An autonomous anti-meta spatiotemporal network driven unmanned inspection data detection method

Abstract

The application relates to the technical field of power information security protection, and discloses an unmanned inspection data detection method driven by an autonomous confrontation meta spatiotemporal network, which is realized through the cooperation of four innovative modules: a spatiotemporal coupling feature learning module extracts multi-scale dynamic correlation features based on a device topology correlation matrix and a causal inflation convolution; a dynamic constraint generative adversarial network embeds a power balance equation and other physical laws to generate compliance anomaly samples; a meta spatiotemporal detector realizes the rapid adaptation and group collaborative verification of new attacks through a differentiable memory matrix and a double-layer update strategy; and a closed-loop optimization engine combines spatiotemporal gradient normalization and light distillation technology to drive millisecond-level response of an edge and autonomous evolution of a defense strategy, thereby forming an end-to-end defense system with physical rationality, dynamic adaptability and real-time response capability.

Description

Technical Field

[0001] This invention relates to the field of power information security protection technology, and in particular to an unmanned inspection data detection method driven by an autonomous adversarial spatiotemporal network. Background Technology

[0002] With the increasing intelligence of power systems, unmanned inspection terminals are playing an increasingly important role in the daily maintenance and monitoring of power facilities. In unmanned inspection systems, terminal devices (such as drones and robots) generate a large amount of spatiotemporal data during task execution, including environmental perception data, equipment status information, and location information. This data is crucial to the accuracy and efficiency of inspection tasks. Terminal devices collect data through sensors and transmit it to a central server or cloud via wireless networks for monitoring, control, and data analysis, providing real-time data support for the safe operation of the power system. However, due to their open communication methods, complex working environment, and remote communication characteristics, unmanned inspection terminals face the risk of cyberattacks, especially data tampering and denial-of-service (DoS) attacks. This can lead to false alarms or missed alarms, seriously threatening the stability and security of the power system.

[0003] Drone inspection data typically contains spatiotemporal characteristics, meaning the data changes with time and spatial location, often in a non-linear and sparse manner. Traditional anomaly detection methods, such as rule-based detection and statistical analysis, often struggle to handle highly dynamic and complex attack patterns, relying heavily on human experience for parameter selection and lacking effective automated optimization tools. While machine learning-based methods have advantages in handling non-linear data, providing probabilistic outputs, and sparse solutions, they require more computational resources and time, posing a bottleneck on edge computing devices, and are prone to misjudgments when dealing with data sparsity and environmental noise interference. Therefore, developing a detection method that can effectively identify anomalies in drone inspection terminal data, while possessing good generalization ability and adaptability, is urgently needed.

[0004] Chinese patent document CN115085898A discloses a "method for detecting anomalies in UAV data based on homomorphic encryption." The scheme includes: 1) A trusted key server verifies the identity of the cloud server and distributes a public key to it, and distributes a private key to the intelligent terminal of the UAV swarm; 2) The terminal homomorphically encrypts the UAV swarm data using the private key and sends it to the cloud server; 3) The cloud server constructs an isolated forest model using the encrypted data, uses this model to detect the encrypted data, and sends the detection result to the intelligent terminal of the UAV swarm; 4) The terminal decrypts the detection result using the private key, calculates the anomaly score of the encrypted data, and achieves data anomaly detection. However, the above technical solution is insufficient to cope with highly dynamic and complex attack patterns, and can only passively determine whether the data is abnormal, failing to effectively improve protection capabilities. Summary of the Invention

[0005] This invention primarily addresses the technical problem that existing technical solutions struggle to cope with highly dynamic and complex attack patterns, passively determining data anomalies and failing to effectively improve protection capabilities. It provides an autonomous, adversarial, spatiotemporal network-driven unmanned inspection data detection method. Through closed-loop interaction between a spatiotemporal coupling constraint generation module and a meta-optimizer, an autonomously evolved anomaly detection architecture is constructed. The generation module uses a dynamic graph convolutional network to embed device topology associations, ensuring that anomaly data conforms to electrical physics laws. The detector compares spatiotemporal prototype deviations based on a differentiable memory matrix, and the meta-optimizer adjusts the adversarial strength and decision threshold in real time. A lightweight spatiotemporal distillation algorithm compresses model complexity, and the computation path is optimized by combining edge hardware characteristics. This achieves efficient fusion of multi-dimensional features and online identification of attack patterns, forming an end-to-end defense system with physical rationality, dynamic adaptability, and real-time response capabilities.

[0006] The above-mentioned technical problems of the present invention are mainly solved by the following technical solutions: The present invention includes: Collect multi-dimensional spatiotemporal data from unmanned power inspection terminals and perform spatiotemporal coupled data preprocessing. Multi-scale spatiotemporal features are extracted based on dynamic graph convolutional networks to generate spatiotemporal coupled feature tensors with dimensions of N×T×D; a dynamic constraint generative adversarial network is launched, the generator generates anomalous samples through physical embedding graph convolutional layers, power balance constraints are verified simultaneously, and the discriminator calculates the spatiotemporal consistency loss. The meta-optimizer dynamically adjusts the generation intensity and discrimination threshold based on real-time detection feedback; The meta-optimizer dynamically adjusts the generation adversarial strength and detection sensitivity based on bus data, and periodically updates the global settings.

[0007] As a preferred approach, multi-dimensional spatiotemporal data of the unmanned power inspection terminal under normal operating conditions are collected, including UAV trajectory coordinates and sensor time-series readings, as well as equipment status parameters and communication link quality indicators, and spatiotemporal feature pattern library of known attack cases is integrated simultaneously.

[0008] As a preferred approach, spatiotemporal coupled data preprocessing is performed to clean up environmental noise and missing values, a spatial constraint framework is constructed through the device topology association matrix, and a causal sliding window is used to normalize and align the time series data.

[0009] As a preferred approach, electromagnetic interference is suppressed by a noise countermeasure layer, and transient fluctuations, medium-term trends and long-term periodic features are fused by a gated attention mechanism to generate a spatiotemporally coupled feature tensor with dimensions N×T×D, where N is the number of device nodes, T is the time step and D is the number of feature channels.

[0010] As a preferred approach, the meta-optimizer dynamically adjusts the generation intensity and discrimination threshold based on real-time detection feedback, updates the generator strategy gradient through a gradient normalization algorithm, and coordinates the parameter update directions of the generator and detector.

[0011] Preferably, the meta-spatiotemporal detector calculates the spatiotemporal deviation based on a differentiable memory matrix, and combines it with a device group collaborative verification module to eliminate isolated noise interference.

[0012] Preferably, the abnormal probability output is dynamically calibrated, where the dynamic threshold μ t With sensitivity coefficient σ t By updating online through exponential smoothing, when the anomaly probability P... anomaly ≥μ t When an anomaly occurs, a progressive response strategy is triggered: a primary anomaly initiates a spatiotemporal correlation review, while a severe deviation results in the blocking of the communication link and activation of the manual intervention interface.

[0013] As a preferred option, the detection model is compressed using lightweight spatiotemporal distillation technology to adapt to the heterogeneous computing architecture of edge terminals.

[0014] As a preferred method, the spatiotemporal state bus synchronously transmits gradient parameters, anomaly feedback, and control commands, and the meta-optimizer dynamically adjusts the generation of adversarial strength and detection sensitivity based on the bus data.

[0015] Preferably, the incremental learning triggered by confirmed attack samples is used to quickly update the prototype library through meta-gradient rules, periodically perform global updates of the base layer, re-cluster the prototype based on device baseline data, and maintain the long-term stability of the normal mode library.

[0016] The beneficial effects of this invention are as follows: Through the closed-loop interaction between the spatiotemporal coupling constraint generation module and the meta-optimizer, an autonomously evolved anomaly detection architecture is constructed. The generation module uses a dynamic graph convolutional network to embed device topology associations to ensure that the abnormal data conforms to the laws of electrical physics. The detector compares the spatiotemporal prototype deviation based on the differentiable memory matrix, adjusts the adversarial strength and decision threshold in real time through the meta-optimizer, compresses the model complexity using a lightweight spatiotemporal distillation algorithm, and optimizes the calculation path by combining the characteristics of edge hardware. This achieves efficient fusion of multi-dimensional features and online identification of attack patterns, forming an end-to-end defense system that combines physical rationality, dynamic adaptability, and real-time response capabilities. Attached Figure Description

[0017] Figure 1 This is a flowchart of the present invention.

[0018] Figure 2 This is a schematic diagram of a system structure according to the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this application will be further described in detail below through embodiments and in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only one preferred embodiment of this application and are only used to explain this application. They do not limit the scope of protection of this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0020] The technical solution of the present invention will be further described in detail below through embodiments and in conjunction with the accompanying drawings.

[0021] Example: This example describes an unmanned inspection data detection method driven by an autonomous adversarial spatiotemporal network, such as... Figure 1 As shown, it includes the following steps: S1 collects multi-dimensional spatiotemporal data from unmanned power grid inspection terminals and performs spatiotemporal coupled data preprocessing. It collects multi-dimensional spatiotemporal data of the terminals under normal operating conditions, including UAV trajectory coordinates, sensor time-series readings, equipment status parameters, and communication link quality indicators, while simultaneously integrating spatiotemporal feature pattern libraries of known attack cases. Spatiotemporal coupled data preprocessing is performed to remove environmental noise and missing values, construct a spatial constraint framework through the device topology correlation matrix, and normalize and align the time-series data using a causal sliding window.

[0022] S2 extracts multi-scale spatiotemporal features based on a dynamic graph convolutional network. This computational network embeds topological constraints in the spatial dimension through graph convolution operations. Specifically, it constructs a topological graph with devices as graph nodes and physical connections between devices as edges. Node features include device state parameters and spatial coordinates, while edge weights are determined by the electrical connection strength between devices, communication link quality, and spatial distance attenuation coefficient. In the spatial dimension, a dynamic graph convolutional network is constructed using three ChebNet graph convolutional layers based on Chebyshev multinomials: the first layer captures the state interactions of direct neighbors, the second layer integrates the topological associations of second-order neighborhoods, and the third layer extracts the cooperative patterns of the entire device group, meeting the multi-scale topological constraint requirements of the power system. In the temporal dimension, strictly causal convolution is employed. Specifically, the temporal perception range is expanded through three layers of dilated causal convolutional kernels. Layered convolutions are performed on the feature sequences at each time step. The bottom layer uses causal convolutional kernels with a smaller dilation rate to capture short-term transient fluctuations, while the higher layers use causal convolutional kernels with a larger dilation rate to extract long-term trends and periodic features. Electromagnetic interference is suppressed by injecting Gaussian noise into the input data and minimizing the feature differences before and after the noise disturbance. This network extracts sequence features by stacking multiple convolutional layers. Then, it integrates transient fluctuations, medium-term trends, and long-term periodic features using a gated attention mechanism. This fusion employs cascading sliding windows to separately acquire transient, medium-term trend, and long-term periodic features, forming feature vector sets at different time scales. The attention weights are jointly generated by the topological correlation matrix and the correlation of temporal features. Based on the generated weight coefficients, the multi-scale features are weighted and summed. Finally, a spatiotemporally coupled feature tensor of dimension N×T×D is generated, where N is the number of device nodes, T is the time step, and D is the number of feature channels.

[0023] S3 initiates a dynamic constraint generative adversarial network. The generator generates anomalous samples through a physical embedding graph convolutional layer, simultaneously verifies the power balance constraint, and the discriminator calculates the spatiotemporal consistency loss. The S4 meta-optimizer dynamically adjusts the generation intensity and discrimination threshold based on real-time detection feedback. It updates the generator policy gradient using a gradient normalization algorithm, coordinating the parameter update directions of the generator and detector. The meta-spatiotemporal detector calculates spatiotemporal deviation based on a differentiable memory matrix and, in conjunction with a device group collaborative verification module, eliminates isolated noise interference.

[0024] Dynamically calibrate the anomaly probability output, where the dynamic threshold μ t With sensitivity coefficient σ t Updated online via exponential smoothing.

[0025] When the anomaly probability P anomaly ≥μ t When an anomaly occurs, a progressive response strategy is triggered: a primary anomaly initiates a spatiotemporal correlation review, while a severe deviation results in the blocking of the communication link and activation of the manual intervention interface.

[0026] The detection model is compressed using lightweight spatiotemporal distillation technology to adapt to the heterogeneous computing architecture of edge terminals.

[0027] The S5 meta-optimizer dynamically adjusts the generated adversarial strength and detection sensitivity based on bus data, and periodically updates it globally. The spatiotemporal state bus synchronously transmits gradient parameters, anomaly feedback, and control commands, and the meta-optimizer dynamically adjusts the generated adversarial strength and detection sensitivity based on the bus data.

[0028] Incremental learning is triggered for confirmed attack samples, the prototype library is updated quickly through meta-gradient rules, the base layer global update is performed periodically, the prototype is re-clustered based on device baseline data, and the long-term stability of the normal mode library is maintained.

[0029] Through the closed-loop interaction between the spatiotemporal coupling constraint generation module and the meta-optimizer, an autonomously evolved anomaly detection architecture is constructed. The generation module uses a dynamic graph convolutional network to embed device topology associations to ensure that abnormal data conforms to the laws of electrical physics. The detector compares the spatiotemporal prototype deviation based on the differentiable memory matrix, and adjusts the adversarial strength and decision threshold in real time through the meta-optimizer. It uses a lightweight spatiotemporal distillation algorithm to compress model complexity and optimizes the calculation path in combination with edge hardware characteristics to achieve efficient fusion of multi-dimensional features and online identification of attack patterns, forming an end-to-end defense system with physical rationality, dynamic adaptability and real-time response capabilities.

[0030] Example 2 The autonomous adversarial spatiotemporal network-driven unmanned inspection data tampering detection method mainly needs to consider two aspects: (1) How to generate high-quality anomaly samples that conform to the spatiotemporal dynamic characteristics of power equipment: In scenarios where real attack data is scarce and noise interference is significant, it is necessary to construct a generation mechanism that can accurately simulate the spatiotemporal propagation law of tampering attacks. This mechanism needs to deeply couple the topological associations and temporal evolution characteristics between devices so that the generated samples not only reflect the sparse distribution characteristics of attack behavior but also follow the physical constraints of the power system. By dynamically adjusting the generation strategy through an autonomous adversarial training framework, it is ensured that the anomaly patterns are highly consistent with real attacks in the spatiotemporal dimension, thereby effectively supporting the improvement of the generalization ability of the detection model.

[0031] (2) How to achieve online self-optimization of detection model parameters: A meta-learning-driven dynamic adjustment mechanism needs to be designed to enable the model to autonomously optimize the spatiotemporal weight distribution based on real-time data features. Through closed-loop feedback between the generation and detection stages, a collaborative optimization process of adversarial enhancement and defense strategy iteration is formed. This mechanism needs to balance the matching of model complexity and edge computing resources, and achieve efficient fusion of multi-dimensional features and accurate identification of abnormal patterns under limited computing power constraints, thereby constructing a dynamic defense system that adapts to the evolution of complex attacks.

[0032] This invention proposes a real-time detection method for unmanned inspection data tampering based on an autonomous adversarial spatiotemporal network. It aims to construct a lightweight defense system under a dynamic closed-loop game mechanism without relying on prior attack samples. By coupling the physical constraints of devices with spatiotemporal correlation characteristics, it solves the core problems of traditional methods, such as inaccurate attack mode simulation, rigid detection models, and insufficient adaptation to edge deployment. This improves the real-time identification accuracy of tampering attacks in complex electromagnetic environments and the self-evolution capability of defense strategies, providing a highly reliable and low-resource-consumption security protection solution for power inspection terminals.

[0033] This invention constructs an autonomously evolved anomaly detection architecture through closed-loop interaction between a spatiotemporally coupled constraint generation module and a meta-optimizer. The generation module employs a dynamic graph convolutional network to embed device topology associations. The generator uses a hierarchical graph convolutional architecture. In the low-level feature extraction stage, a normalized topology association matrix constrains the spatial feature propagation process. A power balance constraint layer is embedded in the high-level network: after the output of the last graph convolutional layer in the high-level network, a fully connected layer maps the features to the power parameter space. Then, based on Kirchhoff's laws, the node power balance is verified. Error backpropagation adjusts the parameters of the previous layer to embed the power balance constraint layer, ensuring that the anomaly data conforms to the laws of electrical physics. The detector calculates the spatiotemporal prototype deviation based on a differentiable memory matrix. The spatiotemporal deviation is calculated using a composite metric method to generate a preliminary anomaly score. The meta-optimizer adjusts the adversarial strength and decision threshold in real time: a group collaborative verification module is used for analysis, which judges anomalies based on the current device deviation and adjacent nodes through spatiotemporal association. The incremental layer update of the meta-optimizer's memory matrix is ​​only for samples confirmed as new types of attacks, while the basic layer update is executed asynchronously during system idle periods. By employing a lightweight spatiotemporal distillation algorithm to compress model complexity and optimizing computational paths based on edge hardware characteristics, we achieve efficient fusion of multi-dimensional features and online identification of attack patterns, forming an end-to-end defense system that combines physical rationality, dynamic adaptability, and real-time response capabilities.

[0034] like Figure 2 As shown, the architecture of the real-time detection system for unmanned inspection data tampering based on the autonomous adversarial meta-spatiotemporal network is presented, which includes four core modules: spatiotemporal coupled feature learning, dynamic constraint generative adversarial network, meta-spatiotemporal detector, closed-loop optimization engine and anomaly early warning. Figure 2The spatiotemporal coupling feature learning module extracts dynamic correlation features between power equipment through joint modeling of device topology association matrices and temporal causal convolutions, eliminating the interference of environmental noise on the spatiotemporal feature expression. The dynamic constraint generative adversarial network adopts a physical embedding graph convolutional layer to simultaneously satisfy power system constraints such as power balance equations when generating abnormal samples, ensuring the physical rationality of the attack mode. The meta-spatiotemporal detector is built based on a differentiable memory matrix and achieves accurate identification of tampering behavior by comparing the spatiotemporal deviation between real-time data and normal mode prototypes. The closed-loop optimization engine and the anomaly warning module integrate an online adaptive mechanism to dynamically adjust the detection sensitivity according to the spatiotemporal evolution characteristics of the real-time data stream. Lightweight spatiotemporal distillation technology is used to compress model complexity and adapt to the heterogeneous computing architecture of edge terminals. All modules are interconnected through a spatiotemporal state bus to form a closed-loop game system of generation, detection, and optimization, realizing the continuous autonomous evolution of defense strategies.

[0035] Specifically, it includes: Spatiotemporal coupled feature learning: A device topology correlation matrix is ​​constructed, fusing spatial correlation features such as UAV trajectories and sensor network layout. Temporal causal convolution is used to capture the dynamic patterns of power equipment state evolution. A meta-gradient-driven feature optimization mechanism is employed, introducing a noise adversarial layer during the feature extraction stage to dynamically suppress the impact of environmental interference and system errors on spatiotemporal feature representation. Multi-scale spatiotemporal feature fusion is achieved through a sliding causal window, providing a high-fidelity device operation benchmark mode for subsequent generative adversarial training.

[0036] Dynamically Constrained Generative Adversarial Network (GAN): The generator employs a hierarchical graph convolutional architecture. The bottom layer consists of topologically constrained graph convolutional layers, which propagate constrained spatial features through a normalized topological correlation matrix. A power balance constraint layer is embedded in the higher layers, following the last graph convolutional layer. Specifically, this layer includes a fully connected layer that maps the graph convolutional output features to the power system's key parameter space. A power balance equation verification module based on Kirchhoff's laws calculates the difference between the injected and outflowing power at each node in the generated samples. If the difference exceeds a threshold, gradient backpropagation is triggered to adjust the generator parameters, ensuring that the generated samples meet the power system's steady-state operation constraints. The discriminator integrates a spatiotemporal consistency verification module. First, it reduces computational complexity through feature mapping compression: after reducing the dimensionality of the high-dimensional features output by the generator in the convolutional layers while retaining multi-scale spatiotemporally sensitive features, it uses an average pooling layer to downsample the spatiotemporal dimension. Then, it retains multi-scale spatiotemporally sensitive features: causal convolutional kernels with different dilation rates are set in parallel to extract multi-scale temporal features from the dimensionality-reduced features. Finally, a concatenation operation fuses features from different scales, ensuring that spatiotemporally sensitive features are not lost. The meta-optimizer dynamically adjusts the generation intensity based on real-time attack detection feedback, achieving a precise balance between attack diversity and physical feasibility.

[0037] The meta-spatiotemporal detector is constructed as follows: a normal behavior prototype library is built based on a differentiable memory matrix. The spatiotemporal deviation is used to measure the probability of anomalies in real-time data. The spatiotemporal deviation calculation employs a composite measurement method: based on the normal behavior prototype library built on the differentiable memory matrix, it simultaneously measures the individual feature deviations between real-time data and prototypes, as well as the differences in device group collaborative modes. The memory matrix adopts a two-layer update strategy: the base layer is periodically refreshed based on the device operating baseline, and prototypes are re-clustered based on the device baseline data within a sliding window, with decay weights introduced during the update process. The incremental layer rapidly captures novel attack features through online meta-learning: when continuous deviation samples are detected, mini-batch gradient descent is used to fine-tune the relevant prototype vectors, while regularization constraints are added to prevent prototypes from deviating from the essential features of normal modes. At the detector output, the dynamic threshold and sensitivity coefficient are updated online using an exponential smoothing algorithm to calibrate the anomaly probability. The device group spatiotemporal correlation verification and group collaborative verification mechanisms are used to suppress edge computing errors, achieving coupling of the spatiotemporal confidence calibration module, eliminating cumulative error interference in edge computing environments, and improving detection robustness in low signal-to-noise ratio scenarios.

[0038] Closed-loop optimization engine and anomaly early warning: A spatiotemporal gradient normalization algorithm is designed to simultaneously constrain the parameter update directions of the generation network and the detection model during the optimization process. This algorithm first performs L2 norm normalization on the original gradient, and then dynamically adjusts the gradient scaling using a tanh function with a temperature coefficient to ensure that the parameter update directions of the generation network and the detection model are consistent. By constructing a teacher-student model architecture, the teacher model outputs a multi-scale spatiotemporal feature tensor, and the student model approximates the feature distribution of the teacher model through a learnable projection matrix and spatiotemporal pooling operations. Lightweight spatiotemporal distillation technology is used to compress model complexity and adapt to the heterogeneous computing architecture of edge terminals. The early warning module adopts a progressive response strategy: when the spatiotemporal deviation exceeds the dynamic threshold, a graded handling mechanism is triggered—a primary anomaly initiates a data review process, and a severe deviation immediately blocks the communication link and activates manual intervention. Each module achieves millisecond-level information synchronization through a spatiotemporal state bus, forming an autonomous evolutionary closed loop of attack simulation, feature learning, and defense optimization.

[0039] The specific process includes: Spatiotemporal coupling feature learning The spatiotemporal coupling feature learning module achieves quantitative modeling of the spatial relationships of power equipment by constructing a dynamic equipment topology association matrix. First, an equipment topology association matrix is ​​constructed based on UAV flight paths and sensor network layout. Each element of this matrix comprehensively considers the electrical connection strength between equipment, spatial distance attenuation effects, and communication link quality. UAV inspection path planning data is simultaneously embedded during the matrix construction process to ensure that the spatial association weights accurately reflect the observation coverage characteristics.

[0040] In the temporal dimension, a Dilated Causal Convolution network is employed to model the evolution of device states. This operation constrains device relationships through matrices in the spatial dimension and captures long-term dependencies through dilated causal convolution in the temporal dimension. The network embeds topological constraints through graph convolution operations to ensure that spatial feature propagation conforms to the correlation characteristics of the device group; in the temporal dimension, strictly causal convolution is used, relying only on historical data to generate current features, avoiding future information leakage.

[0041] To suppress environmental noise and system error interference, this module also injects random Gaussian noise during the feature extraction stage. By comparing the consistency of features before and after noise perturbation, an adversarial optimization objective is constructed. The core of this mechanism lies in jointly optimizing the main feature extraction task and noise robustness constraints, and dynamically adjusting the gradient contribution weights of the two through a meta-learning controller. Multi-scale fusion uses a cascaded sliding window to extract transient, trend, and periodic features, which are then aggregated through gated attention weighting. The attention weights are jointly generated by the topological correlation matrix and the correlation of temporal features. The final output is a fusion feature tensor with dimensions of N×T×D, where N is the number of device nodes, T is the time step, and D is the number of feature channels, providing a high-fidelity spatiotemporal benchmark for downstream modules.

[0042] Dynamically constrained generative adversarial networks The core of this module lies in generating anomalous samples that conform to the operating laws of the power system through physical constraint embedding and dynamic adversarial game theory, while ensuring the spatiotemporal rationality of the attack patterns. The generator adopts a hierarchical graph convolutional architecture. In the low-level feature extraction stage, it constrains the spatial feature propagation process through a normalized topological correlation matrix. In the high-level network, a power balance constraint layer is embedded to force the generated samples to meet the steady-state operating conditions of the power system. Its physical constraint loss is incorporated into the generator's optimization objective through the Lagrange multiplier method, ensuring that the anomalous samples conform to Kirchhoff's laws in key parameters such as voltage amplitude and phase angle, thus fundamentally guaranteeing that the generated attack patterns conform to the physical laws of the power system. The discriminator adopts a multi-scale spatiotemporal consistency verification mechanism. By comparing the differences between the generated data and the spatiotemporal correlation patterns of the real equipment group, a composite spatiotemporal adversarial loss function is constructed, forcing the generated samples to retain the statistical characteristics of the spatiotemporal interaction of the equipment group and avoiding the generation of anomalous patterns that deviate from the real physical laws.

[0043] The meta-optimizer dynamically adjusts the generation intensity and discrimination threshold based on real-time attack detection feedback. When the false rejection rate exceeds the threshold, it automatically increases the weight of physical constraints to strengthen the compliance of generated samples; conversely, it enhances the adversarial freedom to improve attack diversity, thereby achieving a precise balance between attack diversity and physical feasibility.

[0044] Furthermore, the generator incorporates a causal attention mechanism, dynamically monitoring the state evolution of key device nodes during the time-series generation process. Its attention weight is jointly determined by the device topology correlation and historical state residuals. The discriminator also integrates a lightweight spatiotemporal distillation module, reducing computational complexity through feature mapping compression while preserving multi-scale spatiotemporally sensitive features. During adversarial training, the generator gradually learns to simulate covert attack patterns with spatiotemporal propagation characteristics while satisfying hard constraints such as power balance and electromagnetic compatibility. The discriminator, through fine-grained comparison of the spatiotemporal correlation matrix, identifies anomalies in the generated samples that violate the collaborative laws of the device group. Finally, the meta-optimizer dynamically balances the diversity and physical feasibility of the generated samples based on false positives / false negatives from the online detection module, forming an adaptive offensive and defensive game system that adapts to changes in the power environment.

[0045] Construction of the meta-space-time detector This module constructs a spatiotemporal prototype library of normal device behavior using a differentiable memory matrix, enabling precise measurement of anomaly probabilities. First, a memory matrix M is defined, where each row stores a normal mode prototype, initialized as the cluster center of historical data. A composite measurement method is used to calculate spatiotemporal deviation; this design ensures that the anomaly score reflects both individual device state deviations and captures anomalous fluctuations in the collaborative patterns of a group of devices.

[0046] A two-layer collaborative update strategy is employed for the memory matrix. First, the base layer update is performed periodically, re-clustering prototypes based on device baseline data within a sliding window to preserve long-term stable operating patterns. A decay weight is introduced during the update process, with more recent data receiving higher weights, ensuring that the prototypes dynamically reflect the natural drift of device states. Second, the incremental layer update is implemented through online meta-learning. When continuously deviating samples are detected, mini-batch gradient descent is used to fine-tune the relevant prototype vectors, while regularization constraints are added to prevent prototypes from deviating from their essential normal features. This design allows for the rapid capture of novel attack features while avoiding prototype library contamination due to short-term noise interference.

[0047] Anomaly probability P anomaly The dynamic threshold calibration module maps the output to confidence levels, and its dynamic threshold and sensitivity coefficient are updated online using an exponential smoothing algorithm. When environmental noise increases, the sensitivity coefficient automatically widens the threshold to reduce false alarms; when the system is stable, the threshold is tightened to improve detection sensitivity.

[0048] In the anomaly detection process, real-time data is first compared with all prototypes to calculate spatiotemporal deviation, generating a preliminary anomaly score. Subsequently, the group collaborative verification module intervenes for analysis: if the current device has a high deviation, but the spatiotemporal correlation pattern of adjacent nodes is normal, it is determined to be transient noise, and the anomaly probability is reduced; conversely, if the group collaborative pattern is abnormal, it is confirmed as a potential attack. Incremental updates to the memory matrix are only applied to samples confirmed as novel attacks, optimizing prototype vectors through lightweight meta-learning, while base layer updates are performed asynchronously during system idle periods. The final output anomaly probability value includes both single-device state analysis and the results of group collaborative verification. Low-latency transmission and storage are achieved through edge-optimized tensor serialization, ensuring stable detection robustness even under complex electromagnetic interference.

[0049] Closed-loop optimization engine and anomaly warning This module achieves autonomous evolution of the defense strategy through spatiotemporal gradient co-optimization and a hierarchical response mechanism. The spatiotemporal gradient normalization algorithm ensures the consistency of parameter update directions between the generator network and the detection model. Its synchronous constraint generator counteracts the loss gradient and the detector prototype update gradient, avoiding optimization direction conflicts and suppressing the gradient explosion problem, thus improving training stability. The normalized gradient is distributed to each sub-module through a meta-optimizer, prioritizing parameter updates for critical paths (such as the physical constraint layer and spatiotemporal correlation verification).

[0050] Lightweight spatiotemporal distillation technology can transfer knowledge from complex detection models to edge-adapted versions. The teacher model outputs multi-scale spatiotemporal features, while the student model approximates the teacher feature distribution using a learnable projection matrix. This distillation process compresses the number of model parameters to less than 30% of the original version while maintaining detection accuracy, making it better suited to the heterogeneous computing architectures of edge terminals.

[0051] A progressive response strategy requires dynamic triggering of tiered handling based on spatiotemporal deviation: when P anomaly ∈[μ t μ t +2σ t When P is active, a primary exception response is initiated. anomaly ≥μ t +2σ t A severe anomaly response is initiated. Initial anomalies trigger a data review process, performing spatiotemporal correlation verification on suspected attack data; in cases of severe deviation, the communication link is immediately blocked, and a manual intervention interface is activated, while a snapshot of the scene is retained for source tracing and analysis.

[0052] Each module achieves millisecond-level information synchronization via a spatiotemporal state bus: the bus adopts a publish-subscribe architecture, and the transport layer protocol is optimized to a lightweight binary stream format, supporting low-latency exchange of multimodal data (feature tensors, gradient parameters, control commands). The optimization engine monitors the gradient distribution and anomaly feedback in the bus in real time, dynamically adjusting the generation adversarial strength, detection sensitivity, and response threshold, forming a closed-loop iteration of "attack simulation → feature learning → defense optimization". For example, when the anomaly confirmation rate in the bus continues to rise, the meta-optimizer will increase the physical constraint weight of the generator, forcing the generated attack samples to be closer to real physical laws; at the same time, it will lower the detector threshold to improve sensitivity, forming a dynamically balanced attack and defense game.

[0053] Main workflow: (1) The spatial correlation characteristics of UAV trajectory, sensor layout and power equipment are modeled by the equipment topology correlation matrix. The equipment state evolution characteristics are extracted by combining temporal causal convolutional network, dilated convolution is used to expand the temporal perception range, and environmental interference is suppressed by dynamic noise adversarial mechanism. Finally, a multi-scale fused spatiotemporal feature tensor is output to provide high-fidelity input for subsequent modules.

[0054] (2) The generator embeds a power balance constraint layer to force the generated samples to meet the laws of electrical physics and calculates their constraint loss. The discriminator constructs a composite adversarial loss through a spatiotemporal consistency verification module. The meta-optimizer dynamically adjusts the generation intensity and physical constraint weights based on real-time detection feedback to ensure that the generated samples have both attack diversity and physical compliance.

[0055] (3) A normal behavior prototype library is constructed based on a differentiable memory matrix. The spatiotemporal deviation is calculated by combining individual characteristic deviations and group collaboration mode differences. The prototype library is stably evolved through a two-layer update strategy. The dynamic threshold calibration module adjusts the abnormal judgment boundary online through exponential smoothing to suppress edge environmental noise interference.

[0056] (4) Lightweight spatiotemporal distillation technology is used to compress model complexity and adapt to edge terminals. The progressive response strategy is based on dynamic threshold triggering and hierarchical processing, and millisecond-level information synchronization is achieved through spatiotemporal state bus to form an autonomous evolution closed loop of "attack simulation-feature learning-defense optimization" to ensure the real-time performance of detection and the adaptability of defense strategy.

[0057] like Figure 1 As shown, the entire execution process mainly includes the following steps: Step 1: Collect multi-dimensional spatiotemporal data of the unmanned power inspection terminal under normal operating conditions, including UAV trajectory coordinates, sensor time-series readings, equipment status parameters and communication link quality indicators, and simultaneously integrate the spatiotemporal feature pattern library of known attack cases; proceed to Step 2; Step 2: Perform spatiotemporal coupled data preprocessing, clean up environmental noise and missing values, construct a spatial constraint framework through the device topology association matrix, and normalize and align the time series data using a causal sliding window; proceed to Step 3; Step 3: Extract multi-scale spatiotemporal features based on dynamic graph convolutional networks, suppress electromagnetic interference through noise adversarial layers, and fuse transient fluctuations, medium-term trends, and long-term periodic features by combining gated attention mechanisms to generate a spatiotemporal coupled feature tensor with dimensions N×T×D; proceed to step 4. Step 4: Start the dynamic constraint generative adversarial network. The generator generates anomalous samples through the physical embedding graph convolutional layer, and simultaneously verifies the power balance constraint. The discriminator calculates the spatiotemporal consistency loss. Proceed to Step 5. Step 5: The meta-optimizer dynamically adjusts the generation intensity and discrimination threshold based on real-time detection feedback, updates the generator policy gradient through gradient normalization algorithm, and coordinates the parameter update directions of the generator and detector; proceed to step 6. Step 6: The meta-spatiotemporal detector calculates the spatiotemporal deviation based on the differentiable memory matrix, and eliminates isolated noise interference by combining the device group collaborative verification module; proceed to step 7; Step 7: Dynamically calibrate the anomaly probability output, where μ t With σ t Update online via exponential smoothing; proceed to step 8; Step 8: When P anomaly ≥μ t When this occurs, a progressive response strategy is triggered: for primary anomalies, a spatiotemporal correlation review is initiated; for severe deviations, the communication link is blocked and the manual intervention interface is activated; proceed to step 9. Step 9: Compress the detection model using lightweight spatiotemporal distillation technology to adapt it to the heterogeneous computing architecture of edge terminals; Proceed to Step 10; Step 10: The spatiotemporal state bus synchronously transmits gradient parameters, anomaly feedback, and control commands. The meta-optimizer dynamically adjusts the generated adversarial strength and detection sensitivity based on the bus data; proceed to step 11. Step 11: Trigger incremental learning for confirmed attack samples and quickly update the prototype library using meta-gradient rules; proceed to Step 12; Step 12: Periodically perform a global update of the base layer, re-cluster the prototype based on the device baseline data, and maintain the long-term stability of the normal pattern library; proceed to Step 13; Step 13: Loop ends.

[0058] Specifically, it includes: Spatiotemporal coupled feature learning: A device topology correlation matrix is ​​constructed, fusing spatial correlation features such as UAV trajectories and sensor network layout. Temporal causal convolution is used to capture the dynamic patterns of power equipment state evolution. A meta-gradient-driven feature optimization mechanism is employed, introducing a noise adversarial layer during the feature extraction stage to dynamically suppress the impact of environmental interference and system errors on spatiotemporal feature representation. Multi-scale spatiotemporal feature fusion is achieved through a sliding causal window, providing a high-fidelity device operation benchmark mode for subsequent generative adversarial training.

[0059] Dynamically Constrained Generative Adversarial Network (GAN): The generator employs a physically embedded graph convolutional architecture to simultaneously verify power balance constraints and electromagnetic compatibility conditions during the generation of anomalous samples, ensuring that attack patterns conform to the physical laws of the power system. The discriminator integrates a spatiotemporal consistency verification module, constructing a composite adversarial loss function by comparing the spatiotemporal correlation patterns between generated data and real device clusters. The meta-optimizer dynamically adjusts the generation intensity based on real-time attack detection feedback, achieving a precise balance between attack diversity and physical feasibility.

[0060] The meta-spatiotemporal detector is constructed by building a normal behavior prototype library based on a differentiable memory matrix, and measuring the probability of real-time data anomalies through spatiotemporal deviation. The memory matrix adopts a two-layer update strategy: the base layer is periodically refreshed based on the device's operating baseline, and the incremental layer quickly captures new attack features through online meta-learning. The detector output is coupled with a spatiotemporal confidence calibration module to eliminate cumulative error interference in edge computing environments and improve detection robustness in low signal-to-noise ratio scenarios.

[0061] Closed-loop optimization engine and anomaly early warning: A spatiotemporal gradient normalization algorithm is designed to simultaneously constrain the parameter update direction of the generation network and the detection model during the optimization process. Lightweight spatiotemporal distillation technology is used to compress model complexity, adapting to the heterogeneous computing architecture of edge terminals. The early warning module adopts a progressive response strategy: when the spatiotemporal deviation exceeds a dynamic threshold, a tiered handling mechanism is triggered—a primary anomaly initiates a data review process, while a severe deviation immediately blocks the communication link and activates manual intervention. All modules achieve millisecond-level information synchronization through a spatiotemporal state bus, forming an autonomous evolutionary closed loop of attack simulation, feature learning, and defense optimization.

[0062] Beneficial effects: This invention effectively improves the detection efficiency of unmanned inspection data tampering attacks through an autonomous adversarial meta-spatiotemporal network architecture. The spatiotemporal coupled feature learning module accurately models the dynamic associations of device groups, generating an adversarial network embedded with power physics constraints to ensure the compliance and diversity of anomalous samples. The meta-spatiotemporal detector, based on a differentiable memory matrix, achieves rapid attack adaptation and group collaborative verification, enhancing detection robustness in complex scenarios. The closed-loop optimization engine combines lightweight distillation technology and dynamic response strategies, balancing the real-time performance and resource efficiency of edge terminals. Overall, this forms an intrinsic security protection closed loop, providing the power system with adaptive and highly reliable proactive defense capabilities.

[0063] Example 3 A provincial power grid's 500kV smart substation deployed 10 intelligent inspection drones and 50 fixed sensor nodes to collect real-time data on equipment temperature, voltage waveforms, insulation status, etc. (sampling frequency 1kHz). Recently, the system suffered a GPS coordinate tampering attack. The attacker injected false location data, causing the drones to deviate from their preset inspection paths, threatening equipment safety. Traditional rule-based and statistical detection methods have a high false alarm rate of up to 35% against covert attacks and frequent false alarms (1.8%), necessitating the deployment of a new defense system.

[0064] Data Acquisition and Feature Extraction: Input data includes UAV track coordinates (longitude / latitude error <0.5m), sensor time-series data (voltage, temperature, etc., 20-dimensional features in total), and equipment topology parameters (electrical connection matrix, communication latency <2ms). First, data preprocessing is performed. After cleaning, the data integrity reaches 99.8% (original data missing rate 12%), and the spatiotemporal alignment error is reduced by 67% (from ±15ms to ±4ms). A spatiotemporal feature tensor is generated (N = 50 nodes × T = 120 time steps × D = 64 feature channels). Dynamically constrained generative adversarial network training: The optimized generator generates GPS offset attack samples with a maximum offset distance of 10m, which conforms to the dynamic constraints of UAVs and the power balance constraint error is <0.05% (traditional GAN ​​error >1.2%). The optimized discriminator has an attack detection accuracy of 98.7% (traditional method 82.1%) and a false alarm rate of 0.2% (traditional method 1.8%).

[0065] Anomaly detection and dynamic response: Setting the spatiotemporal deviation threshold: The mean of normal data μ = 0.12, the standard deviation σ = 0.02, the primary anomaly threshold is set to μ + σ = 0.16, and the severe anomaly threshold is set to μ + 3σ = 0.18. The actual anomaly detection result is in the form of: (1) GPS coordinates are injected with false positioning data (coordinate offset 8m): deviation s(x t)=0.35(>severe threshold), the system response action is to block the UAV control command and switch to the Beidou backup positioning module. The defense effect is that the UAV path deviation is corrected to within ±0.5m and no equipment collision alarm is triggered; (2) The temperature sensor is slowly injected with deviation (0.3℃ / min, lasting for 30min): the single node deviation s(x) is detected. t If the temperature difference between adjacent nodes exceeds the threshold (ΔT = 2.5℃), the response is to mark it as a primary anomaly and trigger collaborative verification of the device group. After confirmation, the sensor calibration program is started. The defense effect is that the attack is identified within 40 minutes and the temperature data error is corrected to ±0.1℃.

[0066] Edge deployment and model optimization: The lightweight detection model size was compressed to 3.5MB (original model 12.3MB), and the edge inference latency was 28ms. Furthermore, incremental learning showed significant improvement, reducing the adaptation time to new attack patterns from 2 hours to 18 minutes.

[0067] Example 4

[0068] Twenty drone inspection terminals were deployed on a 110kV ultra-high-voltage transmission line in a certain province to transmit insulator infrared thermal imaging data, flight trajectory coordinates, and corona discharge signals in real time. Recently, it was discovered that hackers attacked the line by tampering with the characteristic values ​​of the corona discharge signal and the temperature gradient of the insulator, creating a false appearance of normal partial discharge and injecting false temperature rise data. This caused the drones to miss insulator crack defects. Traditional detection methods have a 42% failure rate for this type of concealed data tampering and are also susceptible to misjudgment due to environmental electromagnetic interference.

[0069] During data acquisition and preprocessing, UAV track coordinates, infrared images, and equipment topology parameters are acquired simultaneously. A spatial constraint framework is constructed through the equipment topology correlation matrix, and a causal sliding window is used to normalize the time-series data. After cleaning, the data integrity reaches 99.8%, and the spatiotemporal alignment error is reduced from ±15ms to ±4ms.

[0070] The dynamic graph convolutional network employs three GAT layers in the spatial dimension, which enhance the feature aggregation of key towers through an attention mechanism. The weights are determined by the topological correlation of the equipment and the consistency of the data time sequence. In the temporal dimension, three layers of dilated causal convolution are used to extract the transient pulses of the corona signal, the medium-term trend of the temperature field, and the long-term periodic features. Combined with a noise countermeasure layer to suppress electromagnetic interference, a 50×120×32 spatiotemporal feature tensor is generated. The tampered temperature gradient data exhibits abrupt change patterns in the feature space that are inconsistent with the topological correlation.

[0071] In the dynamically constrained generative adversarial network (GAN), the generator is embedded with a power balance constraint layer. When simulating data tampering, it verifies the consistency of power parameters between temperature and discharge signals based on Kirchhoff's laws, ensuring that the generated anomalous samples conform to the thermal conduction laws of insulators. The discriminator identifies the break in the spatiotemporal correlation between the temperature field and the corona signal in the tampered data through multi-scale spatiotemporal feature comparison. After training, the detection accuracy for corona signal feature value tampering reaches 99.1%, and the false alarm rate is reduced to 0.15%.

[0072] The memory matrix base layer of the meta-spatiotemporal detector clusters prototypes daily based on normal inspection data, assigning higher attenuation weights to recent data; the incremental layer quickly updates the prototype library through meta-learning when it detects continuous deviation samples. When the corona signal deviation returned by a certain UAV reaches 0.38 (normal mean μ = 0.11, standard deviation σ = 0.015), and there is no coordinated anomaly in the temperature field of adjacent towers, the system determines that the discharge signal has been tampered with, immediately triggers the data verification process, and starts the backup sensor channel.

[0073] The lightweight spatiotemporal distillation technique compresses the model to 4.2MB, and the inference latency of the edge device carried by the drone is 35ms. In a real-world attack, the system identified abnormal corona signal characteristics 15 seconds after the data was injected with tampering, blocking the attack 3 minutes earlier than traditional methods. This prevented line tripping accidents caused by missed insulator cracks and verified the real-time defense capability against multi-dimensional data collaborative tampering.

[0074] The specific embodiments described herein are merely illustrative examples illustrating the spirit of the invention. The above embodiments only express several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of protection of this application. It should be noted that those skilled in the art to which this application pertains can make various modifications or additions to the described specific embodiments or use similar methods to replace them, but without departing from the spirit of this application or exceeding the scope defined by the appended claims. For those skilled in the art, multiple variations and improvements can be made without departing from the concept of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A method for unmanned inspection data detection driven by an autonomous adversarial spatiotemporal network, characterized in that, include: Collect multi-dimensional spatiotemporal data from unmanned power inspection terminals and perform spatiotemporal coupled data preprocessing. Multi-scale spatiotemporal features are extracted based on dynamic graph convolutional networks, generating spatiotemporal coupled feature tensors with dimensions N×T×D; A dynamic constraint generative adversarial network is launched. The generator generates anomalous samples through a physical embedding graph convolutional layer, simultaneously verifying the power balance constraint, and the discriminator calculates the spatiotemporal consistency loss. The meta-optimizer dynamically adjusts the generation intensity and discrimination threshold based on real-time detection feedback; The meta-optimizer dynamically adjusts the generation adversarial strength and detection sensitivity based on bus data, and periodically updates the global settings.

2. The unmanned inspection data detection method driven by an autonomous adversarial spatiotemporal network according to claim 1, characterized in that, Collect multi-dimensional spatiotemporal data of unmanned power inspection terminals under normal operating conditions, including UAV trajectory coordinates and sensor time-series readings, as well as equipment status parameters and communication link quality indicators, and simultaneously integrate spatiotemporal feature pattern libraries of known attack cases.

3. The unmanned inspection data detection method driven by an autonomous adversarial spatiotemporal network according to claim 1, characterized in that, Spatiotemporal coupled data preprocessing is performed to clean up environmental noise and missing values. A spatial constraint framework is constructed through the device topology association matrix, and a causal sliding window is used to normalize and align the time series data.

4. The unmanned inspection data detection method driven by an autonomous adversarial spatiotemporal network according to claim 1, characterized in that, Electromagnetic interference is suppressed by a noise countermeasure layer, and transient fluctuations, medium-term trends and long-term periodic features are fused by a gated attention mechanism to generate a spatiotemporally coupled feature tensor with dimensions N×T×D, where N is the number of device nodes, T is the time step and D is the number of feature channels.

5. The unmanned inspection data detection method driven by an autonomous adversarial spatiotemporal network according to claim 1, characterized in that, The meta-optimizer dynamically adjusts the generation intensity and discrimination threshold based on real-time detection feedback, updates the generator policy gradient through gradient normalization algorithm, and coordinates the parameter update directions of the generator and detector.

6. The autonomous adversarial spatiotemporal network-driven unmanned inspection data detection method according to claim 1 or 4, characterized in that, The meta-spatiotemporal detector calculates the spatiotemporal deviation based on a differentiable memory matrix, and combines it with a device group collaborative verification module to eliminate isolated noise interference.

7. The autonomous adversarial spatiotemporal network-driven unmanned inspection data detection method according to claim 1, 4, or 5, characterized in that, Dynamically calibrate the anomaly probability output, where the dynamic threshold μ t With sensitivity coefficient σ t By updating online through exponential smoothing, when the anomaly probability P... anomaly Exceeding the dynamic threshold μ t When an anomaly occurs, a progressive response strategy is triggered: a primary anomaly initiates a spatiotemporal correlation review, while a severe deviation results in the blocking of the communication link and activation of the manual intervention interface.

8. A method for unmanned inspection data detection driven by an autonomous adversarial spatiotemporal network according to claim 1 or 4, characterized in that, The detection model is compressed using lightweight spatiotemporal distillation technology to adapt to the heterogeneous computing architecture of edge terminals.

9. The unmanned inspection data detection method driven by an autonomous adversarial spatiotemporal network according to claim 1, characterized in that, The spatiotemporal state bus synchronously transmits gradient parameters, anomaly feedback, and control commands. The meta-optimizer dynamically adjusts the generated adversarial strength and detection sensitivity based on the bus data.

10. A method for unmanned inspection data detection driven by an autonomous adversarial spatiotemporal network according to claim 1 or 9, characterized in that, Incremental learning is triggered for confirmed attack samples, the prototype library is updated quickly through meta-gradient rules, the base layer global update is performed periodically, the prototype is re-clustered based on device baseline data, and the long-term stability of the normal mode library is maintained.

Images