger data to clarify the corresponding relationship between protection devices, primary equipment, and substations, ensure that the physical IDs and dispatch names of protection devices are not duplicated, clarify the substation type and the highest voltage level of the plant, and form a standard dataset.

[0006] Optionally, based on a standard dataset, a heterogeneous diagram of relay protection ledgers is constructed, including: Define the node types in the heterogeneous graph, including substation nodes, primary equipment nodes, secondary protection nodes, and standard data nodes. Substation nodes are modeled on a substation-by-substation basis and must include the type and the highest voltage level attribute of the substation. Primary equipment nodes correspond to lines, substations, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. Secondary protection nodes correspond to protection devices, channel types, models, manufacturers, software versions, and maintenance units. Standard data nodes correspond to standard channel types, standard voltage level adaptation parameters, standard models, standard manufacturers, standard software versions, and standard protection configuration requirements. Substation types include conventional substations and intelligent substations. Define the edge types of heterogeneous graphs, including substation information edges, primary equipment topology edges, ledger association edges, and constraint edges; Based on the standard dataset, attribute features are added to each node of the heterogeneous graph. These attributes include: substation node's substation type, highest voltage level, and name; primary equipment node's voltage level, number, and dispatching unit; protection device node's physical ID, dispatching name, channel type, model, manufacturer, software version, and maintenance unit. The attribute features of standard data nodes are parameters from professionally tested standard data, forming a complete relay protection ledger heterogeneous graph. The information about substations explains the relationship between substations and their types (conventional / intelligent), maximum voltage levels, etc. A primary equipment topology edge is derived from the primary equipment topology relationship information and reflects the topology connection relationship between primary equipment. The ledger-related edge is a topological edge derived from the entity information of the protection device, reflecting the configuration of the protection device and its relationship with the primary equipment.

[0007] Optionally, the constraint edges include: the inherent relationships between nodes such as manufacturer, model, software version, and applicable voltage level in the standard data, as well as the complex verification rules for relay protection ledger verification, such as: the matching equipment edge between channel type and primary equipment type, the matching manufacturer edge between model and standard manufacturer, the matching model edge between software version and standard model, the matching circuit breaker protection configuration edge between substation type and standard protection configuration requirements, the matching protection duplication configuration edge between voltage level and standard protection configuration requirements, the matching channel type configuration edge between channel type and the protection channel type of the other side, the matching physical ID configuration edge between physical ID and other equipment physical IDs, and the matching operation and maintenance unit configuration edge between operation and maintenance unit and preset operation and maintenance unit.

[0008] Optionally, the graph embedding model is specifically an algorithm that combines a heterogeneous graph attention network with a graph autoencoder; Representation learning is performed on the heterogeneous graph of the relay protection ledger based on the graph embedding model to generate node embedding vectors, including: The algorithm combining heterogeneous graph attention network and graph autoencoder is selected as the core algorithm for graph embedding. The heterogeneous graph attention network is used to process multiple types of nodes and edges. Through a two-layer mechanism of node-level attention and semantic-level attention, it completes the feature extraction of multiple types of nodes and multiple relational edges. The graph autoencoder is used for unsupervised learning of the structural patterns of normal heterogeneous graphs. The heterogeneous graph of the relay protection ledger is input into a heterogeneous graph attention network. Through node-level attention and semantic-level attention, the importance of different types of nodes and edges is distinguished, and the structural features of the nodes are extracted. The structural features output by the heterogeneous graph attention network are input into the encoder of the graph autoencoder, which maps the nodes into low-dimensional embedding vectors. The embedding vectors fuse the structural features and attribute features of the nodes. The decoder of the graph autoencoder reconstructs the heterogeneous graph based on the embedding vectors, calculates the reconstruction error, and optimizes the embedding vectors through backpropagation to minimize the reconstruction error of the heterogeneous graph with normal structure until the model converges, thus obtaining the trained graph embedding model and the embedding vectors of all nodes.

[0009] Optionally, node-level attention is used to calculate the weights of adjacent nodes on the same meta-path, using the following formula: In the formula, LeakyReLU is a linear unit with leakage correction and a nonlinear activation function; , They are nodes i With nodes j The original feature vector, e ij It is a node i with neighboring nodes j Original attention weights α ij These are the normalized node-level attention weights. W The characteristic transformation matrix, For attention parameter vectors, N i For nodes i The set of neighboring nodes, where || denotes vector concatenation, is used. Semantic attention then fuses the features of multiple meta-paths to obtain the final HAN output features of the node. In the formula, It is the first m Feature representation vector of a single path For the first m Nodes under the element path i eigenvectors, β m For the first m Attention weights corresponding to each element path It is a common query vector for semantic-level attention, used to measure the importance of features of different meta-paths; The graph autoencoder takes the HAN output features as input and maps high-dimensional features into low-dimensional node embedding vectors through the encoder, thereby achieving the fusion of topological and attribute features. Its encoding process is as follows: The decoder reconstructs the original graph structure based on the node embedding vectors, and the reconstructed adjacency matrix is: The reconstruction error is used as the base anomaly score and is calculated using cross-entropy loss. In the formula, X The node feature matrix, A For the graph adjacency matrix, For the normalized adjacency matrix, σ It is the Sigmoid activation function, which maps the output to the interval between 0 and 1. W 1. W 2 is the weight matrix of the two-layer linear transformation of the GAE encoder. Z Embed vectors for nodes. L rec For reconstruction error, N This represents the total number of nodes in the heterogeneous graph, corresponding to the basic anomaly score. S 1; In the model training process, with the goal of minimizing the reconstruction error, the network parameters are continuously updated through backpropagation to optimize the embedding vector.

[0010] Optionally, based on node embedding vectors, combined with primary equipment topology features and relay protection business rules, ledger anomaly detection is performed to obtain a comprehensive anomaly score, and anomalies are determined according to the comprehensive anomaly score threshold, including: The reconstruction error output by the graph autoencoder is used as the first anomaly score; the first type of anomaly score includes: circuit breaker protection configuration anomaly score and protection duplication configuration anomaly score based on substation type and highest voltage level, protection device category, voltage level and protection configuration specification matching degree. For protection devices with primary equipment topology association, the embedded vector distance is calculated and scored, and the obtained score is used as the second anomaly score. The second anomaly score includes: channel matching anomaly score based on the embedded vector distance of the channel type of two main protection devices in the same substation; model-manufacturer matching anomaly score based on manufacturer-model standard constraints; and configuration adaptation anomaly score based on the embedded vector distance between the protection device node and the corresponding primary equipment node. Input the embedding vectors of all nodes into the Isolation Forest algorithm, and output the statistical anomaly score of each node as the third anomaly score; A weighted summation method is used to merge the first abnormal score, the second abnormal score, and the third abnormal score to calculate the comprehensive abnormal score; A comprehensive anomaly score threshold is set. When the comprehensive anomaly score of a node or edge is greater than the comprehensive anomaly score threshold, it is judged as an anomaly. The comprehensive anomaly score threshold is set based on the scores of 95% of normal samples according to historical qualified data.

[0011] Optionally, in the first type of anomaly score, the specific rules for judging whether the circuit breaker protection configuration complies with the specifications and whether the protection duplication configuration is implemented, based on the substation type, highest voltage level, protection device category, and voltage level, are as follows: For circuit breaker protection at voltage levels of 220kV and above, intelligent substations require duplication configuration, while conventional substations require single-set configuration; for all types of protection at voltage levels of 220kV and above, as well as 110kV or 66kV line protection and bus protection within substations at voltage levels of 220kV and above, duplication configuration is required.

[0012] Optionally, based on the primary equipment topology, anomalies are classified into multiple preset levels. Anomaly nodes and their relationships are located based on the primary equipment topology, the causes of the anomalies are traced, and an anomaly detection report is output, including: Based on the comprehensive anomaly score and anomaly type, anomalies are divided into three levels: high-risk anomalies, medium-risk anomalies, and low-risk anomalies. Based on the primary equipment topology, locate the primary equipment, protection devices and related relationships corresponding to abnormal nodes or edges, and trace the cause of the abnormality. Output an anomaly detection report, including anomaly location, anomaly type, anomaly score, classification result, source analysis, and rectification suggestions.

[0013] Optionally, high-risk anomalies include inconsistent protection device channels on both sides, mismatch between protection configuration and primary equipment voltage level, lack of dual configuration for various protections at 220kV and above voltage levels, lack of dual configuration for 110kV or 66kV line protection and bus protection in substations at 220kV and above voltage levels, lack of dual configuration for circuit breaker protection at 220kV and above voltage levels in intelligent substations, and lack of single-set protection for circuit breaker protection at 220kV and above voltage levels in conventional substations; medium-risk anomalies include missing or redundant protection devices, incompatible channel type and equipment, model-manufacturer mismatch, incompatible software version and model, and dual protection devices from the same manufacturer; low-risk anomalies include duplicate physical IDs, duplicate dispatch names, and errors in data entry by the operation and maintenance unit.

[0014] Optionally, the causes of the anomaly include duplicate physical ID / scheduling name entries, configuration conflicts, improper parameter settings, errors in data entry by the operation and maintenance unit, non-compliance of protection dualization configuration with specifications, and mismatch between circuit breaker protection configuration and substation type.

[0015] According to another aspect of the present invention, a relay protection ledger information anomaly detection device based on graph embedding is provided, comprising: The data acquisition module is used to collect primary equipment topology data and relay protection ledger data of the power system, associate the primary equipment topology data and relay protection ledger data, clarify the corresponding relationship between protection devices and primary equipment and substations, and form a standard dataset. The module is used to construct a heterogeneous graph of relay protection ledger based on a standard dataset, and to perform representation learning on the heterogeneous graph of relay protection ledger based on a graph embedding model to generate node embedding vectors. The detection module is used to perform ledger anomaly detection based on node embedding vectors, combined with primary equipment topology features and relay protection business rules, to obtain a comprehensive anomaly score, and to determine anomalies based on the comprehensive anomaly score threshold. The traceability module is used to classify anomalies into multiple preset levels based on the primary equipment topology, locate the abnormal nodes and their relationships based on the primary equipment topology, trace the cause of the anomalies, and output an anomaly detection report. The update module is used to periodically collect new primary equipment topology data and relay protection ledger data, add them to the standard dataset, fine-tune the graph embedding model, and update the comprehensive anomaly score threshold and weight coefficients.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing a computer program for performing the methods described in any of the above aspects of the present invention.

[0017] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the method described in any of the preceding aspects of the present invention.

[0018] Therefore, this invention provides a method for detecting anomalies in relay protection ledger information based on HAN-GAE graph embedding. By constructing a heterogeneous graph integrating primary equipment topology, secondary protection devices, and standard data nodes, and utilizing a heterogeneous graph attention network and graph autoencoder for unsupervised representation learning, node embedding vectors are generated to capture deep correlation features between primary equipment, protection devices, and standard specifications. Based on this, by combining reconstruction error, vector distance, and statistical anomaly scores, automated and multi-dimensional anomaly detection of relay protection ledgers is achieved. This solves the problem of traditional methods struggling to handle complex topological relationships and adapt to business rules, improving the accuracy, robustness, and interpretability of ledger anomaly identification. Attached Figure Description

[0019] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures: Figure 1This is a flowchart illustrating an exemplary embodiment of the present invention for a method of detecting anomalies in relay protection ledger information based on graph embedding. Figure 2 This is an overall flowchart of relay protection ledger information anomaly detection provided by an exemplary embodiment of the present invention; Figure 3 This is a structural diagram of a heterogeneous graph embedding model based on HAN-GAE provided in an exemplary embodiment of the present invention; Figure 4 This is a flowchart of anomaly scoring and grading determination provided by an exemplary embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of a relay protection ledger information anomaly detection device based on graph embedding provided in an exemplary embodiment of the present invention; Figure 6 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. Detailed Implementation

[0020] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0021] It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0022] Those skilled in the art will understand that the terms "first," "second," etc., in the embodiments of the present invention are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a necessary logical order between them.

[0023] It should also be understood that in the embodiments of the present invention, "multiple" can refer to two or more, and "at least one" can refer to one, two or more.

[0024] It should also be understood that any component, data or structure mentioned in the embodiments of the present invention can generally be understood as one or more unless explicitly defined or given contrary instructions in the context.

[0025] Furthermore, the term "and / or" in this invention is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this invention generally indicates that the preceding and following related objects have an "or" relationship.

[0026] It should also be understood that the description of the various embodiments in this invention emphasizes the differences between the various embodiments, and the similarities or similarities can be referred to each other. For the sake of brevity, they will not be described in detail.

[0027] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0028] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the invention or its application or use.

[0029] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, they should be considered part of the specification.

[0030] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0031] The embodiments of this invention can be applied to electronic devices such as terminal devices, computer systems, and servers, and can operate together with a wide range of other general-purpose or special-purpose computing system environments or configurations. Well-known examples of terminal devices, computing systems, environments, and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, and servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments including any of the above systems, etc.

[0032] Electronic devices such as terminal devices, computer systems, and servers can be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are performed by remote processing devices linked through communication networks. In distributed cloud computing environments, program modules can reside on local or remote computing system storage media, including storage devices.

[0033] Exemplary methods Figure 1 This is a schematic flowchart of an anomaly detection method for relay protection ledger information based on graph embedding, provided by an exemplary embodiment of the present invention. This embodiment can be applied to electronic devices, such as... Figure 1 As shown, the relay protection ledger information anomaly detection method 100 based on graph embedding includes the following steps: Step 101: Collect primary equipment topology data and relay protection ledger data of the power system, associate the primary equipment topology data and relay protection ledger data, clarify the corresponding relationship between protection devices and primary equipment and substations, and form a standard dataset; Step 102: Based on the standard dataset, construct a heterogeneous graph of the relay protection ledger, and perform representation learning on the heterogeneous graph of the relay protection ledger based on the graph embedding model to generate node embedding vectors; Step 103: Based on the node embedding vector, combined with the primary equipment topology features and relay protection business rules, perform ledger anomaly detection, obtain a comprehensive anomaly score, and determine anomalies based on the comprehensive anomaly score threshold. Step 104: Based on the primary equipment topology, classify the anomalies into multiple preset levels, locate the anomaly nodes and their relationships based on the primary equipment topology, trace the cause of the anomalies, and output an anomaly detection report. Step 105: Periodically collect new primary equipment topology data and relay protection ledger data, add them to the standard dataset, fine-tune the graph embedding model, and update the comprehensive anomaly score threshold and weight coefficients.

[0034] Specifically, this invention aims to provide a method for detecting anomalies in relay protection ledger information based on HAN-GAE graph embedding. By constructing a heterogeneous graph integrating primary equipment topology, secondary protection devices, and standard data nodes, and utilizing a heterogeneous graph attention network and graph autoencoder for unsupervised representation learning, node embedding vectors are generated to capture deep correlation features between primary equipment, protection devices, and standard specifications. Based on this, by combining reconstruction error, vector distance, and statistical anomaly scores, automated and multi-dimensional anomaly detection of relay protection ledgers is achieved. This solves the problem of traditional methods struggling to handle complex topological relationships and adapt to business rules, improving the accuracy, robustness, and interpretability of ledger anomaly identification. The specific implementation steps are as follows: Step 1: Preprocess primary equipment topology data and relay protection ledger data to construct a standard dataset. Step 1-1: Collect topology data of primary equipment in the power system This includes substation information (with attributes of the highest voltage level and substation type), primary equipment entity information, and primary equipment topology information. The primary equipment entity information includes the name, number, voltage level, and dispatching unit of lines, substations, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. The primary equipment topology information includes the connection relationships between lines and the busbars of the substations on both sides, the affiliation relationship between substations and busbars, the connection relationship between busbars and transformers, the connection relationship between busbars and high-voltage reactors, low-voltage reactors, and low-voltage capacitors, and the connection relationships between circuit breakers and lines, busbars, transformers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors.

[0035] Step 1-2: Collect relay protection ledger data This includes protection device entity information and protection configuration information; the protection device entity information includes the protection device physical ID (globally unique), scheduling name (globally unique), channel type, model, manufacturer, software version, and operation and maintenance unit; the protection configuration information includes the correspondence between the protection device and the aforementioned primary equipment.

[0036] Steps 1-3: Link primary equipment topology data with relay protection ledger data Clearly define the corresponding relationships between protection devices, primary equipment, and substations, ensuring that the physical IDs (globally unique) and dispatch names (globally unique) of protection devices are not duplicated. At the same time, clearly define the substation type (conventional station / intelligent station) and the highest voltage level of the substation, forming a standard dataset that can be used for subsequent graph modeling.

[0037] Step 2: Construct a heterogeneous diagram of the relay protection ledger based on the primary equipment topology. The heterogeneous diagram is based on the primary equipment topology framework, integrating secondary protection devices and standard specification entities; Step 2-1: Define the node types of the heterogeneous graph This includes substation nodes, primary equipment nodes, secondary protection nodes, and standard data nodes. Substation nodes are modeled on a substation-by-substation basis and must include the type (conventional / intelligent) and the highest voltage level attribute of the substation. The primary equipment nodes correspond to the lines, substations, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors in step 1-1. The secondary protection nodes correspond to the protection devices, channel types, models, manufacturers, software versions, and maintenance units in step 1-2. The standard data nodes correspond to standard channel types, standard voltage level adaptation parameters, standard models, standard manufacturers, standard software versions, and standard protection configuration requirements (including dual / single configuration specifications).

[0038] Step 2-2: Define the edge type of the heterogeneous graph Based on the primary equipment topology and relay protection ledger associations, the following edges are constructed: (1) Substation information edge: Substation ──(type) ──► Substation Type Substation ── (Highest voltage level is) ──► Highest voltage level (2) Primary equipment topology edge: Line ── (starting point connection) ── ► Substation busbar Line ── (Terminal Connection) ── ► Substation Busbar Busbar ── (Belonging) ── ► Substation Busbar ── (Connection) ── ► Transformer High Voltage Side Busbar ── (Connection) ── ► Medium voltage side of transformer Busbar ── (Connection) ── ► Low-voltage side of transformer Busbar ── (Connection) ── ► High Voltage Reactor Busbar ── (Connection) ── ► Low-voltage reactor Busbar ── (Connection) ── ► Low-voltage capacitor Circuit breaker ── (connection) ── ► Line Circuit breaker ── (connection) ── ► Busbar Circuit breaker ── (connection) ── ► Transformer high-voltage side Circuit breaker ── (connection) ── ► Medium voltage side of transformer Circuit breaker ── (connection) ── ► Low-voltage side of transformer Circuit breaker ── (connection) ── ► High-voltage reactor Circuit breaker ── (connection) ── ► Low-voltage reactor Circuit breaker ── (connection) ── ► Low-voltage capacitor Line ── (Connection) ── ► High-voltage reactor Primary equipment ── (primary voltage level is) ── ► Primary voltage level Primary equipment ── (dispatching unit is) ──► Dispatching unit Primary equipment ── (numbered) ──► Primary equipment number (3) Ledger Related Edges: Protection devices (deployed at) ► Substation Protection device ──(channel is) ──► Channel type Protection device ── (model number) ──► Model Protective device ──(physical ID is) ──► Physical ID Protection device ──(voltage level) ──► Voltage level Protective device ── (protection category is) ──► Protection category Protective device ── (manufacturer) ──► Manufacturer Protection device ── (software version is) ──► Software version Protection device ── (maintenance unit is) ──► Maintenance unit Protection devices ── (corresponding) ── ► Primary equipment (including lines, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors) (4) Constraint edges: Channel Type ── (Adaptive Equipment) ── ► Primary Equipment Type (Line) Model Number ── (Compatible Manufacturer) ── ► Standard Manufacturer Software Version ── (Compatible Models) ── ► Standard Model Substation Type ── (Applicable Circuit Breaker Protection Configuration) ── ► Standard Protection Configuration Requirements (Intelligent substations with dual circuit breaker protection configuration for 220kV and above voltage levels; conventional substations with single circuit breaker protection configuration for 220kV and above voltage levels) Voltage Level ── (Adaptive Protection Dual Configuration) ── ► Standard Protection Configuration Requirements (Regardless of substation type, all protection systems at voltage levels of 220kV and above require dual configuration. Dual configuration is required for 110kV (66kV) line protection and busbar protection within substations at voltage levels of 220kV and above.) Channel type ── (Adaptive channel type configuration) ──► Channel type for line protection on the other side Physical ID ──(Adapted Physical ID Configuration) ──► Inconsistent with Physical IDs of other devices Operations and Maintenance Unit (Adapted to Operations and Maintenance Unit Configuration) ► Usually not provincial or municipal dispatch centers. Steps 2-3: Add attribute features to each node of the heterogeneous graph The attribute features include the substation type (conventional / intelligent), highest voltage level, and name of the substation nodes; the voltage level, number, and dispatching unit of primary equipment nodes (including circuit breakers, high-voltage reactors, low-voltage reactors, low-voltage capacitors, etc.); the physical ID (globally unique), dispatching name (globally unique), channel type, model, manufacturer, software version, and maintenance unit of protection device nodes; and the attribute features of standard data nodes are parameters of standard data obtained through professional testing, forming a complete heterogeneous graph. The basic framework of the heterogeneous graph is the primary equipment topology, and secondary protection nodes are attached to the corresponding primary equipment nodes and substation nodes through ledger association edges, realizing deep integration of primary equipment topology and relay protection ledger.

[0039] Step 3: Based on graph embedding algorithms, perform representation learning on heterogeneous graphs to generate node embedding vectors, capturing the association features between primary equipment, protection devices, and standards and specifications. Step 3-1: Select an algorithm combining Heterogeneous Graph Attention Network (HAN) and Graph Autoencoder (GAE) as the core algorithm for graph embedding. HAN is used to process multiple types of nodes and edges, and assigns different weights to edges through an attention mechanism (e.g., the weight of a primary equipment topology edge is higher than that of a regular ledger-related edge). GAE is used for unsupervised learning of the structural patterns of normal heterogeneous graphs. Heterogeneous graph attention networks employ a two-layer mechanism of node-level attention and semantic-level attention to extract features from multiple node types and multiple relational edges. Node-level attention is used to calculate the weights of adjacent nodes along the same meta-path; the calculation formula is as follows: In the formula, LeakyReLU is a linear unit with leakage correction, a non-linear activation function used to avoid the vanishing of negative gradients and improve the stability of model training. , They are nodes i With nodes j The original feature vector, e ij It is a node i with neighboring nodes j Original attention weights α ij These are the normalized node-level attention weights. W The characteristic transformation matrix, For attention parameter vectors, N i For nodes i The set of neighboring nodes, where || denotes vector concatenation. Based on this, semantic attention fuses the features of multiple meta-paths to obtain the final HAN output features of the nodes: In the formula, It is the first m Feature representation vector of a single path For the first m Nodes under the element path i eigenvectors, β m For the first m Attention weights corresponding to each element path It is a common query vector for semantic-level attention, used to measure the importance of features of different meta-paths.

[0040] Step 3-2: Model Training and Embedding Vector Generation The heterogeneous graph is input into HAN, and the importance of different types of nodes and edges is distinguished through node-level attention and semantic-level attention, and the structural features of the nodes are extracted. The structural features output by HAN are input into the encoder of GAE, and the nodes are mapped into low-dimensional embedding vectors of 64 to 128 dimensions. The embedding vectors fuse the structural features and attribute features of the nodes. The decoder of GAE reconstructs the heterogeneous graph based on the embedding vectors, calculates the reconstruction error, and optimizes the embedding vectors through backpropagation to minimize the reconstruction error of the heterogeneous graph with normal structure until the model converges, and obtains the trained graph embedding model and the embedding vectors of all nodes (including the embedding vectors of all primary equipment, protection devices, and standard data nodes).

[0041] The graph autoencoder takes the HAN output features as input and maps high-dimensional features into low-dimensional node embedding vectors through the encoder, thereby achieving the fusion of topological and attribute features. Its encoding process is as follows: The decoder reconstructs the original graph structure based on the node embedding vectors, and the reconstructed adjacency matrix is: The reconstruction error is used as the base anomaly score and is calculated using cross-entropy loss. In the formula, X The node feature matrix, A For the graph adjacency matrix, For the normalized adjacency matrix, σ It is the Sigmoid activation function, which maps the output to the 0~1 range. W 1. W 2 is the weight matrix of the two-layer linear transformation of the GAE encoder. Z Embed vectors for nodes. L rec For reconstruction error, N This is the total number of nodes in the heterogeneous graph, corresponding to the basic anomaly score in step 4-1. S 1.

[0042] During model training, the goal is to minimize the reconstruction error. The network parameters are continuously updated through backpropagation to optimize the embedding vector.

[0043] Step 4: Perform anomaly scoring based on node embedding vectors, and combine primary equipment topology features and relay protection business rules to achieve ledger anomaly detection. Step 4-1: Calculate the reconstruction error anomaly score The reconstruction error output by GAE is used as the base anomaly score; the larger the reconstruction error, the higher the anomaly score. Step 4-2: Calculate the vector distance anomaly score For protection devices with primary equipment topology association, calculate and score the following vector distances: (1) For two main protection devices deployed on the same side of the substation, calculate the embedding vector distance between the two channel type nodes. If the distance is greater than the preset threshold, it is judged as channel type mismatch abnormality; calculate the embedding vector distance between the two model and manufacturer nodes. If it deviates from the standard adaptation relationship, it is judged as model-manufacturer mismatch abnormality; combine the substation type (conventional station / intelligent station) and voltage level to determine whether the circuit breaker protection configuration of 220kV and above voltage level meets the specifications (intelligent station dualization, conventional station single set). If it does not meet the specifications, it is judged as circuit breaker protection configuration abnormality; determine whether the various protections of 220kV and above voltage level, 110kV (66kV) line protection and bus protection in 220kV and above voltage level substations have achieved dualization configuration. If they have not achieved dualization, it is judged as protection dualization configuration abnormality, and corresponding abnormality scores are assigned. (2) The embedded vector distance between the protection device node and the corresponding primary equipment node (including line, bus, transformer, circuit breaker, high voltage reactor, low voltage reactor, and low voltage capacitor) is calculated. If the deviation from the adaptation relationship (e.g., 220kV line protection corresponds to 35kV primary equipment, and high voltage reactor protection corresponds to low voltage capacitor equipment) is judged as an abnormal configuration and assigned a corresponding abnormal score. Step 4-3: Calculate the statistical anomaly score Input the embedding vectors of all nodes into the Isolation Forest algorithm, and output the anomaly score (0~1) for each node. The higher the score, the greater the probability of the node being an anomaly.

[0044] Isolation forests identify anomalous nodes by constructing binary isolation trees. The anomalous score is calculated using the following formula: In the formula, ξ It is the Euler-Marcheroni constant, approximately 0.5772, used for path length correction in isolated forests. h ( n ) is a node n Path length in the isolation tree E ( h ( n )) represents the average path length. c ( m )for m The average path length of a binary search tree with n nodes s (n , m ) represents the statistical outlier score. S 3. The value range is [0,1]. The closer the score is to 1, the higher the probability of node abnormality.

[0045] Step 4-4: Calculate the overall anomaly score The reconstruction error anomaly score, vector distance anomaly score, and statistical anomaly score are fused using a weighted summation method, as shown in the formula: S = αS 1 + βS 2 + γS 3, of which, S To calculate the overall abnormal score, S 1 represents the score for abnormal reconstruction error. S 2 represents the vector distance anomaly score. S 3 represents the statistical anomaly score. α , β , γ These are the weighting coefficients, and α + β + γ =1, which can be adjusted according to the needs of relay protection services; Steps 4-5: Anomaly Detection Set the threshold for comprehensive anomaly score T (Based on historical qualified data, and set according to the score of 95% of normal samples), when the comprehensive abnormal score of a certain node or edge is... S > T When an error occurs, it is considered abnormal, and the identifier of the abnormal node / edge and the type of abnormality are recorded.

[0046] Step 5: Anomaly classification and source tracing, outputting anomaly detection results based on the primary equipment topology. Step 5-1: Anomaly Classification Based on the comprehensive anomaly score and anomaly type, anomalies are divided into three levels: (1) High-risk anomalies: These reflect data anomalies related to the implementation of anti-accident measures and standard procedures. They are related to whether the configuration, operation, and maintenance of relay protection meet the requirements. These include inconsistent protection device channels on both sides, mismatch between protection configuration and primary equipment voltage level, failure to implement dual configuration for various protections at voltage levels of 220kV and above, failure to implement dual configuration for 110kV (66kV) line protection and bus protection in substations at voltage levels of 220kV and above, failure to configure dual protection for circuit breakers at voltage levels of 220kV and above in intelligent substations, and failure to configure a single set of circuit breaker protection for circuit breakers at voltage levels of 220kV and above in conventional substations. (2) Medium-risk anomalies: These reflect errors in key information of the protection device and have a significant impact on the on-site operation and maintenance of the equipment. They include missing / redundant protection devices, incompatible channel types with the equipment, model-manufacturer mismatch, incompatible software versions with the model, and dual protection devices from the same manufacturer. (3) Low-risk anomalies: Other types of anomalies, including duplicate physical IDs, duplicate scheduling names, and errors in data entry by the operation and maintenance unit.

[0047] Step 5-2: Anomaly Tracing Based on the primary equipment topology, locate the primary equipment (lines, substations, circuit breakers, high-voltage reactors, low-voltage reactors, low-voltage capacitors, etc.), protection devices, and related relationships corresponding to abnormal nodes / edges, and trace the causes of the abnormalities (such as duplicate physical IDs / dispatch names, configuration conflicts, improper parameter settings, errors in input by the operation and maintenance unit, non-compliance of protection dualization configuration, and mismatch between circuit breaker protection configuration and substation type). Step 5-3: Output an anomaly detection report This includes the location of the anomaly (associated primary equipment and protection devices, substation type and highest voltage level of the substation), anomaly type, anomaly score, classification results, source analysis and rectification suggestions (including rectification requirements for protection configuration specifications).

[0048] Step 6: Iterative Model Optimization Regularly collect new primary equipment topology data and relay protection ledger data (including substation type, highest voltage level of the substation and related protection configuration data), add them to the standard dataset, fine-tune the graph embedding model, update the anomaly score threshold and weight coefficients, focus on optimizing the anomaly identification accuracy of protection dual configuration and circuit breaker protection configuration, improve the accuracy and adaptability of anomaly detection, and adapt to the iterative update needs of primary equipment and protection devices in the power system.

[0049] Figure 2This invention presents a flowchart of the overall process for detecting anomalies in relay protection ledger information, including: Step 1: Collecting primary equipment topology data of the power system, including the names, numbers, and voltage levels of lines, substations, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. For substations, the highest voltage level attribute needs to be added, and substations are divided into conventional and intelligent substations. Simultaneously, collecting relay protection ledger data, including protection device entity information and protection configuration information. Linking the primary equipment topology data with the relay protection ledger data ensures that each protection device corresponds to a unique primary equipment, forming a standard dataset. Step 2: Based on the primary equipment topology framework, integrating secondary protection devices and standard specification entities, constructing a heterogeneous graph. Step 3: Selecting an algorithm combining HAN and GAE, inputting the heterogeneous graph into HAN, allocating weights to different edges through an attention mechanism, inputting the structural features output by HAN into the GAE encoder, mapping nodes to 64-128 dimensional low-dimensional embedding vectors, and the decoder reconstructing the heterogeneous graph based on the embedding vectors, minimizing the reconstruction error of the heterogeneous graph with a normal structure. Step 4 calculates the overall anomaly score, and step 5 classifies the anomalies into three levels: high risk, medium risk, and low risk, and outputs a detection report.

[0050] Figure 3 This invention presents the structural diagram of the heterogeneous graph embedding model based on HAN-GAE. The invention selects an algorithm combining a heterogeneous graph attention network and a graph autoencoder as the core algorithm for graph embedding. HAN is used to handle multiple types of nodes and edges, allocating different weights to edges through an attention mechanism; for example, the weight of edges related to primary equipment topology is higher than that of edges related to ordinary ledgers. GAE is used for unsupervised learning of the structural patterns of normal heterogeneous graphs. The heterogeneous graph is input into HAN, and the importance of different types of nodes and edges is distinguished through node-level attention and semantic-level attention, extracting the structural features of the nodes. The structural features output by HAN are input into the encoder of GAE, mapping the nodes into low-dimensional embedding vectors of 64-128 dimensions. These embedding vectors fuse the structural and attribute features of the nodes. The decoder of GAE reconstructs the heterogeneous graph based on the embedding vectors, calculates the reconstruction error, and optimizes the embedding vectors through backpropagation to minimize the reconstruction error of heterogeneous graphs with normal structures until the model converges, obtaining the trained graph embedding model and the embedding vectors of all nodes, including those of all primary equipment, protection devices, and standard data nodes. The basic framework of the heterogeneous graph is the primary equipment topology, and the secondary protection nodes are attached to the corresponding primary equipment nodes and substation nodes through the ledger association edge to achieve deep integration.

[0051] Figure 4This is a flowchart of the anomaly scoring and classification process of this invention, including: calculating the reconstruction error anomaly score, using the reconstruction error output by GAE as the basic anomaly score; the larger the reconstruction error, the higher the anomaly score. Calculating the vector distance anomaly score, for two main protection devices deployed on the same side of the substation, calculating the embedding vector distance between their channel type nodes; if the distance is greater than a preset threshold, it is judged as a channel type mismatch anomaly; calculating the embedding vector distance between their model and manufacturer nodes; if it deviates from the standard adaptation relationship, it is judged as a model-manufacturer mismatch anomaly; combining the substation type and voltage level, determining whether the protection configuration of 220kV and above voltage level circuit breakers complies with the specifications. Calculating the embedding vector distance between the protection device node and the corresponding primary equipment node; if it deviates from the adaptation relationship, it is judged as a configuration adaptation anomaly. Calculating the statistical anomaly score, inputting the embedding vectors of all nodes into the isolated forest algorithm, outputting the anomaly score for each node. A weighted summation method is used to fuse the three types of scores, the formula being S=αS1+βS2+γS3, α+β+γ=1. Setting a comprehensive anomaly score threshold T; when S>T, it is judged as an anomaly. Anomalies are classified into three levels: high-risk, medium-risk, and low-risk. Anomaly nodes and their relationships are located based on the primary equipment topology, and an anomaly detection report is output.

[0052] To verify the effectiveness and practicality of the method proposed in this invention, several representative relay protection ledger anomaly scenarios were selected for application testing. Table 1 below lists eight typical anomaly data types, covering high-risk, medium-risk, and low-risk anomaly types, including model-manufacturer mismatch, circuit breaker protection configuration incompatible with substation type, missing protection dualization, configuration adaptation error, inconsistent channel type, duplicate physical ID, and entry errors by the operation and maintenance unit. Taking item 2, "abnormal configuration of 220kV circuit breaker protection in conventional substations," as an example, the entire process of ledger anomaly detection based on HAN-GAE graph embedding is described in detail, including heterogeneous graph construction, embedding vector generation, multi-dimensional anomaly scoring, and hierarchical tracing.

[0053] Table 1

[0054] This analysis focuses on a high-risk anomaly: an abnormal configuration of the 220kV circuit breaker protection at a conventional substation. It elucidates the entire process of anomaly detection based on HAN-GAE diagram embedding. The analysis focuses on substation K, a conventional substation with a maximum voltage level of 220kV. The corresponding primary equipment is circuit breaker 211 (220kV). Two sets of circuit breaker protection devices, 0003 and 0004, are deployed on-site. According to relay protection configuration specifications, conventional substations with 220kV and above voltage levels should use a single-set configuration for circuit breaker protection. However, the actual configuration on-site is a dual-set configuration, directly conflicting with the standard configuration and constituting a typical high-risk anomaly.

[0055] To simplify calculations, the embedding vectors of each node are uniformly reduced to 2 dimensions, and an actual configuration vector is added to directly represent the dual configuration states on site. The values ​​of each node vector are as follows: Embedding vector of K node in substation Z 站 = [0.8, 0.1], 211 circuit breaker node embedding vector Z 断 =[0.7, 0.2], actual on-site configuration (dual sets) of vectors Z 实 =[0.6, 0.3], Standard configuration (single set) vector Z 标 =[0.1,0.9]. First, calculate the basic anomaly score. S 1. This score is directly derived from the GAE reconstruction error. Due to the fundamental conflict between the dual-set configuration on-site and the standard single-set configuration, the diagram structure reconstruction deviation is significant, resulting in a substantial reconstruction error. L rec =0.78, which is the baseline anomaly score. S 1 = 0.78. Next, calculate the vector distance anomaly score. S 2. The Euclidean distance is used to directly measure the characteristic differences between the actual on-site configuration and the standard specification configuration. The Euclidean distance formula is: Substituting the on-site dual-set configuration vectors and the standard single-set configuration vectors into the calculation, we obtain... This distance significantly exceeds the normal threshold, directly indicating an abnormal circuit breaker protection configuration, resulting in an abnormal vector distance score. S 2 = 0.85. Then, the statistical anomaly score was calculated. S 3. Embed all nodes into the vector input of the Isolation Forest algorithm. The dual-configuration nodes in the dataset exhibit a clearly isolated distribution, and the algorithm outputs a statistical anomaly score. S 3 = 0.92.

[0056] After calculating the scores for the three types of anomalies, a weighted summation formula is used to calculate the overall anomaly score. S = αS 1+ βS 2+ γS 3. Set weights according to business needs α =0.3、 β =0.4、 γ =0.3, substituting the value, we get S=0.3×0.78+0.4×0.85+0.3×0.92=0.234+0.34+0.276=0.85. Based on historical qualified ledger data, an anomaly judgment threshold T=0.6 was set. Since the comprehensive anomaly score 0.85>0.6, the ledger was determined to be abnormal. Combining the anomaly classification rules, this anomaly reflects matters that clearly require implementation of anti-accident measures and standard procedures, concerning whether the relay protection configuration, operation, and maintenance meet the requirements, and is classified as a high-risk anomaly. Through tracing the relationship between the primary equipment topology and the ledger, the anomaly location was determined to be the protection configuration corresponding to circuit breaker 211 in substation K (conventional station). The root cause of the anomaly was the mismatch between the on-site dual-set configuration and the standard requirement of a single-set configuration, and the mismatch between the circuit breaker protection configuration and the substation type.

[0057] Therefore, this invention constructs a heterogeneous graph based on primary equipment topology, integrates protection devices and standard data nodes, and employs the HAN-GAE graph embedding algorithm for representation learning, effectively capturing the complex structural and attribute features of multiple types of nodes and edges. Utilizing a dual attention mechanism at the node and semantic levels, it rationally distinguishes the importance of substation information edges, primary equipment topology edges, ledger-related edges, and constraint edges, improving the model's ability to model key business relationships. The unsupervised learning approach of GAE reduces dependence on labeled data, and reconstruction errors directly reflect graph structure anomalies. Combining vector distance anomaly scores (such as channel type, model-manufacturer matching, and dual-configuration business rule verification) and isolated forest statistical anomaly scores, a multi-dimensional anomaly scoring mechanism is implemented, capable of identifying various anomaly types such as configuration mismatch, missing protection dualization, and ledger entry errors. Furthermore, through anomaly classification and tracing, combined with the primary equipment topology, an interpretable detection report is output to guide operation and maintenance rectification. This method has good iterability, allowing for model optimization with data updates, significantly improving the automation level and accuracy of relay protection ledger anomaly detection.

[0058] Exemplary device Figure 5 This is a schematic diagram of the structure of a relay protection ledger information anomaly detection device based on graph embedding provided in an exemplary embodiment of the present invention. Figure 5 As shown, the device 500 includes: The data acquisition module 510 is used to acquire primary equipment topology data and relay protection ledger data of the power system, associate the primary equipment topology data and relay protection ledger data, clarify the corresponding relationship between protection devices and primary equipment and substations, and form a standard dataset. Module 520 is used to construct a heterogeneous graph of relay protection ledger based on a standard dataset, and to perform representation learning on the heterogeneous graph of relay protection ledger based on a graph embedding model to generate node embedding vectors. The detection module 530 is used to perform ledger anomaly detection based on node embedding vectors, combined with primary equipment topology features and relay protection business rules, to obtain a comprehensive anomaly score, and to determine anomalies based on the comprehensive anomaly score threshold. The traceability module 540 is used to classify anomalies into multiple preset levels based on the primary equipment topology, locate the abnormal nodes and their relationships based on the primary equipment topology, trace the cause of the anomalies, and output an anomaly detection report. The update module 550 is used to periodically collect new primary equipment topology data and relay protection ledger data, add standard datasets, fine-tune the graph embedding model, and update the comprehensive anomaly score threshold and weight coefficients.

[0059] Optionally, primary equipment topology data and relay protection ledger data of the power system are collected, and the primary equipment topology data and relay protection ledger data are correlated to clarify the corresponding relationship between protection devices and primary equipment and substations, forming a standard dataset, including: Collect primary equipment topology data for the power system, including substation information, primary equipment entity information, and primary equipment topology relationship information. Substation information includes the highest voltage level and nature of the substation. Primary equipment entity information includes the name, number, voltage level, and dispatching unit of lines, substations, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. Primary equipment topology relationship information includes the connection relationship between lines and busbars of substations on both sides, the ownership relationship between substations and busbars, the connection relationship between busbars and transformers, the connection relationship between busbars and high-voltage reactors, low-voltage reactors, and low-voltage capacitors, and the connection relationship between circuit breakers and lines, busbars, transformers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. Collect relay protection ledger data, including physical information of protection devices and protection configuration information; physical information of protection devices includes physical ID of protection device, dispatch name, channel type, model, manufacturer, software version, and operation and maintenance unit; protection configuration information includes the correspondence between protection devices and primary equipment; Link primary equipment topology data with relay protection ledger data to clarify the corresponding relationship between protection devices, primary equipment, and substations, ensure that the physical IDs and dispatch names of protection devices are not duplicated, clarify the substation type and the highest voltage level of the plant, and form a standard dataset.

[0060] Optionally, based on a standard dataset, a heterogeneous diagram of relay protection ledgers is constructed, including: Define the node types in the heterogeneous graph, including substation nodes, primary equipment nodes, secondary protection nodes, and standard data nodes. Substation nodes are modeled on a substation-by-substation basis and must include the type and the highest voltage level attribute of the substation. Primary equipment nodes correspond to lines, substations, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. Secondary protection nodes correspond to protection devices, channel types, models, manufacturers, software versions, and maintenance units. Standard data nodes correspond to standard channel types, standard voltage level adaptation parameters, standard models, standard manufacturers, standard software versions, and standard protection configuration requirements. Substation types include conventional substations and intelligent substations. Define the edge types of heterogeneous graphs, including substation information edges, primary equipment topology edges, ledger association edges, and constraint edges; Based on the standard dataset, attribute features are added to each node of the heterogeneous graph. These attributes include: substation node's substation type, highest voltage level, and name; primary equipment node's voltage level, number, and dispatching unit; protection device node's physical ID, dispatching name, channel type, model, manufacturer, software version, and maintenance unit. The attribute features of standard data nodes are parameters from professionally tested standard data, forming a complete relay protection ledger heterogeneous graph. The information about substations explains the relationship between substations and their types (conventional / intelligent), maximum voltage levels, and other information.

[0061] A primary equipment topology edge is derived from the primary equipment topology relationship information and reflects the topology connection relationship between primary equipment. The ledger-related edge is a topological edge derived from the entity information of the protection device, reflecting the configuration of the protection device and its relationship with the primary equipment.

[0062] Optionally, the constraint edges include: the inherent relationships between nodes such as manufacturer, model, software version, and applicable voltage level in the standard data, as well as the complex verification rules for relay protection ledger verification, such as: the matching equipment edge between channel type and primary equipment type, the matching manufacturer edge between model and standard manufacturer, the matching model edge between software version and standard model, the matching circuit breaker protection configuration edge between substation type and standard protection configuration requirements, the matching protection duplication configuration edge between voltage level and standard protection configuration requirements, the matching channel type configuration edge between channel type and the protection channel type of the other side, the matching physical ID configuration edge between physical ID and other equipment physical IDs, and the matching operation and maintenance unit configuration edge between operation and maintenance unit and preset operation and maintenance unit.

[0063] Optionally, the graph embedding model is specifically an algorithm that combines a heterogeneous graph attention network with a graph autoencoder; Representation learning is performed on the heterogeneous graph of the relay protection ledger based on the graph embedding model to generate node embedding vectors, including: The algorithm combining heterogeneous graph attention network and graph autoencoder is selected as the core algorithm for graph embedding. The heterogeneous graph attention network is used to process multiple types of nodes and edges. Through a two-layer mechanism of node-level attention and semantic-level attention, it completes the feature extraction of multiple types of nodes and multiple relational edges. The graph autoencoder is used for unsupervised learning of the structural patterns of normal heterogeneous graphs. The heterogeneous graph of the relay protection ledger is input into a heterogeneous graph attention network. Through node-level attention and semantic-level attention, the importance of different types of nodes and edges is distinguished, and the structural features of the nodes are extracted. The structural features output by the heterogeneous graph attention network are input into the encoder of the graph autoencoder, which maps the nodes into low-dimensional embedding vectors. The embedding vectors fuse the structural features and attribute features of the nodes. The decoder of the graph autoencoder reconstructs the heterogeneous graph based on the embedding vectors, calculates the reconstruction error, and optimizes the embedding vectors through backpropagation to minimize the reconstruction error of the heterogeneous graph with normal structure until the model converges, thus obtaining the trained graph embedding model and the embedding vectors of all nodes.

[0064] Optionally, node-level attention is used to calculate the weights of adjacent nodes on the same meta-path, using the following formula: In the formula, LeakyReLU is a linear unit with leakage correction and a nonlinear activation function; , They are nodes i With nodes j The original feature vector, e ij It is a node i with neighboring nodes j Original attention weights α ij These are the normalized node-level attention weights. W The characteristic transformation matrix, For attention parameter vectors, N i For nodes i The set of neighboring nodes, where || denotes vector concatenation, is used. Semantic attention then fuses the features of multiple meta-paths to obtain the final HAN output features of the node. In the formula, It is the first m Feature representation vector of a single path For the first m Nodes under the element path i eigenvectors, β m For the first m Attention weights corresponding to each element path It is a common query vector for semantic-level attention, used to measure the importance of features of different meta-paths; The graph autoencoder takes the HAN output features as input and maps high-dimensional features into low-dimensional node embedding vectors through the encoder, thereby achieving the fusion of topological and attribute features. Its encoding process is as follows: The decoder reconstructs the original graph structure based on the node embedding vectors, and the reconstructed adjacency matrix is: The reconstruction error is used as the base anomaly score and is calculated using cross-entropy loss. In the formula, X The node feature matrix, A For the graph adjacency matrix, For the normalized adjacency matrix, σ It is the Sigmoid activation function, which maps the output to the interval between 0 and 1. W 1. W 2 is the weight matrix of the two-layer linear transformation of the GAE encoder. Z Embed vectors for nodes. L rec For reconstruction error, N This represents the total number of nodes in the heterogeneous graph, corresponding to the basic anomaly score. S 1; In the model training process, with the goal of minimizing the reconstruction error, the network parameters are continuously updated through backpropagation to optimize the embedding vector.

[0065] Optionally, based on node embedding vectors, combined with primary equipment topology features and relay protection business rules, ledger anomaly detection is performed to obtain a comprehensive anomaly score, and anomalies are determined according to the comprehensive anomaly score threshold, including: The reconstruction error output by the graph autoencoder is used as the first anomaly score; the first type of anomaly score includes: circuit breaker protection configuration anomaly score and protection duplication configuration anomaly score based on substation type and highest voltage level, protection device category, voltage level and protection configuration specification matching degree. For protection devices with primary equipment topology association, the embedded vector distance is calculated and scored, and the obtained score is used as the second anomaly score. The second anomaly score includes: channel matching anomaly score based on the embedded vector distance of the channel type of two main protection devices in the same substation; model-manufacturer matching anomaly score based on manufacturer-model standard constraints; and configuration adaptation anomaly score based on the embedded vector distance between the protection device node and the corresponding primary equipment node. Input the embedding vectors of all nodes into the Isolation Forest algorithm, and output the statistical anomaly score of each node as the third anomaly score; A weighted summation method is used to merge the first abnormal score, the second abnormal score, and the third abnormal score to calculate the comprehensive abnormal score; A comprehensive anomaly score threshold is set. When the comprehensive anomaly score of a node or edge is greater than the comprehensive anomaly score threshold, it is judged as an anomaly. The comprehensive anomaly score threshold is set based on the scores of 95% of normal samples according to historical qualified data.

[0066] Optionally, in the first type of anomaly score, the specific rules for judging whether the circuit breaker protection configuration complies with the specifications and whether the protection duplication configuration is implemented, based on the substation type, highest voltage level, protection device category, and voltage level, are as follows: For circuit breaker protection at voltage levels of 220kV and above, intelligent substations require duplication configuration, while conventional substations require single-set configuration; for all types of protection at voltage levels of 220kV and above, as well as 110kV or 66kV line protection and bus protection within substations at voltage levels of 220kV and above, duplication configuration is required.

[0067] Optionally, based on the primary equipment topology, anomalies are classified into multiple preset levels. Anomaly nodes and their relationships are located based on the primary equipment topology, the causes of the anomalies are traced, and an anomaly detection report is output, including: Based on the comprehensive anomaly score and anomaly type, anomalies are divided into three levels: high-risk anomalies, medium-risk anomalies, and low-risk anomalies. Based on the primary equipment topology, locate the primary equipment, protection devices and related relationships corresponding to abnormal nodes or edges, and trace the cause of the abnormality. Output an anomaly detection report, including anomaly location, anomaly type, anomaly score, classification result, source analysis, and rectification suggestions.

[0068] Optionally, high-risk anomalies include inconsistent protection device channels on both sides, mismatch between protection configuration and primary equipment voltage level, lack of dual configuration for various protections at 220kV and above voltage levels, lack of dual configuration for 110kV or 66kV line protection and bus protection in substations at 220kV and above voltage levels, lack of dual configuration for circuit breaker protection at 220kV and above voltage levels in intelligent substations, and lack of single-set protection for circuit breaker protection at 220kV and above voltage levels in conventional substations; medium-risk anomalies include missing or redundant protection devices, incompatible channel type and equipment, model-manufacturer mismatch, incompatible software version and model, and dual protection devices from the same manufacturer; low-risk anomalies include duplicate physical IDs, duplicate dispatch names, and errors in data entry by the operation and maintenance unit.

[0069] Optionally, the causes of the anomaly include duplicate physical ID / scheduling name entries, configuration conflicts, improper parameter settings, errors in data entry by the operation and maintenance unit, non-compliance of protection dualization configuration with specifications, and mismatch between circuit breaker protection configuration and substation type.

[0070] Exemplary electronic devices Figure 6 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. For example... Figure 6 As shown, the electronic device 60 includes one or more processors 61 and a memory 62.

[0071] The processor 61 may be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0072] The memory 62 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 61 may execute the program instructions to implement the methods of the software programs of the various embodiments of the present invention described above, and / or other desired functions. In one example, the electronic device may also include an input device 63 and an output device 64, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0073] In addition, the input device 63 may also include, for example, a keyboard, a mouse, etc.

[0074] The output device 64 can output various information to the outside. The output device 64 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0075] Of course, for the sake of simplicity, Figure 6 Only some of the components of this electronic device relevant to the present invention are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0076] Exemplary computer program products and computer-readable storage media In addition to the methods and apparatus described above, embodiments of the present invention may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps in the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0077] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0078] Furthermore, embodiments of the present invention may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps of the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0079] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0080] The basic principles of the present invention have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in the present invention are merely examples and not limitations, and should not be considered as essential features of each embodiment of the present invention. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the present invention to the necessity of employing the aforementioned specific details.

[0081] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0082] The block diagrams of devices, systems, devices, and systems involved in this invention are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, systems, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0083] The methods and systems of the present invention may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of the present invention are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, the present invention may also be implemented as a program recorded on a recording medium, the program comprising machine-readable instructions for implementing the methods according to the present invention. Thus, the present invention also covers recording media storing programs for performing the methods according to the present invention.

[0084] It should also be noted that in the systems, apparatus, and methods of the present invention, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered equivalents of the present invention. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the invention. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the invention. Therefore, the invention is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0085] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the invention to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A method for detecting anomalies in relay protection ledger information based on graph embedding, characterized in that, include: Collect primary equipment topology data and relay protection ledger data of the power system, associate the primary equipment topology data and the relay protection ledger data, clarify the corresponding relationship between protection devices, primary equipment and substations, and form a standard dataset; Based on the standard dataset, a heterogeneous graph of relay protection ledger is constructed, and representation learning is performed on the heterogeneous graph of relay protection ledger based on graph embedding model to generate node embedding vectors. Based on the node embedding vector, combined with the primary equipment topology features and relay protection business rules, anomaly detection of ledgers is performed to obtain a comprehensive anomaly score, and anomalies are determined according to the comprehensive anomaly score threshold. Based on the primary equipment topology, the anomalies are classified into multiple preset levels. The abnormal nodes and their relationships are located based on the primary equipment topology, the causes of the anomalies are traced, and an anomaly detection report is output. Regularly collect new primary equipment topology data and relay protection ledger data, add them to the standard dataset, fine-tune the graph embedding model, and update the comprehensive anomaly score threshold and weight coefficients.

2. The method according to claim 1, characterized in that, Collect primary equipment topology data and relay protection ledger data of the power system, associate the primary equipment topology data and the relay protection ledger data, clarify the corresponding relationship between protection devices, primary equipment, and substations, and form a standard dataset, including: The system collects primary equipment topology data, including substation information, primary equipment entity information, and primary equipment topology relationship information. The substation information includes the highest voltage level and nature of the substation. The primary equipment entity information includes the name, number, voltage level, and dispatching unit of lines, substations, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. The primary equipment topology relationship information includes the connection relationships between lines and the busbars of both substations, the ownership relationship between substations and busbars, the connection relationship between busbars and transformers, the connection relationship between busbars and high-voltage reactors, low-voltage reactors, and low-voltage capacitors, and the connection relationships between circuit breakers and lines, busbars, transformers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. Collect relay protection ledger data, including protection device physical information and protection configuration information; the protection device physical information includes the protection device physical ID, scheduling name, channel type, model, manufacturer, software version, and operation and maintenance unit; the protection configuration information includes the correspondence between the protection device and the primary equipment; By associating the primary equipment topology data with the relay protection ledger data, the corresponding relationship between the protection device and the primary equipment and substation is clarified, ensuring that the physical ID and dispatch name of the protection device are not duplicated, the substation type and the highest voltage level of the plant are clarified, and the standard dataset is formed.

3. The method according to claim 2, characterized in that, Based on the aforementioned standard dataset, a heterogeneous diagram of relay protection ledgers is constructed, including: Define the node types in the heterogeneous graph, including substation nodes, primary equipment nodes, secondary protection nodes, and standard data nodes. Substation nodes are modeled on a substation-by-substation basis, and each substation node must include its type and the highest voltage level attribute. Primary equipment nodes correspond to lines, substations, busbars, transformers, circuit breakers, high-voltage reactors, low-voltage reactors, and low-voltage capacitors. Secondary protection nodes correspond to protection devices, channel types, models, manufacturers, software versions, and maintenance units. Standard data nodes correspond to standard channel types, standard voltage level adaptation parameters, standard models, standard manufacturers, standard software versions, and standard protection configuration requirements. Substation types include conventional substations and intelligent substations. Define the edge types of heterogeneous graphs, including substation information edges, primary equipment topology edges, ledger association edges, and constraint edges; According to the standard dataset, attribute features are added to each node of the heterogeneous graph. These attribute features include: substation type, highest voltage level, and name for substation nodes; voltage level, number, and dispatching unit for primary equipment nodes; physical ID, dispatching name, channel type, model, manufacturer, software version, and maintenance unit for protection device nodes; and attribute features for standard data nodes are parameters from professionally tested standard data, forming a complete heterogeneous graph of the relay protection ledger. The information about substations explains the relationship between substations and their types (conventional / intelligent), maximum voltage levels, etc. The primary equipment topology edge is derived from the primary equipment topology relationship information and reflects the topology connection relationship between primary equipment. The ledger association edge is derived from the entity information of the protection device and reflects the topological edge of the protection device configuration and its relationship with the primary equipment.

4. The method according to claim 3, characterized in that, The constraint edges include: the inherent relationships between nodes such as manufacturer, model, software version, and applicable voltage level in the standard data, as well as the complex verification rules for relay protection ledger verification, such as: the matching equipment edge between channel type and primary equipment type, the matching manufacturer edge between model and standard manufacturer, the matching model edge between software version and standard model, the matching circuit breaker protection configuration edge between substation type and standard protection configuration requirements, the matching protection duplication configuration edge between voltage level and standard protection configuration requirements, the matching channel type configuration edge between channel type and the protection channel type of the other side, the matching physical ID configuration edge between physical ID and other equipment physical IDs, and the matching operation and maintenance unit configuration edge between operation and maintenance unit and preset operation and maintenance unit.

5. The method according to claim 1, characterized in that, The graph embedding model is specifically an algorithm that combines a heterogeneous graph attention network with a graph autoencoder; Based on a graph embedding model, representation learning is performed on the heterogeneous graph of the relay protection ledger to generate node embedding vectors, including: The algorithm combining heterogeneous graph attention network and graph autoencoder is selected as the core algorithm for graph embedding. The heterogeneous graph attention network is used to process multiple types of nodes and edges, and completes feature extraction of multiple types of nodes and multiple relational edges through a two-layer mechanism of node-level attention and semantic-level attention. The graph autoencoder is used for unsupervised learning of the structural patterns of normal heterogeneous graphs. The heterogeneous graph of the relay protection ledger is input into a heterogeneous graph attention network. Through node-level attention and semantic-level attention, the importance of different types of nodes and edges is distinguished, and the structural features of the nodes are extracted. The structural features output by the heterogeneous graph attention network are input into the encoder of the graph autoencoder, which maps the nodes into low-dimensional embedding vectors. The embedding vectors fuse the structural features and attribute features of the nodes. The decoder of the graph autoencoder reconstructs the heterogeneous graph based on the embedding vectors, calculates the reconstruction error, and optimizes the embedding vectors through backpropagation to minimize the reconstruction error of the heterogeneous graph with normal structure until the model converges, thus obtaining the trained graph embedding model and the embedding vectors of all nodes.

6. The method according to claim 5, characterized in that, The node-level attention is used to calculate the weights of adjacent nodes on the same meta-path, and the calculation formula is as follows: In the formula, LeakyReLU is a linear unit with leakage correction and a nonlinear activation function; , They are nodes i With nodes j The original feature vector, e ij It is a node i with neighboring nodes j Original attention weights α ij These are the normalized node-level attention weights. W The characteristic transformation matrix, For attention parameter vectors, N i For nodes i The set of neighboring nodes, where || denotes vector concatenation, is used. Semantic attention then fuses the features of multiple meta-paths to obtain the final HAN output features of the node. In the formula, It is the first m Feature representation vector of a single path For the first m Nodes under the element path i eigenvectors, β m For the first m Attention weights corresponding to each element path It is a common query vector for semantic-level attention, used to measure the importance of features of different meta-paths; The graph autoencoder takes the HAN output features as input and maps high-dimensional features into low-dimensional node embedding vectors through the encoder, thereby achieving the fusion of topological and attribute features. Its encoding process is as follows: The decoder reconstructs the original graph structure based on the node embedding vectors, and the reconstructed adjacency matrix is: The reconstruction error is used as the base anomaly score and is calculated using cross-entropy loss. In the formula, X The node feature matrix, A For the graph adjacency matrix, For the normalized adjacency matrix, σ It is the Sigmoid activation function, which maps the output to the interval between 0 and 1. W 1. W 2 is the weight matrix of the two-layer linear transformation of the GAE encoder. Z Embed vectors for nodes. L rec For reconstruction error, N This represents the total number of nodes in the heterogeneous graph, corresponding to the basic anomaly score. S 1; In the model training process, with the goal of minimizing the reconstruction error, the network parameters are continuously updated through backpropagation to optimize the embedding vector.

7. The method according to claim 5, characterized in that, Based on the node embedding vector, combined with primary equipment topology features and relay protection business rules, ledger anomaly detection is performed to obtain a comprehensive anomaly score. Anomalies are then determined based on the comprehensive anomaly score threshold, including: The reconstruction error output by the graph autoencoder is used as the first anomaly score; the first type of anomaly score includes: circuit breaker protection configuration anomaly score and protection duplication configuration anomaly score based on substation type and highest voltage level, protection device category, voltage level and protection configuration specification matching degree. For the protection devices associated with the primary equipment topology, the embedded vector distance is calculated and scored, and the obtained score is used as the second anomaly score; the second anomaly score includes: channel matching anomaly score based on the embedded vector distance of the channel type of the two main protection devices in the same substation; model-manufacturer matching anomaly score based on the manufacturer-model standard constraint; and configuration adaptation anomaly score based on the embedded vector distance between the protection device node and the corresponding primary equipment node. Input the embedding vectors of all nodes into the isolated forest algorithm, and output the statistical anomaly score of each node as the third anomaly score; The first abnormal score, the second abnormal score, and the third abnormal score are combined using a weighted summation method to calculate the comprehensive abnormal score; A comprehensive anomaly score threshold is set. When the comprehensive anomaly score of a node or edge is greater than the comprehensive anomaly score threshold, it is determined to be an anomaly. The comprehensive anomaly score threshold is set based on the scores of 95% of normal samples according to historical qualified data.

8. The method according to claim 7, characterized in that, In the first category of abnormal scores, the specific rules for judging whether the circuit breaker protection configuration complies with the specifications and whether the protection duplication configuration has been implemented, based on the substation type, highest voltage level, protection device category, and voltage level, are as follows: For circuit breaker protection at voltage levels of 220kV and above, intelligent substations require duplication configuration, while conventional substations require single configuration; for all types of protection at voltage levels of 220kV and above, as well as 110kV or 66kV line protection and bus protection within substations at voltage levels of 220kV and above, duplication configuration is required.

9. The method according to claim 1, characterized in that, Based on the primary equipment topology, the anomalies are classified into multiple preset levels. Anomaly nodes and their relationships are located based on the primary equipment topology, the causes of the anomalies are traced, and an anomaly detection report is output, including: Based on the comprehensive anomaly score and anomaly type, anomalies are divided into three levels: high-risk anomalies, medium-risk anomalies, and low-risk anomalies. Based on the primary equipment topology, locate the primary equipment, protection device and related relationships corresponding to the abnormal node or edge, and trace the cause of the abnormality. Output an anomaly detection report, including anomaly location, anomaly type, anomaly score, classification result, source analysis, and rectification suggestions.

10. The method according to claim 9, characterized in that, The high-risk anomalies include inconsistent protection device channels on both sides, mismatch between protection configuration and primary equipment voltage level, lack of dual configuration for various protections at 220kV and above voltage levels, lack of dual configuration for 110kV or 66kV line protection and bus protection in substations at 220kV and above voltage levels, lack of dual configuration for circuit breaker protection at 220kV and above voltage levels in intelligent substations, and lack of single-set protection for circuit breaker protection at 220kV and above voltage levels in conventional substations. The medium-risk anomalies include missing or redundant protection devices, incompatible channel type and equipment, model-manufacturer mismatch, incompatible software version and model, and dual protection sets from the same manufacturer. The low-risk anomalies include duplicate physical IDs, duplicate dispatch names, and errors in data entry by the operation and maintenance unit.

11. The method according to claim 9, characterized in that, The causes of the anomalies include duplicate physical ID / scheduling name entries, configuration conflicts, improper parameter settings, errors in data entry by the operation and maintenance unit, non-compliance of protection dualization configuration with specifications, and mismatch between circuit breaker protection configuration and substation type.

12. A relay protection ledger information anomaly detection device based on graph embedding, characterized in that, include: The data acquisition module is used to collect primary equipment topology data and relay protection ledger data of the power system, associate the primary equipment topology data and the relay protection ledger data, clarify the corresponding relationship between protection devices and primary equipment and substations, and form a standard dataset. The construction module is used to construct a heterogeneous graph of relay protection ledger based on the standard dataset, and to perform representation learning on the heterogeneous graph of relay protection ledger based on the graph embedding model to generate node embedding vectors. The detection module is used to perform ledger anomaly detection based on the node embedding vector, combined with primary equipment topology features and relay protection business rules, to obtain a comprehensive anomaly score, and to determine anomalies based on the comprehensive anomaly score threshold. The traceability module is used to classify the anomalies into multiple preset levels based on the primary equipment topology, locate the abnormal nodes and their relationships based on the primary equipment topology, trace the cause of the anomalies, and output an anomaly detection report. The update module is used to periodically collect new primary equipment topology data and relay protection ledger data, add them to the standard dataset, fine-tune the graph embedding model, and update the comprehensive anomaly score threshold and weight coefficients.

13. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for performing the method described in any one of claims 1-11.

14. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1-11.

Images