A method and system for identifying abnormal electricity consumption behavior

Abstract

The present application relates to the technical field of electricity data detection, and provides a kind of identification method and system of abnormal electricity behavior.The implementation scheme is: the sample data corresponding to the electricity behavior of the object to be identified is obtained, based on the correlation and collinearity between each first sample feature and feature label, each first sample feature is dynamically screened to obtain second sample feature;Through adaptive decision tree model, the feature vector in second sample feature is stolen electricity probability prediction, and the target electricity stealing probability of the object to be identified is obtained;Through adaptive time-frequency fusion prediction model, the feature sequence in second sample feature is abnormally predicted, and the abnormal electricity score of the object to be identified is obtained;Based on dynamic probability threshold, the target electricity stealing probability and abnormal electricity score of the object to be identified are abnormally determined, and the abnormal electricity identification result of the object to be identified is obtained.The present application embodiment can improve the identification efficiency and precision.

Description

Technical Field

[0001] This invention relates to the field of electricity consumption data detection technology, and in particular to a method and system for identifying abnormal electricity consumption behavior. Background Technology

[0002] With the rapid development of power Internet of Things (IoT) technology, the scale of smart meters, sensing terminals, and edge data acquisition devices in power distribution networks continues to expand. This has led to a massive increase in the amount of electricity consumption data collected by these terminals, as well as complex characteristics such as high dimensionality and multi-source heterogeneity. Consequently, higher demands are placed on the rapid processing and accurate identification of abnormal electricity consumption behavior.

[0003] Traditional electricity theft detection methods lack effective feature filtering mechanisms, resulting in slow response speeds in identifying new types of electricity theft. Furthermore, the simplistic prediction models or fixed threshold mechanisms are prone to generating numerous false alarms in complex environments, making it difficult to meet the refined requirements of modern power distribution network operation and maintenance in terms of accuracy.

[0004] Therefore, how to efficiently and accurately identify abnormal electricity consumption behavior in complex and ever-changing electricity consumption scenarios is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0005] This invention provides a method and system for identifying abnormal electricity consumption behavior, which can solve at least one of the above-mentioned technical problems.

[0006] In a first aspect, embodiments of the present invention provide a method for identifying abnormal electricity consumption behavior, comprising: Obtain sample data corresponding to the electricity consumption behavior of the object to be identified, wherein the sample data includes each first sample feature and the feature label corresponding to the first sample feature; Based on the correlation and collinearity between each of the first sample features and the feature labels, the first sample features are dynamically filtered to obtain the second sample features; By using an adaptive decision tree model, the probability of electricity theft is predicted from the feature vectors in the second sample features, thus obtaining the target probability of electricity theft for the object to be identified. An abnormality prediction is performed on the feature sequence in the second sample feature by using an adaptive time-frequency fusion prediction model to obtain the abnormal electricity consumption score of the object to be identified. Based on a dynamic probability threshold, the target electricity theft probability and abnormal electricity consumption score of the object to be identified are used to determine the abnormal electricity consumption identification result of the object to be identified.

[0007] Secondly, embodiments of the present invention provide a system for identifying abnormal electricity consumption behavior, comprising: The acquisition module is used to acquire sample data corresponding to the electricity consumption behavior of the object to be identified, wherein the sample data includes each first sample feature and the feature label corresponding to the first sample feature; The filtering module is used to dynamically filter each first sample feature based on the correlation and collinearity between each first sample feature and the feature label to obtain second sample features. The electricity theft probability prediction module is used to predict the electricity theft probability of the feature vector in the second sample features through an adaptive decision tree model, so as to obtain the target electricity theft probability of the object to be identified. An anomaly prediction module is used to perform anomaly prediction on the feature sequence in the second sample features through an adaptive time-frequency fusion prediction model, so as to obtain the abnormal power consumption score of the object to be identified. The anomaly detection module is used to determine the anomaly of the target electricity theft probability and abnormal electricity consumption score of the object to be identified based on a dynamic probability threshold, and to obtain the abnormal electricity consumption identification result of the object to be identified.

[0008] The technical solution of this invention firstly constructs sample data containing first sample features and their corresponding feature labels, and dynamically filters based on the correlation and collinearity between each first sample feature and feature label. This effectively eliminates redundant and strongly collinear features, reduces the dimensionality of the feature space and the degree of information redundancy, thereby reducing the computational complexity of subsequent models and improving overall recognition efficiency. Furthermore, an adaptive decision tree model is used to predict the probability of electricity theft from the filtered feature vectors. This model can adaptively adjust the model structure and splitting strategy according to the data distribution characteristics under different electricity consumption scenarios, thereby improving the fitting ability to complex nonlinear relationships and enhancing the accuracy of electricity theft identification. Simultaneously, an adaptive time-frequency fusion prediction model is used to predict anomalies in the feature sequence. This model comprehensively utilizes time-domain and frequency-domain information to characterize the dynamic changes in electricity consumption behavior at multiple scales, compensating for the insufficient modeling ability of a single feature domain, thereby improving the identification ability and robustness against multiple types of abnormal electricity consumption behavior. Based on this, a dynamic probability threshold is introduced to adaptively fuse the target electricity theft probability with the abnormal electricity consumption score. Compared to a fixed threshold mechanism, this allows for dynamic adjustment of the judgment boundary according to different electricity consumption scenarios and data distribution, effectively reducing the false alarm rate. Thus, through the synergistic effect of the above-mentioned technical features, not only is the processing efficiency of abnormal power consumption identification improved, but the accuracy and reliability of the identification results are also significantly enhanced.

[0009] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0010] The accompanying drawings are provided for a better understanding of this solution and do not constitute a limitation of the invention. Wherein: Figure 1 This is a flowchart of a method for identifying abnormal electricity consumption behavior according to an embodiment of the present invention; Figure 2 This is a dynamic feature filtering interface diagram according to an embodiment of the present invention; Figure 3 This is an adaptive decision tree prediction interface diagram according to an embodiment of the present invention; Figure 4 This is a time-frequency fusion and anomaly score distribution diagram according to an embodiment of the present invention; Figure 5 This is a comparison chart of the area under the curve before and after incremental learning according to an embodiment of the present invention; Figure 6 This is a dynamic threshold determination and confusion matrix according to an embodiment of the present invention; Figure 7 This is a structural block diagram of an abnormal electricity consumption behavior identification system according to an embodiment of the present invention; Figure 8 This is a schematic block diagram of a computer device used to implement the methods of the embodiments of the present invention. Detailed Implementation

[0011] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0012] This invention provides a method and system for identifying abnormal electricity consumption behavior. The entity executing this method can be the abnormal electricity consumption behavior identification system provided in this invention, or a computer device integrating the abnormal electricity consumption behavior identification system. The abnormal electricity consumption behavior identification system can be implemented in hardware or software, and the computer device can be a terminal or a server.

[0013] In a specific application scenario, an abnormal electricity consumption behavior identification system according to an embodiment of the present invention includes a multi-source data acquisition layer, an edge processing layer, and a main station processing layer. Specifically, the multi-source data acquisition layer includes smart meters, distribution terminals, IoT sensors, and equipment status monitoring nodes, used to collect multi-source heterogeneous power operation data and equipment status data. Power operation data includes voltage, current, active power, reactive power, power factor, and load curves; equipment status data includes meter operating status, sensor operating status, and distribution terminal operating conditions.

[0014] The edge processing layer establishes bidirectional data paths with both the multi-source data acquisition layer and the main station processing layer via wired or wireless converged communication. Simultaneously, the edge processing layer is equipped with a data cleaning module, a feature extraction module, and a preliminary fusion module to perform deduplication, outlier filtering, coarse feature extraction, and preliminary fusion of multi-source data on the acquired raw data, thereby reducing the computational and storage pressure on the main station.

[0015] The main station processing layer is equipped with a deep fusion module, a data storage module, and an application service module. It adopts a distributed storage architecture to perform timestamp alignment and standardization on heterogeneous data after edge processing, forming a multi-source heterogeneous electricity consumption database with device status tags. Simultaneously, the main station processing layer incorporates an abnormal electricity consumption behavior identification model (i.e., an adaptive decision tree model and an adaptive time-frequency fusion prediction model). This model acquires sample data of the object to be identified, performs electricity theft probability prediction and time-frequency fusion anomaly prediction based on a dynamically filtered feature set, and combines dynamic probability thresholds with the electricity theft probability and abnormal electricity consumption score of the object to be identified to determine anomalies. Finally, a multi-level alarm mechanism pushes differentiated identification results to relevant maintenance and inspection personnel.

[0016] Figure 1 This is a flowchart of a method for identifying abnormal electricity consumption behavior according to an embodiment of the present invention.

[0017] like Figure 1 As shown, the method for identifying abnormal electricity consumption behavior may include: S110, Obtain sample data corresponding to the electricity consumption behavior of the object to be identified, wherein the sample data includes each first sample feature and the feature label corresponding to the first sample feature; S120, based on the correlation and collinearity between each first sample feature and feature label, dynamically filter each first sample feature to obtain the second sample feature; S130, using an adaptive decision tree model, predicts the probability of electricity theft from the feature vectors in the second sample features to obtain the target probability of electricity theft for the object to be identified. S140, through the adaptive time-frequency fusion prediction model, anomaly prediction is performed on the feature sequence in the second sample features to obtain the abnormal power consumption score of the object to be identified; S150, based on the dynamic probability threshold, performs anomaly determination on the target electricity theft probability and abnormal electricity consumption score of the object to be identified, and obtains the abnormal electricity consumption identification result of the object to be identified.

[0018] For example, the object to be identified refers to the electricity user within the monitoring range of the electricity marketing system or distribution network that needs to be monitored for the risk of electricity theft. This can be a single electricity user or electrical equipment. For example, an industrial enterprise user, a residential electricity meter, or a distribution substation.

[0019] For example, sample data refers to a set of historical or real-time data used for prediction (i.e., the original feature set), which consists of first sample features and their corresponding feature labels. For example, a dataset containing voltage, current, power, load curves, and electricity theft labels (e.g., normal electricity usage status, abnormal electricity usage status, strong interference electricity theft, short-circuit electricity theft, meter bypass electricity theft, external shunt electricity theft, meter tampering electricity theft, shunt electricity theft).

[0020] For example, the first sample feature refers to each independent dimension indicator in the original feature set. For example, the instantaneous current value, instantaneous voltage value, power factor, load fluctuation rate, etc. at a specific time point.

[0021] For example, feature labels refer to classification markers that characterize the nature of electricity consumption behavior and are used to guide the supervised learning process of the model. For instance, "0" represents normal electricity consumption, "1" represents strong interference electricity theft, and "2" represents diverting electricity theft.

[0022] In this example, firstly, the power operation indicators and equipment status indicators of the object to be identified are collected in real time through smart meters, distribution terminals, and IoT sensors within the multi-source data acquisition layer, constructing multi-dimensional raw feature data including voltage, current, active power, reactive power, power factor, and load curves. Next, the collected raw feature data is integrated from multiple sources using a heterogeneous architecture. The data cleaning module of the edge processing layer performs missing value imputation, outlier denoising, and redundant information removal, completing data cleaning and standardization. Subsequently, according to the business logic of power auditing, corresponding feature labels are associated with the cleaned power operation indicators. These feature labels include labels representing normal power consumption status and labels representing specific electricity theft patterns (e.g., strong interference electricity theft, short-circuit electricity theft, meter bypass electricity theft, external shunt electricity theft, meter tampering electricity theft, and diversion electricity theft), thereby constructing an initial dataset containing each first sample feature and its corresponding feature label. Finally, the constructed initial dataset is uploaded to the main station processing layer through the converged communication channel, and the data is deeply integrated and timestamped in combination with the device status tags to generate sample data for subsequent dynamic feature selection.

[0023] For example, the second sample feature refers to the optimized feature set obtained through correlation analysis and collinearity screening. The second sample feature includes, but is not limited to, "load fluctuation rate, power fluctuation rate, and electricity consumption periodicity index".

[0024] In this example, an object to be identified corresponds to a set of electricity consumption behavior data (sample data) within a specific observation period. The electricity consumption behavior of each object to be identified is characterized by multiple first sample features. After dynamic filtering, the number of dimensions of the second sample features is less than or equal to the number of dimensions of the first sample features, and both correspond to the electricity consumption behavior of the same object to be identified.

[0025] It should be noted that all feature indicators across all dimensions in the second sample feature set collectively constitute a multidimensional feature vector. The total number of dimensions in the feature vector is equal to the number of feature indicators, and there is a one-to-one correspondence between the two. Each feature indicator in the second sample feature set evolves over time, forming a feature sequence. The number of feature indicators in the second sample feature set corresponds to the number of corresponding feature sequences, and these feature sequences collectively constitute the behavioral trajectory of the object to be identified over time.

[0026] For example, the abnormal electricity consumption identification result refers to the final output result obtained by comprehensively judging the target electricity theft probability and the abnormal electricity consumption score, which may include the identity of the object to be identified, the identification result, the target electricity theft probability, the abnormal electricity consumption score, the electricity theft type, and the push information.

[0027] For example, after the model comprehensively judges the electricity consumption behavior of an industrial enterprise user (identified as "User A-20260410") on April 10, 2026, the abnormal electricity consumption identification result is "suspected electricity theft". Its target electricity theft probability is 0.91 and the abnormal electricity consumption score is 0.86. The system further determines that its electricity theft type is "short-circuit electricity theft". At the same time, the abnormal electricity consumption identification result and alarm information are pushed to the distribution network operation and maintenance management platform and relevant operation and maintenance personnel terminals for on-site verification and metering equipment re-inspection.

[0028] According to the above implementation method, by acquiring sample data of the electricity consumption behavior of the object to be identified, and dynamically filtering based on the correlation and collinearity between sample features and feature labels, redundant and strongly collinear features are removed, thereby reducing feature dimensionality and computational burden, improving subsequent processing efficiency, and retaining key discriminative features to improve identification accuracy. Based on this, an adaptive decision tree model is used to predict the probability of electricity theft from the filtered feature vectors, and an adaptive time-frequency fusion prediction model is combined to predict anomalies in the feature sequences, thus characterizing abnormal electricity consumption behavior from both probabilistic discrimination and time-frequency dynamic evolution perspectives, thereby enhancing the expressive power and identification accuracy of complex electricity theft patterns. Finally, by introducing a dynamic probability threshold to comprehensively determine the probability of electricity theft and the abnormal electricity consumption score, compared to a fixed threshold mechanism, the judgment boundary can be adaptively adjusted according to different electricity consumption scenarios, effectively reducing the false alarm rate and further improving the accuracy and overall identification efficiency of abnormal electricity consumption identification results.

[0029] In one implementation, based on the correlation and collinearity between each first sample feature and feature label, a dynamic screening is performed on each first sample feature to obtain a second sample feature. This includes: estimating the probability distribution of each first sample feature and feature label to obtain each first marginal probability of the first sample feature, each second marginal probability of the feature label, and the joint probability between each first sample feature and feature label; determining each comprehensive marginal probability based on the product of each first marginal probability and each second marginal probability; determining each probability ratio based on the ratio of each joint probability to each comprehensive marginal probability; summing the logarithms of each probability ratio based on each joint probability to obtain the mutual information entropy corresponding to the first sample feature; removing each first sample feature whose mutual information entropy is less than the correlation threshold from the first sample features based on the mutual information entropy corresponding to each first sample feature to obtain a first feature subset; and updating the first feature subset based on the collinearity of each feature in the first feature subset to obtain the second sample feature.

[0030] For example, the process of calculating the mutual information entropy of each first sample feature can be represented as follows: ; In the formula, The mutual information entropy corresponding to the features of the first sample; It is a set composed of the features of each first sample; It is a set composed of various feature labels; The specific values ​​of the features of the first sample; The specific values ​​to be taken for the feature labels; The joint probability is the probability that the first sample has a feature value of x and a feature label value of y at the same time. The first marginal probability is the probability that the first sample feature takes the value x. The second marginal probability is the probability that the feature label takes the value y. This is for the comprehensive marginal probability.

[0031] In this example, firstly, joint statistical processing is performed on each first sample feature and its corresponding feature label. For continuous features, probability estimation is performed using interval partitioning or kernel density estimation; for discrete features, the frequency of each value is calculated using frequency statistics. Subsequently, using kernel density estimation or histogram statistics, the observation frequency of the first sample feature across different value intervals is calculated to obtain the first marginal probability distribution. The observation frequency of the feature label across different categories is calculated to obtain the second marginal probability distribution. Finally, the frequency distribution of the first sample feature and feature label appearing together in the same observed samples is statistically analyzed to obtain their joint probability distribution.

[0032] The first marginal probability of each first sample feature is multiplied point-to-point with the second marginal probability of its corresponding feature label to determine the comprehensive marginal probability under the assumption that the feature and label are independent of each other. Then, the ratio of the joint probability to the comprehensive marginal probability is calculated. This ratio reflects the offset of the association strength between the feature and the label under the current value.

[0033] Based on the joint probability distribution, the probability ratios calculated above are logarithmic to the base 2, and the logarithmic value is weighted with the corresponding joint probability to complete the summation operation in the entire probability space, finally obtaining the mutual information entropy, which measures the degree of information dependence between the features and feature labels of the first sample.

[0034] A correlation threshold is set, and the mutual information entropy corresponding to each feature of the first sample is compared with the threshold one by one. Any feature whose mutual information entropy value is lower than the correlation threshold indicates that its information correlation with the feature label is insufficient and should be removed. The remaining features are combined to form the first feature subset.

[0035] For example, if the correlation threshold is set to 0.1, the calculated mutual information entropy of "average daily electricity consumption" is 0.85, and the mutual information entropy of "ambient temperature" is 0.09. Since 0.09 is less than the threshold of 0.1, the "ambient temperature" feature is removed, and "average daily electricity consumption" and other features with mutual information entropy greater than 0.1 are retained to form the first feature subset.

[0036] According to the above implementation method, firstly, probability distribution estimation is performed for each first sample feature and feature label to obtain their respective marginal probabilities and joint probabilities. Then, a comprehensive marginal probability is constructed based on the product of the marginal probabilities. The ratio between the joint probability and the comprehensive marginal probability is further calculated, and the logarithm of this ratio is summed to obtain the mutual information entropy corresponding to each first sample feature, thereby quantitatively characterizing the correlation strength between each feature and label. Based on this, a correlation threshold is set to filter the mutual information entropy, eliminating redundant features with low correlation to obtain a first feature subset, thus reducing interference from invalid features. Subsequently, the feature subset is further updated and optimized based on the collinearity among the features in the first feature subset to eliminate information duplication caused by strongly collinear features, ultimately obtaining the second sample features. In this way, not only can highly correlated key features be effectively preserved, but feature redundancy and information duplication can also be significantly reduced, thereby reducing the computational complexity of subsequent models, improving the efficiency of model training and inference, and further enhancing the accuracy and stability of anomaly identification.

[0037] In one implementation, the first feature subset is updated based on the collinearity of its features to obtain second sample features. This includes: determining the first feature subset as a set of features to be processed, wherein the set of features to be processed includes each currently retained feature; establishing an auxiliary regression model for each currently retained feature, using the currently retained feature as the dependent variable and the remaining currently retained features in the set of features to be processed as independent variables; fitting the auxiliary regression model using the least squares method to obtain the determination coefficient of the auxiliary regression model; and determining the variance based on the difference between a preset constant and the determination coefficient. The constant is divided by the variance difference to obtain the variance inflation factor of the currently retained feature. If there is a variance inflation factor greater than the preset collinearity threshold among the variance inflation factors of each currently retained feature, the currently retained feature corresponding to the largest variance inflation factor is removed from the feature set to be processed to update the feature set to be processed, and the updated feature set to be processed is used as the feature set to be processed for the next iteration. If the variance inflation factors of each currently retained feature in the feature set to be processed are all less than or equal to the collinearity threshold, the iteration stops, and each currently retained feature in the feature set to be processed at the time of stopping the iteration is determined as the second sample feature.

[0038] For example, a first subset of features is determined as the set of features to be processed, wherein the set of features to be processed contains The currently retained features are denoted as... For each currently retained feature, an auxiliary regression model is established to quantify the degree of multicollinearity.

[0039] Specifically, the currently selected feature is retained. As the dependent variable, the feature set to be processed, excluding The rest Using these features as independent variables, a linear regression equation is constructed. The auxiliary regression model can be expressed by the following functional expression: ; In the formula, The currently retained feature as the dependent variable; This is the constant term in the regression model; This represents the total number of features contained in the current feature set to be processed. The index variable for summation; The feature set to be processed excluding the currently detected feature Other features besides these (i.e., independent variables); For features The corresponding partial regression coefficients; This is the random error term in the auxiliary regression model.

[0040] The determination coefficient of the regression equation was obtained by fitting the auxiliary regression model using the least squares method. This value reflects the characteristics The degree to which it is linearly interpreted by other features in the set of features to be processed.

[0041] Based on the preset constant 1 and the determination coefficients obtained from the above fitting... The difference is used to determine the variance difference value, and the constant 1 is divided by this variance difference value to obtain the current retained feature. variance inflation factor ,Right now .

[0042] Iterate through and calculate the variance inflation factor (VIF) value of all currently retained features in the feature set to be processed. If it exists... If a feature has a VIF value greater than the preset collinearity threshold, it indicates that there is serious redundancy between the feature and other features. In this case, the feature with the largest VIF value should be removed first in a single iteration to update the feature set to be processed. The updated feature set to be processed will then be used as the object of the next iteration.

[0043] Repeat the regression modeling, VIF calculation and elimination steps above until the VIF values ​​of all remaining features in the feature set to be processed are less than or equal to the collinearity threshold. At this point, stop the iteration and determine the remaining features in the feature set to be processed at the time of stopping the iteration as the second sample features.

[0044] For example, the multicollinearity threshold can be set according to the feature dimension requirements of the actual business scenario. For example, it can be set to 10. When the VIF value of a feature exceeds 10, it is considered to have significant multicollinearity and needs to be removed to optimize the feature space.

[0045] For example, Figure 2 This is a dynamic feature filtering interface diagram according to an embodiment of the present invention. Figure 2 As shown, in a specific test, the original features consisted of 10 dimensions, with a mutual information threshold set to 0.05. The mutual information entropies of reactive power and ambient temperature were 0.030 and 0.035 respectively, both below the threshold and therefore discarded. The remaining 8 features underwent variance inflation factor testing, and the variance inflation factors of the retained features were all no higher than the collinearity threshold of 10. Therefore, after dynamic feature filtering, the input features were reduced from 10 dimensions to 8 dimensions, a 20% reduction in feature dimensionality, and the number of redundant features entering subsequent models was also reduced.

[0046] According to the above implementation method, the first feature subset is determined as the feature set to be processed. For each currently retained feature in the feature set to be processed, an auxiliary regression model is constructed with the current retained feature as the dependent variable and the remaining currently retained features as independent variables. The model is fitted using the least squares method to obtain the coefficient of determination, and the variance inflation factor of each feature is calculated accordingly to quantitatively characterize the degree of multicollinearity among features. Subsequently, the variance inflation factor is judged by setting a collinearity threshold; when there is a feature with a variance inflation factor greater than the threshold, the feature with the largest variance inflation factor is iteratively removed to gradually reduce the collinearity effect among features; when the variance inflation factor of all features meets the threshold condition, the iteration stops, and the remaining features are determined as the second sample features. In this way, feature redundancy and multicollinearity interference can be effectively reduced, the stability and interpretability of the feature set can be improved, thereby improving the efficiency of subsequent model training and the accuracy of anomaly identification.

[0047] In one implementation, an adaptive decision tree model is used to predict the probability of electricity theft from the feature vectors in the second sample features, thereby obtaining the target probability of electricity theft for the object to be identified. This includes: inputting the feature vectors into each decision tree in the adaptive decision tree model for processing to obtain local prediction scores, and summing these local prediction scores to obtain a first prediction value; inputting the feature vectors into a cross-layer feature interaction function of the adaptive decision tree model for processing to obtain a second prediction value, wherein the cross-layer feature interaction function is constructed using a two-layer fully connected network; determining a target interaction value based on the product of a preset feature interaction coefficient and the second prediction value, and determining an original prediction output value based on the sum of the first prediction value and the target interaction value; mapping the original prediction output value using a preset activation function to obtain an initial probability of electricity theft; calculating the conditional probability of the initial probability of electricity theft using a kernel density estimation algorithm to obtain a first conditional probability of the initial probability of electricity theft under electricity theft conditions and a second conditional probability of the feature vector under normal conditions; and correcting the first and second conditional probabilities using preset prior probabilities to obtain the target probability of electricity theft.

[0048] For example, firstly, the features of the second sample are integrated. For each feature index value collected at the target time for the object to be identified, normalization is performed to eliminate the influence of different units on the model's predictive stability. Secondly, according to a preset feature arrangement order (e.g., time series features first, then statistical features, and finally frequency domain features), the values ​​of each retained feature corresponding to the object to be identified at the target time are sequentially arranged and concatenated to form a numerical sequence with fixed dimensions. Finally, this numerical sequence is encapsulated into a feature vector of a specific dimension. This vector serves as a "snapshot" representation of the object to be identified at the target time. It is directly input into the adaptive decision tree model to predict the probability of electricity theft, or it can be stacked according to the time window to form a feature matrix (i.e., a feature vector that serves as the input to the adaptive time-frequency fusion prediction model) for use as input to the adaptive decision tree model.

[0049] For example, if the second sample feature contains 64 dimensions, the system will sequentially read the instantaneous values ​​of these 64 dimensions according to a preset index and convert them into a single value. A one-dimensional numerical array. This array is the feature vector of the object to be identified at that target time. This ensures that subsequent models can perform cross-layer feature interactions and decision tree computations with a consistent feature space dimension.

[0050] For example, the adaptive decision tree model (officially known as the adaptive cost-sensitive gradient boosting decision tree model) is an ensemble learning architecture deeply optimized for abnormal power consumption scenarios. Based on the additive model of the traditional gradient boosting decision tree (GBDT), this model introduces a cross-layer feature interaction mechanism and a cost-sensitive learning strategy to achieve accurate modeling of the nonlinear coupling relationships of massive multidimensional power features and adaptive output of the probability of electricity theft.

[0051] Specifically, the model utilizes a two-layer fully connected neural network to construct a cross-layer feature interaction function, mapping the scenario-based input feature vector to a high-dimensional space. Through nonlinear transformations, it extracts deep interaction features between different decision tree nodes, effectively compensating for the insufficient capture of multi-dimensional feature associations by a single decision tree. Furthermore, the model integrates cost-sensitive optimization and probability correction mechanisms. By using an improved hybrid loss function and adaptive penalty weight coefficients, it dynamically balances the distribution of normal electricity consumption and electricity theft samples, effectively addressing the identification bias caused by sample class imbalance. Simultaneously, combined with a Bayesian posterior probability correction module, the original output is precisely calibrated, ultimately outputting a corrected target electricity theft probability reflecting the probability of electricity theft events, providing high-confidence decision support for electricity inspection work.

[0052] For example, firstly, the feature vector The inputs are fed into the various decision trees in the adaptive decision tree model for processing. The model contains... decision trees (e.g.) Each decision tree For eigenvectors Feature node splitting and path searching are performed, and the corresponding local prediction scores are output. The local prediction scores output by all decision trees are then summed to obtain the first prediction value, i.e. This value represents the model's initial assessment of the degree of anomaly in the feature vectors.

[0053] Secondly, a cross-layer feature interaction mechanism is used to enhance the mining of nonlinear features. This involves combining feature vectors... Simultaneously input into the cross-layer feature interaction function The function, constructed using a two-layer fully connected network comprising an input layer, hidden layers, and an output layer, processes the data and outputs a second predicted value representing deep interaction features. This is based on preset feature interaction coefficients. The target interaction value is determined by multiplying the first predicted value (ranging from 0.2 to 0.5) with the second predicted value. The original predicted output value is determined based on the sum of the first predicted value and the target interaction value. Its expression is .in, For the first The original predicted output values ​​of each feature vector. Indicates the first The function space to which each decision tree belongs. This represents the space to which the feature interaction function belongs.

[0054] Furthermore, the original predicted output value is processed by a preset activation function (such as the Sigmoid function). Perform mapping processing to convert it to The interval is used to obtain the initial probability of electricity theft. To address the poor model adaptability caused by the dynamic changes in the distribution of electricity theft feature vectors, an improved Focal-LogLoss hybrid loss function is introduced to optimize the model parameters. This loss function can be expressed as: ;in, The value of the loss function. The total number of eigenvectors. For the first The true labels of each feature vector Difficult feature vector mining coefficients (e.g., a value of 2.0). The adaptive penalty weight coefficients are based on the feature vector distribution, and their update rule is as follows: Here, This is an adjustment factor (for example, a value between 1.2 and 2.0). The number of normal feature vectors. This represents the number of feature vectors for electricity theft.

[0055] It should be noted that the "adaptive" aspect of the "adaptive decision tree model" in this invention is mainly reflected in the automatic adjustment of model parameters according to changes in sample category distribution and incremental samples, rather than the unbounded alteration of the decision tree topology during each prediction process. Specifically, at the start of model training or online fine-tuning, the number of normal feature vectors and the number of electricity theft feature vectors in the current target sample set are counted, and adaptive penalty weight coefficients are automatically calculated according to the aforementioned update rules, where the adjustment coefficient ranges from 1.2 to 2.0. When the target sample set is updated due to new abnormal electricity consumption identification results, new electricity theft samples, or equipment operation and maintenance data, and online fine-tuning is initiated, adaptive parameter adjustment is triggered. During the online fine-tuning phase, the node splitting structure and leaf node weight parameters of the constructed decision tree remain frozen. Only the weights and bias parameters of the two fully connected layers in the cross-layer feature interaction mechanism and the adaptive penalty weight coefficients are allowed to be updated, and a learning rate in the range of 0.001 to 0.01 is used for parameter updates, thereby limiting the range of parameters for online model adjustment and avoiding unconstrained drift of the existing decision structure caused by incremental learning.

[0056] Finally, the granularity of the output is improved through a Bayesian posterior probability correction mechanism. The kernel density estimation algorithm is used to calculate the first conditional probability of the initial electricity theft probability under the condition of electricity theft. And the second conditional probability of the eigenvector under normal conditions. And the prior probability obtained through historical electricity consumption data statistics and .

[0057] Use the correction formula After performing probability calibration, the final output value range is within Corrected probability of electricity theft This serves as the probability of identifying targets for electricity theft. In this way, the identification accuracy is effectively improved in complex and ever-changing electricity usage scenarios.

[0058] For example, Figure 3 This is an adaptive decision tree prediction interface diagram according to an embodiment of the present invention. Figure 3 As shown, with the current 1000 simulated samples and corresponding training and testing partitions and parameter settings, the AUC (Area Under the Curve) of the adaptive decision tree model on the training set and the AUC on the test set are both 1.000, and the accuracy after Bayesian correction is 99.67%, which can characterize the model's ability to rank and identify normal electricity consumption samples and electricity theft samples under the current testing conditions.

[0059] According to the above implementation method, the feature vector is input into each decision tree in the adaptive decision tree model for processing to obtain local prediction scores, which are then summed to obtain a first prediction value. Simultaneously, the feature vector is input into a cross-layer feature interaction function constructed based on a two-layer fully connected network for processing to obtain a second prediction value representing higher-order feature interactions. This second prediction value is then weighted and fused with feature interaction coefficients to obtain the original prediction output value. Then, an activation function is used to perform a nonlinear mapping on the original prediction output value to obtain an initial probability of electricity theft. A kernel density estimation algorithm is then used to model the conditional probability of this initial probability, calculating the first conditional probability under electricity theft conditions and the second conditional probability under normal conditions. Finally, the two conditional probabilities are corrected by combining prior probabilities to obtain the target probability of electricity theft. By fusing the local discriminative ability of the decision tree with the higher-order representation ability of cross-layer feature interactions and introducing a probability correction mechanism, the model's ability to characterize complex nonlinear electricity theft behavior can be effectively improved, thereby enhancing the accuracy and robustness of electricity theft probability prediction.

[0060] In one implementation, an anomaly prediction is performed on the feature sequence in the second sample features using an adaptive time-frequency fusion prediction model to obtain an abnormal electricity consumption score for the object to be identified. This includes: determining the target block size based on the target electricity consumption scenario of the object to be identified; performing high-dimensional mapping processing on the features of each adjacent time step in the feature sequence based on the target block size to obtain a scenario-based feature embedding sequence; inputting the scenario-based feature embedding sequence into the time domain branch of the adaptive time-frequency fusion prediction model for multi-head self-attention calculation to obtain an intermediate time domain sequence; and performing residual connection and layer normalization processing on the intermediate time domain sequence. The time-domain feature sequence is obtained; the scene-based feature embedding sequence is input into the frequency domain branch of the adaptive time-frequency fusion prediction model to obtain the frequency domain feature sequence output by the frequency domain branch, wherein the frequency domain branch includes a transform layer and an interaction layer; the time-domain feature sequence and the frequency domain feature sequence are reconstructed to obtain the reconstructed feature sequence; based on the time-domain difference and frequency-domain difference between the feature sequence and the reconstructed feature sequence, the time-domain reconstruction error and the frequency-domain reconstruction error are determined respectively; based on the preset balance coefficient and scene-based fusion weight parameters, the time-domain reconstruction error and the frequency-domain reconstruction error are weighted and summed to obtain the abnormal electricity consumption score of the object to be identified.

[0061] For example, electricity consumption behavior data of the object to be identified within a preset time range (e.g., April 10, 2026) is acquired, and the electricity consumption behavior data is time-aligned according to a preset sampling period to obtain original data at multiple times arranged in chronological order. Then, for each time sampling point, the corresponding second sample feature is extracted from the original data to obtain the feature vector corresponding to that time sampling point, wherein the feature vector is composed of the values ​​of each second sample feature. Further, the feature vectors corresponding to each time sampling point are arranged in chronological order to form a feature sequence.

[0062] In one specific embodiment, taking the electricity consumption behavior of an industrial user on a certain day as an example, with a sampling period of 15 minutes, 96 time sampling points can be obtained within 24 hours. For each time sampling point, the filtered second sample features are extracted, such as load fluctuation rate, power change rate, current imbalance, and harmonic content, totaling 10 features, and these 10 feature values ​​are combined into a feature vector. Subsequently, the feature vectors corresponding to the 96 time sampling points are arranged sequentially in chronological order, ultimately forming a feature sequence of length 96, with each element being a 10-dimensional feature vector.

[0063] For example, the adaptive time-frequency fusion prediction model is a deeply integrated anomaly detection architecture designed to accurately identify abnormal electricity consumption behavior in complex power scenarios through dual feature extraction and reconstruction in the time and frequency domains.

[0064] Specifically, the core architecture of the model includes the following key components: First, the scenario-based temporal embedding module: This module automatically determines the optimal block size according to different power consumption scenarios, and converts the original feature sequence into a scenario-based feature embedding sequence through high-dimensional mapping technology, which can effectively improve the model's dynamic representation ability of different periodic fluctuation features.

[0065] Second, the attention-gated dual-domain encoder: The model is designed with a parallel time-domain and frequency-domain dual-branch coding structure. The time-domain branch adopts a multi-head self-attention mechanism with residual connections and layer normalization, which can accurately capture long and short time-series dependencies and sudden fluctuations in load; the frequency-domain branch uses Fourier transform and frequency pattern interaction layers to dynamically filter harmonic features and remove noise frequencies, thereby extracting the periodic fluctuation patterns of load data.

[0066] Third, attention-gated fusion mechanism and anomaly reconstruction judgment: This mechanism replaces simple feature splicing, dynamically assigning fusion weights to time-domain and frequency-domain features in different scenarios through an attention model. The model compares and analyzes the reconstructed features in both domains, calculates the reconstruction differences between the time and frequency domains, and combines a preset balance coefficient to weight and sum the reconstruction errors, ultimately outputting an abnormal electricity consumption score that reflects the degree of abnormality of the object to be identified.

[0067] For example, firstly, based on the target electricity consumption scenario of the object to be identified (such as residential electricity consumption, commercial electricity consumption, or industrial park electricity consumption), the patch size of the time window is dynamically adjusted to achieve adaptive modeling of different periodic features. Based on the determined patch size, the features of adjacent time steps of the patch are mapped to a high-dimensional space to form a scenario-based feature embedding sequence. For example, in the peak segment of the residential electricity consumption scenario, Patch=3 is set, while in the valley segment, Patch=6 is set, thereby effectively balancing the modeling efficiency of long sequences and the feature capture capability of short sequences.

[0068] Secondly, parallel processing is achieved using an attention-gated time-frequency dual-domain encoder. In the time-domain branch, scene-specific features are embedded into the sequence input via a multi-head self-attention mechanism with residual connections and layer normalization. By deeply mining each time step within the sequence, intermediate time-domain sequences are obtained and output as time-domain feature sequences after standardization, thus accurately capturing sudden load changes. In the adaptive frequency-domain branch, a RealFast Fourier Transform (RFFT) is performed on the sequence through a transform layer. Based on the harmonic characteristics of the electrical equipment type, Top-K (the first K, where K is a positive integer) frequency patterns are dynamically selected (e.g., K=8 for industrial park electricity, K=5 for residential electricity, and K=6 for commercial electricity). After removing noise frequencies, frequency pattern interaction is achieved through a Multilayer Perceptron (MLP). Finally, the sequence is restored to a frequency-domain feature sequence via an Inverse RealFast Fourier Transform (IRFFT).

[0069] Furthermore, an attention-gated fusion mechanism is adopted to dynamically allocate temporal scenario weight coefficients based on the importance of the current electricity consumption scenario characteristics. Frequency domain scene weighting coefficient The extracted time-domain feature sequence and frequency-domain feature sequence are deeply fused and reconstructed to obtain the reconstructed feature sequence. This is based on the original input features. With reconstructed feature sequences Calculate the anomaly score based on the difference between the time and frequency domains. The formula is: ; In the formula, This refers to the score for abnormal electricity consumption of the object to be identified; Refers to the time-domain balance coefficient; Refers to the frequency domain balance coefficient; Refers to the time-domain scene weighting coefficient; Refers to the original input feature vector; This refers to reconstructing the feature sequence vector; Frequency domain scene weighting coefficients; Refers to the Fast Fourier Transform function.

[0070] For example, for power consumption scenarios in industrial parks, the system automatically configures time-domain weights. With frequency domain weights This enhances the sensitivity of monitoring high-frequency anomalous changes during production periods. Through this four-fold innovative and optimized structure, the model effectively solves the problems of fixed block division and rigid frequency domain filtering in traditional architectures, achieving efficient and accurate identification of complex and covert electricity theft.

[0071] It should be noted that the "adaptive" aspect of the "adaptive time-frequency fusion prediction model" in this invention uses the target electricity consumption scenario of the object to be identified and its corresponding electricity consumption period as the scenario triggering condition. It automatically selects the size of the time series block patch and automatically selects the number of frequency modes K based on the harmonic characteristics of the type of electrical equipment. Simultaneously, an attention-gated fusion mechanism automatically allocates time-domain and frequency-domain scenario weight coefficients based on the feature importance of the current scenario. All of the above adjustments are performed within the preset candidate parameter range. For example, the blocks for peak and off-peak electricity consumption in residential areas are 3 and 6, respectively; K for industrial park electricity consumption, residential electricity consumption, and commercial electricity consumption are 8, 5, and 6, respectively; the time-domain and frequency-domain scenario weight coefficients are normalized to between 0 and 1, and their sum is 1. Therefore, the time-domain and frequency-domain branches in the model structure remain unchanged, only the block size, the number of frequency modes, and the dual-domain fusion weights (time-domain and frequency-domain scenario weight coefficients) are adaptively adjusted.

[0072] For example, Figure 4 This is a time-frequency fusion and anomaly score distribution diagram according to an embodiment of the present invention. For example... Figure 4 As shown, in a set of test results, the average abnormal electricity consumption score of normal samples was 0.106, and the average abnormal electricity consumption score of electricity theft samples was 0.236. The absolute difference between the two was 0.130. The average abnormal electricity consumption score of electricity theft samples was about 2.226 times that of normal samples. It can be seen that the abnormal electricity consumption score obtained based on time-frequency feature reconstruction can distinguish between the two types of samples under the current test conditions.

[0073] According to the above implementation method, firstly, the target block size is determined based on the target electricity consumption scenario of the object to be identified. Then, based on this block size, high-dimensional mapping processing is performed on the features of adjacent time steps in the feature sequence to obtain a scenario-based feature embedding sequence, thereby achieving adaptive expression of data distribution characteristics under different electricity consumption scenarios. Next, the scenario-based feature embedding sequence is input into the time-domain branch and frequency-domain branch of the adaptive time-frequency fusion prediction model, respectively. The time-domain branch models the sequence using a multi-head self-attention mechanism combined with residual connections and layer normalization to enhance the ability to capture temporal dependencies. The frequency-domain branch extracts frequency-domain features from the sequence through a transformation layer and an interaction layer to characterize the periodicity and spectral characteristics of electricity consumption behavior. Subsequently, the time-domain feature sequence and the frequency-domain feature sequence are reconstructed to obtain a reconstructed feature sequence. Based on the differences between the original feature sequence and the reconstructed feature sequence in the time and frequency domains, the time-domain reconstruction error and the frequency-domain reconstruction error are calculated respectively. Finally, based on a preset balance coefficient and scenario-based fusion weight parameters, the time-domain reconstruction error and the frequency-domain reconstruction error are weighted and fused to obtain the abnormal electricity consumption score of the object to be identified. In this way, the model can simultaneously capture the temporal dynamic changes and frequency domain structural features of electricity consumption behavior, enhance its ability to represent complex abnormal patterns, and thus improve the accuracy and robustness of abnormal electricity consumption identification.

[0074] In one implementation, after determining the abnormality of the target electricity theft probability and abnormal electricity consumption score of the object to be identified based on a dynamic probability threshold, and obtaining the abnormal electricity consumption identification result of the object to be identified, the method further includes: constructing a first incremental sample set based on the abnormal electricity consumption identification result, new electricity theft samples, and equipment operation and maintenance data; standardizing the first incremental sample set to obtain a second incremental sample set; fusing the second incremental sample set with the historical sample set to obtain a target sample set; and updating the model parameters of the adaptive decision tree model and the adaptive time-frequency fusion prediction model respectively using the mini-batch gradient descent method based on the target sample set to obtain the updated adaptive decision tree model and the updated adaptive time-frequency fusion prediction model. The model parameters of the adaptive decision tree model include the node splitting structure and leaf node weight parameters of the decision tree, the weights and biases of the fully connected network, and the adaptive penalty weight coefficients; the model parameters of the adaptive time-frequency fusion prediction model include the parameters of the time-frequency dual-domain coding layer, the scene-based fusion weight parameters in the attention-gated fusion layer, and the weights and biases of the decoding layer.

[0075] For example, based on the abnormal electricity consumption identification results collected by the main station layer, novel electricity theft samples reported from power inspection sites, and equipment operation and maintenance data, multi-source heterogeneous data is identified. Through multi-source heterogeneous data cleaning and feature reconstruction, a first incremental sample set is constructed for incremental model training. Subsequently, data standardization algorithms (e.g., ...) are used... The first incremental sample set is standardized using normalization to eliminate differences in statistical scales between different business data sources, resulting in the second incremental sample set. Then, the second incremental sample set is deeply integrated with the massive historical sample set stored at the main station layer to form a target sample set containing the latest electricity theft patterns and typical long-term characteristics.

[0076] The target sample set is used as the training sample for the model, and mini-batch gradient descent (MBGD) is employed with a preset, relatively small learning rate (e.g., The model is fine-tuned online. To prevent "catastrophic forgetting" when learning new samples, the system employs a parameter freezing strategy.

[0077] In this example, for the adaptive decision tree model, the node splitting structure and leaf node weight parameters of the constructed decision tree are frozen. The weights and bias parameters of the two fully connected layers in the cross-layer feature interaction mechanism are updated only through gradient descent, and the improved model is updated simultaneously. Adaptive penalty weight coefficients in the loss function This is to rapidly improve the model's ability to fit nonlinear characteristics of new types of electricity theft.

[0078] For the adaptive time-frequency fusion prediction model, all parameters of the time-frequency dual-domain coding layer are frozen, and the backpropagation algorithm is used to update only the scene-specific fusion weight parameters in the attention-gated fusion mechanism and the weights and bias parameters of the decoding layer. In this way, the model can adaptively adjust the reconstruction judgment logic for new anomalies while retaining its original ability to extract time-frequency features.

[0079] In summary, through the above online fine-tuning process, the updated adaptive decision tree model and the updated adaptive time-frequency fusion prediction model are obtained, realizing the continuous evolution and performance optimization of the system in the environment of massive heterogeneous electricity consumption data, and ensuring that the identification results can adapt to the ever-evolving electricity theft techniques in a timely manner.

[0080] It should be noted that after the first incremental sample set, constructed from abnormal electricity consumption identification results, new electricity theft samples, and equipment operation and maintenance data, is standardized and fused with the historical sample set to form the target sample set, online fine-tuning of the adaptive decision tree model and the adaptive time-frequency fusion prediction model is triggered. During the online fine-tuning process, the adaptive decision tree model freezes the node splitting structure and leaf node weight parameters of the constructed decision tree in the aforementioned manner; the adaptive time-frequency fusion prediction model freezes the parameters of the time-frequency dual-domain encoding layer and only updates the scenario-based fusion weight parameters in the attention-gated fusion mechanism and the weight and bias parameters of the decoding layer.

[0081] For example, Figure 5This is a comparison chart of the area under the curve before and after incremental learning according to an embodiment of the present invention. For example... Figure 5 As shown, in a set of incremental learning tests, the AUC of the model before incremental learning was 0.990, and the AUC after incremental learning was 0.995, an increase of 0.005. This indicates that after updating the model parameters based on incremental samples, the model's ability to distinguish categories under the current test conditions was improved.

[0082] In one implementation, based on a dynamic probability threshold, anomaly determination is performed on the target electricity theft probability and abnormal electricity consumption score of the object to be identified to obtain the abnormal electricity consumption identification result of the object to be identified. This includes: calculating the load fluctuation coefficient corresponding to the object to be identified based on the real-time active power of the object to be identified within a preset sliding time window; determining a first adjustment value based on the product of a preset first coefficient and the load fluctuation coefficient; multiplying the sum of a preset constant and the first adjustment value by a preset base probability threshold to obtain a dynamic probability threshold; determining a second adjustment value based on the product of a preset second coefficient and the load fluctuation coefficient; multiplying the difference between the constant and the second adjustment value by a preset first base score threshold to obtain a first abnormal score threshold; multiplying the difference between the constant and the second adjustment value by a preset second base score threshold to obtain a second abnormal score threshold; and performing anomaly determination on the target electricity theft probability and abnormal electricity consumption score of the object to be identified based on the equipment operating status, abnormal duration, dynamic probability threshold, first abnormal score threshold, and second abnormal score threshold to obtain the abnormal electricity consumption identification result of the object to be identified.

[0083] For example, firstly, the system adaptively matches a preset sliding time window size based on the user's electricity consumption scenario (such as residential, commercial, or industrial park). And the basic discrimination threshold. Based on the real-time active power data of the object to be identified within the target sliding time window, the load fluctuation coefficient is calculated. This coefficient is used to quantify the degree of dispersion of load from the average level, reflecting the drastic fluctuations in electricity load during that period. Its calculation formula is as follows: ; In the formula, This refers to the load fluctuation coefficient; The total number of load sampling points within the sliding time window; The first one in the window Real-time active power at each sampling point; This refers to the average value of the real-time active power within the sliding window.

[0084] Secondly, utilize the load fluctuation coefficient The system dynamically fine-tunes the base threshold. It presets a first coefficient (e.g., 0.1) and a second coefficient (e.g., 0.05), and adjusts the load fluctuation coefficient accordingly. The adjustment value is determined, and then the dynamic discrimination threshold is obtained. The specific formula for calculating the dynamic threshold is as follows: ; ; ; In the formula, Refers to the dynamic probability threshold; Refers to the base probability threshold; The high threshold for dynamic anomalies (i.e., the first anomaly threshold). The high threshold of the basic abnormal score; The lower threshold of dynamic anomaly score (i.e., the second anomaly score threshold). This refers to the low threshold of the basic anomaly score.

[0085] For example, a sliding window is set up for residential electricity consumption scenarios. (Data from the past hour), base probability threshold Basic high threshold Low threshold In industrial park scenarios, due to the impact of starting and stopping large equipment, a window is set to improve fault tolerance. (Based on data from the past 2.5 hours), base probability threshold Basic high threshold Low threshold .

[0086] The system comprehensively considers the device's operating status, the duration of the anomaly, and the aforementioned dynamic thresholds to determine the anomaly based on the target's probability of electricity theft and abnormal electricity consumption score. When the electricity load fluctuates drastically (i.e.,...), the system will assess the anomaly. When the value is relatively large, the dynamic threshold It will adaptively improve, thereby effectively filtering false alarms caused by normal load changes, and achieving accurate identification and fine classification of abnormal power consumption behavior in different scenarios.

[0087] For example, Figure 6 This is a dynamic threshold determination and confusion matrix according to an embodiment of the present invention. For example... Figure 6 As shown, in a set of dynamic threshold judgment tests, the confusion matrix includes 650 true normal samples and 350 true abnormal samples. All 650 true normal samples were predicted as normal, while of the 350 true abnormal samples, 12 were predicted as abnormal and 338 were predicted as normal. Therefore, under the current test parameters and threshold settings, the false alarm rate for normal samples is 0%, demonstrating that the dynamic probability threshold and multi-condition joint judgment can suppress false alarms for normal samples under the current test conditions.

[0088] According to the above implementation method, firstly, based on the real-time active power of the object to be identified within a preset sliding time window, a load fluctuation coefficient is calculated to characterize the dynamic fluctuation degree of the electricity load, thereby reflecting the instability of electricity consumption behavior under different scenarios. Then, by multiplying the load fluctuation coefficient by preset coefficients, corresponding adjustment values ​​are obtained. These are further adaptively corrected by combining a basic probability threshold and a basic sub-threshold, constructing a dynamic probability threshold, a first abnormal sub-threshold, and a second abnormal sub-threshold, thus realizing a dynamic adjustment mechanism for the judgment threshold as the load fluctuates. Finally, considering the equipment operating status of the object to be identified, the duration of the abnormality, the dynamic probability threshold, and each abnormal sub-threshold, the target electricity theft probability and abnormal electricity consumption score are jointly determined to obtain the final abnormal electricity consumption identification result. Through the dynamic threshold adjustment and multi-condition fusion judgment mechanism driven by load fluctuations, the adaptability of the judgment rules to complex electricity consumption scenarios can be effectively enhanced, reducing false alarms caused by fixed thresholds.

[0089] In one implementation, based on the device operating status, abnormal duration, dynamic probability threshold, first abnormal score threshold, and second abnormal score threshold of the object to be identified, anomaly determination is made on the target electricity theft probability and abnormal electricity consumption score of the object to be identified to obtain the abnormal electricity consumption identification result of the object to be identified. This includes: if the target electricity theft probability is greater than the dynamic probability threshold, the abnormal electricity consumption score is greater than the first abnormal score threshold, the device operating status is abnormal, and the abnormal duration is greater than or equal to a preset first duration threshold, then the first abnormal category is determined as the abnormal electricity consumption identification result of the object to be identified; if the target electricity theft probability is greater than the dynamic probability threshold, the abnormal electricity consumption score is greater than or equal to the second abnormal score threshold and less than or equal to the first abnormal score threshold, the device operating status is normal, and the abnormal duration is greater than or equal to a preset second duration threshold, then the second abnormal category is determined as the abnormal electricity consumption identification result of the object to be identified; if the target electricity theft probability is less than or equal to the dynamic probability threshold, the abnormal electricity consumption score is greater than the first abnormal score threshold, the device operating status is abnormal, and the abnormal duration is greater than or equal to a preset third duration threshold, then the third abnormal category is determined as the abnormal electricity consumption identification result of the object to be identified.

[0090] For example, if the probability of the target electricity theft is... Greater than the dynamic probability threshold And abnormal electricity consumption score Greater than the first abnormal threshold Meanwhile, the equipment is in an abnormal operating state, and the abnormality lasts for a certain period of time. Greater than or equal to the preset first duration threshold (For example, If the data collection period exceeds one continuous data acquisition cycle (lasting more than one minute), the object to be identified is determined to be a case of strong interference or short-circuit electricity theft, and the first anomaly category is identified as the abnormal electricity usage result. This type of anomaly is verified from multiple dimensions through characteristic waveform distortion and statistical feature mutation, and is used to effectively identify serious electricity theft methods such as high-frequency jammers or live wire short circuits.

[0091] For example, if the probability of the target electricity theft is... Greater than the dynamic probability threshold And abnormal electricity consumption score satisfy (in (This is the second abnormal threshold), while the device is operating normally and the abnormal duration is... Greater than or equal to the preset second duration threshold (For example, If the number of hours (hours) is recorded, the entity to be identified is determined to be engaging in electricity theft by diverting current or bypassing the meter, and the second anomaly category is identified as an abnormal electricity consumption result. This type of electricity theft is characterized by significant long-term concealment, and long-term continuous monitoring is used to eliminate fluctuations and interferences such as normal temporary shutdowns or load reductions during holidays.

[0092] For example, if the probability of the target electricity theft is... Less than or equal to the dynamic probability threshold And abnormal electricity consumption score Greater than the first abnormal threshold Meanwhile, the equipment is in an abnormal operating state, and the abnormality lasts for a certain period of time. Greater than or equal to the preset third duration threshold (For example, If the data usage exceeds a certain threshold (e.g., 1 hour), the device to be identified is determined to be either a metering equipment malfunction or a data anomaly, and the third anomaly category is identified as the abnormal power consumption result. This judgment logic aims to eliminate occasional data loss caused by communication network jitter, ensuring that equipment maintenance prompts are generated promptly after a substantial physical fault is confirmed.

[0093] According to the above implementation method, a first incremental sample set is constructed based on the abnormal electricity consumption identification results, novel electricity theft samples, and equipment operation and maintenance data. The first incremental sample set is standardized to eliminate dimensional differences and distribution shifts between different data sources, resulting in a second incremental sample set. This second incremental sample set is then fused with a historical sample set to form a target sample set covering the distribution of both new and old samples, thereby improving the completeness and representativeness of the dataset. Subsequently, based on the target sample set, the parameters of the adaptive decision tree model and the adaptive time-frequency fusion prediction model are iteratively updated using a mini-batch gradient descent method, enabling the models to continuously learn new electricity theft behavior patterns and equipment operating status changes. This enhances the model's adaptability to novel electricity theft samples, thereby improving the timeliness and accuracy of overall abnormal electricity consumption identification.

[0094] In one implementation, the method further includes: if the abnormal electricity consumption identification result is a first abnormal category, then sending a first push message to the person in charge of inspection and the on-site verification personnel to trigger an immediate response process, wherein the first push message includes the identity identifier of the object to be identified, the abnormal time, the abnormal type, the probability of electricity theft, the abnormal score, and the push content of the on-site verification suggestion; if the abnormal electricity consumption identification result is a second abnormal category, then sending a second push message to the person in charge of inspection to trigger a time-limited verification process, wherein the second push message includes the identity identifier of the object to be identified, the abnormal time, the abnormal type, the probability of electricity theft, and the abnormal score; if the abnormal electricity consumption identification result is a third abnormal category, then sending a third push message to the maintenance personnel to trigger an equipment repair and data recovery process, wherein the third push message includes the identity identifier of the object to be identified, the identity identifier of the faulty equipment, the fault time, and the abnormal score.

[0095] For example, the first anomaly category refers to the result category that belongs to the high-risk abnormal electricity use type after comprehensive judgment. It usually corresponds to the situation where both the probability of electricity theft and the abnormal electricity use score exceed the high-level threshold. For example, if an industrial user has a target probability of electricity theft of 0.92 and an abnormal electricity use score of 0.88 in a certain period of time, it is judged to be in the first anomaly category.

[0096] For example, the first push information refers to the high-priority alarm information generated for the first anomaly category, which is used to trigger the immediate response process. Its content includes at least the identity identifier, anomaly time, anomaly type, probability of electricity theft, anomaly score, and on-site verification suggestions.

[0097] For example, “User A-20260410 engaged in high-risk electricity theft at 14:00 on April 10, 2026, with a theft probability of 0.92 and an anomaly score of 0.88. It is recommended to immediately conduct on-site verification of the metering device and line connection.”

[0098] In this example, if the abnormal electricity usage identification result is classified as the first abnormal category (serious alarm), the system determines that it has characteristics of high risk, strong interference, or short-circuit electricity theft. At this time, the system immediately sends a first push notification to the area's electricity inspection supervisor and on-site inspectors. This push notification includes not only the identification of the target, the time of the abnormality, the probability of electricity theft, and the abnormality score, but also a detailed list of the abnormality type and precise on-site inspection location suggestions. The response time is set to immediate, requiring on-site inspectors to respond within a preset response period. (For example, We will arrive at the scene within 24 hours to conduct an inspection in order to stop serious illegal occupation of electricity.

[0099] For example, the second anomaly category refers to an abnormal electricity consumption type that is determined to be of medium risk, where the probability of electricity theft or the anomaly score reaches a preset medium-level threshold but does not reach a high-level threshold. For instance, a commercial user with a probability of electricity theft of 0.65 and an anomaly score of 0.60 is determined to be in the second anomaly category.

[0100] For example, the second push information refers to the alarm information generated for the second anomaly category, which is used to trigger a time-limited verification process. Its content includes identity identifier, anomaly time, anomaly type, probability of electricity theft, and anomaly score. For example, "User B-20260410 has suspected abnormal electricity usage behavior on April 10, 2026, with a probability of electricity theft of 0.65 and anomaly score of 0.60. Please complete the verification within the specified time."

[0101] In this example, if the abnormal electricity consumption identification result is the second abnormal category (important warning), corresponding to long-term hidden risks such as diversion or meter circumvention for electricity theft, the system will send a second push notification containing the identification of the object to be identified, the abnormal time, the abnormal type, the probability of electricity theft, the abnormal score, and the main abnormal electricity consumption characteristics to the person in charge of the area's power inspection. The response time is set to a preset response period. (For example, (Hours), the person in charge will arrange for a dedicated person to conduct on-site inspections in order to effectively manage moderate anomalies.

[0102] For example, the third anomaly category refers to the result category that is determined to be a device anomaly or a data anomaly, which is usually characterized by a high anomaly score but a low probability of electricity theft. For example, a user with a probability of electricity theft of 0.12 but an anomaly score of 0.82 is determined to be in the device anomaly category.

[0103] For example, the third push information refers to the operation and maintenance notification information generated for the third anomaly category, which is used to trigger the equipment maintenance and data recovery process. Its content includes the identity of the object to be identified, the faulty equipment identifier, the fault time, and the anomaly score. For example, "User C-20260410's associated electricity meter equipment number MTR-009 experienced an anomaly on April 10, 2026, with an anomaly score of 0.82. It is recommended to carry out equipment maintenance and data calibration."

[0104] In this example, if the abnormal power consumption identification result is the third abnormal category (equipment maintenance prompt), it corresponds to a metering equipment malfunction or data acquisition anomaly. The system will send a third push notification containing the faulty equipment's identification, fault time, abnormal score, and fault type prediction to the power equipment maintenance personnel. The response time is set to a preset response period. (For example, Within a specified timeframe (hours), maintenance personnel must complete equipment repair and data recovery to ensure the accuracy and integrity of power distribution network operation data.

[0105] Figure 7 This is a structural block diagram of an abnormal electricity consumption behavior identification system according to an embodiment of the present invention.

[0106] like Figure 7 As shown, the system for identifying abnormal electricity consumption behavior may include: The acquisition module 510 is used to acquire sample data corresponding to the electricity consumption behavior of the object to be identified, wherein the sample data includes each first sample feature and the feature label corresponding to the first sample feature; The filtering module 520 is used to dynamically filter each first sample feature based on the correlation and collinearity between each first sample feature and the feature label to obtain second sample features. The electricity theft probability prediction module 530 is used to predict the electricity theft probability of the feature vector in the second sample features through an adaptive decision tree model, so as to obtain the target electricity theft probability of the object to be identified. Anomaly prediction module 540 is used to perform anomaly prediction on the feature sequence in the second sample features through an adaptive time-frequency fusion prediction model to obtain the abnormal power consumption score of the object to be identified. The anomaly determination module 550 is used to determine the anomaly of the target electricity theft probability and abnormal electricity consumption score of the object to be identified based on a dynamic probability threshold, and to obtain the abnormal electricity consumption identification result of the object to be identified.

[0107] In one embodiment, the filtering module includes: The probability distribution estimation unit is used to perform probability distribution estimation on each of the first sample features and the feature labels to obtain each first marginal probability of the first sample feature, each second marginal probability of the feature label, and the joint probability between each of the first sample features and the feature labels. The mutual information entropy calculation unit is used to determine each comprehensive edge probability based on the product of each first edge probability and each second edge probability; determine each probability ratio based on the ratio of each joint probability to each comprehensive edge probability; and sum the logarithms of each probability ratio based on each joint probability to obtain the mutual information entropy corresponding to the first sample feature. The elimination unit is used to eliminate each first sample feature whose mutual information entropy is less than the correlation threshold from each first sample feature based on the mutual information entropy corresponding to each first sample feature, so as to obtain a first feature subset. The update unit is used to update the first feature subset based on the collinearity of each feature in the first feature subset to obtain the second sample features.

[0108] In one embodiment, the updating unit includes: A set determination subunit is used to determine the first feature subset as the feature set to be processed, wherein the feature set to be processed includes each currently retained feature; The auxiliary regression model establishes a sub-unit, which is used to establish an auxiliary regression model for each of the currently retained features, taking the currently retained feature as the dependent variable and the remaining currently retained features in the set of features to be processed other than the currently retained feature as independent variables; The fitting calculation subunit is used to fit the auxiliary regression model using the least squares method to obtain the determination coefficient of the auxiliary regression model; The variance inflation factor calculation subunit is used to determine the variance difference value based on the difference between a preset constant and the determination coefficient, and to divide the constant by the variance difference value to obtain the variance inflation factor of the currently retained feature; The feature set update subunit is used to remove the current retained feature corresponding to the largest variance inflation factor from the feature set if there is a variance inflation factor greater than a preset collinearity threshold among the variance inflation factors of each of the currently retained features, so as to update the feature set and use the updated feature set as the feature set to be processed in the next iteration. The iteration termination subunit is used to stop the iteration if the variance inflation factor of each currently retained feature in the set of features to be processed is less than or equal to the collinearity threshold, and to determine each currently retained feature in the set of features to be processed at the time of stopping the iteration as the second sample feature.

[0109] In one embodiment, the anomaly detection module includes: The load fluctuation coefficient calculation unit is used to calculate the load fluctuation coefficient corresponding to the object to be identified based on the real-time active power of the object to be identified within a preset sliding time window. The dynamic probability threshold calculation unit is used to determine a first adjustment value based on the product of a preset first coefficient and the load fluctuation coefficient; and to multiply the sum of a preset constant and the first adjustment value by a preset basic probability threshold to obtain the dynamic probability threshold. The first anomaly threshold calculation unit is used to determine a second adjustment value based on the product of a preset second coefficient and the load fluctuation coefficient; and to multiply the difference between the constant and the second adjustment value by a preset first basic threshold to obtain a first anomaly threshold. The second anomaly threshold calculation unit is used to multiply the difference between the constant and the second adjustment value by a preset second base threshold to obtain the second anomaly threshold. An anomaly determination unit is used to determine the target electricity theft probability and abnormal electricity consumption score of the object to be identified based on the device operating status, abnormal duration, dynamic probability threshold, first abnormal score threshold and second abnormal score threshold of the object to be identified, and to obtain the abnormal electricity consumption identification result of the object to be identified.

[0110] In one embodiment, the anomaly determination unit includes: The first determination subunit is used to determine the first abnormal category as the abnormal electricity consumption identification result of the object to be identified if the target electricity theft probability is greater than the dynamic probability threshold, the abnormal electricity consumption score is greater than the first abnormal score threshold, the device operating status is abnormal, and the abnormal duration is greater than or equal to a preset first duration threshold. The second determination subunit is used to determine the second abnormal category as the abnormal electricity consumption identification result of the object to be identified if the target electricity theft probability is greater than the dynamic probability threshold, the abnormal electricity consumption score is greater than or equal to the second abnormal score threshold and less than or equal to the first abnormal score threshold, the device is in normal operating status, and the abnormal duration is greater than or equal to the preset second duration threshold. The third determination subunit is used to determine the third abnormal category as the abnormal electricity consumption identification result of the object to be identified if the target electricity theft probability is less than or equal to the dynamic probability threshold, the abnormal electricity consumption score is greater than the first abnormal score threshold, the device operating status is abnormal, and the abnormal duration is greater than or equal to the preset third duration threshold.

[0111] In one embodiment, the electricity theft probability prediction module includes: The decision tree processing unit is used to input the feature vector into each decision tree in the adaptive decision tree model for processing, to obtain each local prediction score, and to sum the local prediction scores to obtain the first prediction value. A cross-layer feature interaction function processing unit is used to input the feature vector into the cross-layer feature interaction function of the adaptive decision tree model for processing to obtain a second predicted value, wherein the cross-layer feature interaction function is constructed using a two-layer fully connected network; The original prediction output value calculation unit is used to determine the target interaction value based on the product of the preset feature interaction coefficient and the second prediction value, and to determine the original prediction output value based on the sum of the first prediction value and the target interaction value. The mapping processing unit is used to map the original predicted output value through a preset activation function to obtain the initial probability of electricity theft. The conditional probability calculation unit is used to calculate the conditional probability of the initial electricity theft probability using a kernel density estimation algorithm, so as to obtain the first conditional probability of the initial electricity theft probability under the electricity theft condition and the second conditional probability of the feature vector under the normal condition. The correction unit is used to correct the first conditional probability and the second conditional probability using a preset prior probability to obtain the target electricity theft probability.

[0112] In one implementation, the anomaly prediction module includes: The target block size determination unit is used to determine the target block size based on the target power consumption scenario of the object to be identified. A high-dimensional mapping processing unit is used to perform high-dimensional mapping processing on the features of each adjacent time step in the feature sequence based on the target block size, so as to obtain a scene-based feature embedding sequence. The temporal branch unit is used to input the scene-based feature embedding sequence into the temporal branch of the adaptive time-frequency fusion prediction model to perform multi-head self-attention calculation, obtain an intermediate temporal sequence, and perform residual connection and layer normalization processing on the intermediate temporal sequence to obtain a temporal feature sequence. A frequency domain branch unit is used to input the scene-based feature embedding sequence into the frequency domain branch of the adaptive time-frequency fusion prediction model to obtain the frequency domain feature sequence output by the frequency domain branch, wherein the frequency domain branch includes a transform layer and an interaction layer; The reconstruction unit is used to reconstruct the time-domain feature sequence and the frequency-domain feature sequence to obtain a reconstructed feature sequence; An error determination unit is used to determine the time-domain reconstruction error and the frequency-domain reconstruction error based on the time-domain difference and the frequency-domain difference between the feature sequence and the reconstructed feature sequence, respectively. The abnormal power consumption score calculation unit is used to perform a weighted summation of the time domain reconstruction error and the frequency domain reconstruction error based on a preset balance coefficient and a scenario-based fusion weight parameter to obtain the abnormal power consumption score of the object to be identified.

[0113] In one implementation, after the anomaly detection module, the system further includes: The first incremental sample set construction module is used to construct the first incremental sample set based on the abnormal electricity consumption identification results, new electricity theft samples, and equipment operation and maintenance data. The standardization processing module is used to standardize the first incremental sample set to obtain the second incremental sample set. The fusion module is used to fuse the second incremental sample set with the historical sample set to obtain the target sample set; The model parameter update module is used to update the model parameters of the adaptive decision tree model and the adaptive time-frequency fusion prediction model respectively based on the target sample set using the mini-batch gradient descent method, so as to obtain the updated adaptive decision tree model and the updated adaptive time-frequency fusion prediction model. The model parameters of the adaptive decision tree model include the node splitting structure and leaf node weight parameters of the decision tree, the weights and biases of the fully connected network, and the adaptive penalty weight coefficients; the model parameters of the adaptive time-frequency fusion prediction model include the parameters of the time-frequency dual-domain coding layer, the scene-based fusion weight parameters in the attention-gated fusion layer, and the weights and biases of the decoding layer.

[0114] In one embodiment, the abnormal electricity consumption behavior identification system further includes: The first push information sending module is used to send the first push information to the person in charge of inspection and the on-site verification personnel if the abnormal electricity consumption identification result is the first abnormal category, so as to trigger the immediate response process. The first push information includes the identity identifier of the object to be identified, the abnormal time, the abnormal type, the probability of electricity theft, the abnormal score, and the push content of on-site verification suggestions. The second push information sending module is used to send the second push information to the person in charge of inspection if the abnormal electricity consumption identification result is the second abnormal category, so as to trigger the time-limited verification process. The second push information includes the identity identifier of the object to be identified, the abnormal time, the abnormal type, the probability of electricity theft, and the abnormal score. The third push information sending module is used to send third push information to maintenance personnel if the abnormal power consumption identification result is the third abnormal category, so as to trigger the equipment maintenance and data recovery process. The third push information includes the identity identifier of the object to be identified, the identity identifier of the faulty equipment, the fault time, and the abnormal score.

[0115] The specific functions and examples of each module and submodule of the system in this embodiment of the invention can be found in the relevant descriptions of the corresponding steps in the above method embodiments, and will not be repeated here.

[0116] The acquisition, storage, and application of user personal information involved in the technical solution of this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0117] This invention also provides a computer device, comprising: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the method described in any one of the embodiments of the present invention.

[0118] The beneficial effects of the computer device in this embodiment of the invention are equivalent to the beneficial effects of the above-described method for identifying abnormal power consumption behavior, and will not be repeated here.

[0119] This invention also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to perform the method described in any one of the embodiments of this invention.

[0120] The beneficial effects of the storage medium of the present invention are equivalent to the beneficial effects of the above-described method for identifying abnormal power consumption behavior, and will not be repeated here.

[0121] Figure 8A schematic block diagram of an example computer device 800 that can be used to implement embodiments of the present invention is shown. Computer device 800 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Computer device 800 may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0122] like Figure 8 As shown, the computer device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. The RAM 803 may also store various programs and data required for the operation of the computer device 800. The computing unit 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0123] Multiple components in computer device 800 are connected to I / O interface 805, including: input unit 806, such as keyboard, mouse, etc.; output unit 807, such as various types of monitors, speakers, etc.; storage unit 808, such as disk, optical disk, etc.; and communication unit 809, such as network card, modem, wireless transceiver, etc. Communication unit 809 allows computer device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0124] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as the method for identifying abnormal power consumption behavior. For example, in some embodiments, the method for identifying abnormal power consumption behavior may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the computer device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the method for identifying abnormal power consumption behavior described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured, by any other suitable means (e.g., by means of firmware), to perform a method for identifying abnormal power consumption behavior.

[0125] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0126] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0127] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0128] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0129] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0130] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0131] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this invention can be achieved, and this is not limited herein.

[0132] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for identifying abnormal electricity consumption behavior, characterized in that, include: Obtain sample data corresponding to the electricity consumption behavior of the object to be identified, wherein the sample data includes each first sample feature and the feature label corresponding to the first sample feature; Based on the correlation and collinearity between each of the first sample features and the feature labels, the first sample features are dynamically filtered to obtain the second sample features; By using an adaptive decision tree model, the probability of electricity theft is predicted from the feature vectors in the second sample features, thus obtaining the target probability of electricity theft for the object to be identified. An abnormality prediction is performed on the feature sequence in the second sample feature by using an adaptive time-frequency fusion prediction model to obtain the abnormal electricity consumption score of the object to be identified. Based on a dynamic probability threshold, the target electricity theft probability and abnormal electricity consumption score of the object to be identified are used to determine the abnormal electricity consumption identification result of the object to be identified.

2. The method according to claim 1, characterized in that, The step of dynamically filtering each of the first sample features based on the correlation and collinearity between each of the first sample features and the feature labels to obtain the second sample features includes: For each of the first sample features and the feature labels, a probability distribution estimation is performed on the first sample features and the feature labels to obtain each of the first edge probabilities of the first sample features, each of the second edge probabilities of the feature labels, and the joint probability between each of the first sample features and the feature labels; Each comprehensive edge probability is determined based on the product of each first edge probability and each second edge probability; each probability ratio is determined based on the ratio of each joint probability to each comprehensive edge probability; and the logarithms of each probability ratio are summed based on each joint probability to obtain the mutual information entropy corresponding to the first sample feature. Based on the mutual information entropy corresponding to each of the first sample features, the first sample features whose mutual information entropy is less than the correlation threshold are removed from each of the first sample features to obtain the first feature subset; Based on the collinearity of the features in the first feature subset, the first feature subset is updated to obtain the second sample features.

3. The method according to claim 2, characterized in that, The step of updating the first feature subset based on the collinearity of each feature in the first feature subset to obtain the second sample features includes: The first feature subset is determined as the feature set to be processed, wherein the feature set to be processed includes each currently retained feature; For each of the currently retained features, the currently retained feature is used as the dependent variable, and the remaining currently retained features in the set of features to be processed, excluding the currently retained feature, are used as independent variables to establish an auxiliary regression model; The determination coefficient of the auxiliary regression model is obtained by fitting the model using the least squares method. Based on the difference between the preset constant and the determination coefficient, the variance difference value is determined, and the constant is divided by the variance difference value to obtain the variance inflation factor of the currently retained feature; If any of the variance inflation factors of the currently retained features is greater than a preset collinearity threshold, then the currently retained feature corresponding to the largest variance inflation factor is removed from the set of features to be processed to update the set of features to be processed, and the updated set of features to be processed is used as the set of features to be processed in the next iteration. If the variance inflation factor of each currently retained feature in the set of features to be processed is less than or equal to the collinearity threshold, then the iteration stops, and each currently retained feature in the set of features to be processed at the time of stopping the iteration is determined as the second sample feature.

4. The method according to claim 1, characterized in that, The method of determining anomalies based on the target electricity theft probability and abnormal electricity consumption score of the object to be identified using a dynamic probability threshold, and obtaining the abnormal electricity consumption identification result of the object to be identified, includes: Based on the real-time active power of the object to be identified within a preset sliding time window, calculate the load fluctuation coefficient corresponding to the object to be identified. A first adjustment value is determined based on the product of a preset first coefficient and the load fluctuation coefficient; and the sum of a preset constant and the first adjustment value is multiplied by a preset base probability threshold to obtain the dynamic probability threshold. A second adjustment value is determined based on the product of a preset second coefficient and the load fluctuation coefficient; and the difference between the constant and the second adjustment value is multiplied by a preset first basic threshold to obtain a first anomaly threshold. The difference between the constant and the second adjustment value is multiplied by a preset second basic threshold to obtain the second anomaly threshold. Based on the device operating status, abnormal duration, dynamic probability threshold, first abnormal score threshold, and second abnormal score threshold of the object to be identified, anomaly determination is made on the target electricity theft probability and abnormal electricity consumption score of the object to be identified, and the abnormal electricity consumption identification result of the object to be identified is obtained.

5. The method according to claim 4, characterized in that, The process involves determining the target electricity theft probability and abnormal electricity consumption score of the object to be identified based on the device operating status, abnormal duration, dynamic probability threshold, first abnormal score threshold, and second abnormal score threshold, thereby obtaining the abnormal electricity consumption identification result of the object to be identified, including: If the target electricity theft probability is greater than the dynamic probability threshold, the abnormal electricity consumption score is greater than the first abnormal score threshold, the device operating status is abnormal, and the abnormal duration is greater than or equal to the preset first duration threshold, then the first abnormal category is determined as the abnormal electricity consumption identification result of the object to be identified. If the target electricity theft probability is greater than the dynamic probability threshold, the abnormal electricity consumption score is greater than or equal to the second abnormal score threshold and less than or equal to the first abnormal score threshold, the device is in normal operating status, and the abnormal duration is greater than or equal to the preset second duration threshold, then the second abnormal category is determined as the abnormal electricity consumption identification result of the object to be identified. If the target electricity theft probability is less than or equal to the dynamic probability threshold, the abnormal electricity consumption score is greater than the first abnormal score threshold, the device operating status is abnormal, and the abnormal duration is greater than or equal to the preset third duration threshold, then the third abnormal category is determined as the abnormal electricity consumption identification result of the object to be identified.

6. The method according to claim 1, characterized in that, The step of predicting the probability of electricity theft from the feature vectors in the second sample features using an adaptive decision tree model to obtain the target probability of electricity theft for the object to be identified includes: The feature vectors are input into each decision tree in the adaptive decision tree model for processing to obtain local prediction scores. The local prediction scores are then summed to obtain the first prediction value. The feature vector is input into the cross-layer feature interaction function of the adaptive decision tree model for processing to obtain a second predicted value. The cross-layer feature interaction function is constructed using a two-layer fully connected network. The target interaction value is determined based on the product of the preset feature interaction coefficient and the second predicted value, and the original predicted output value is determined based on the sum of the first predicted value and the target interaction value. The initial probability of electricity theft is obtained by mapping the original predicted output value through a preset activation function. The initial electricity theft probability is calculated using a kernel density estimation algorithm to obtain the first conditional probability of the initial electricity theft probability under the electricity theft condition, and the second conditional probability of the feature vector under the normal condition. The first conditional probability and the second conditional probability are corrected by using a preset prior probability to obtain the target electricity theft probability.

7. The method according to claim 1, characterized in that, The step of using an adaptive time-frequency fusion prediction model to predict anomalies in the feature sequences of the second sample features to obtain the abnormal electricity consumption score of the object to be identified includes: The target block size is determined based on the target electricity consumption scenario of the object to be identified; Based on the target block size, the features of each adjacent time step in the feature sequence are subjected to high-dimensional mapping processing to obtain a scene-based feature embedding sequence. The scene-based feature embedding sequence is input into the time-domain branch of the adaptive time-frequency fusion prediction model for multi-head self-attention calculation to obtain an intermediate time-domain sequence. The intermediate time-domain sequence is then subjected to residual connection and layer normalization to obtain a time-domain feature sequence. The scene-based feature embedding sequence is input into the frequency domain branch of the adaptive time-frequency fusion prediction model to obtain the frequency domain feature sequence output by the frequency domain branch, wherein the frequency domain branch includes a transform layer and an interaction layer; The time-domain feature sequence and the frequency-domain feature sequence are reconstructed to obtain the reconstructed feature sequence; Based on the time-domain and frequency-domain differences between the feature sequence and the reconstructed feature sequence, the time-domain reconstruction error and the frequency-domain reconstruction error are determined respectively. Based on the preset balance coefficient and scenario-based fusion weight parameters, the time-domain reconstruction error and the frequency-domain reconstruction error are weighted and summed to obtain the abnormal power consumption score of the object to be identified.

8. The method according to claim 1, characterized in that, After determining the abnormality of the target electricity theft probability and abnormal electricity consumption score of the object to be identified based on a dynamic probability threshold, and obtaining the abnormal electricity consumption identification result of the object to be identified, the method further includes: Based on the abnormal electricity consumption identification results, new electricity theft samples, and equipment operation and maintenance data, a first incremental sample set is constructed. The first incremental sample set is standardized to obtain the second incremental sample set. The second incremental sample set is merged with the historical sample set to obtain the target sample set; Based on the target sample set, the model parameters of the adaptive decision tree model and the adaptive time-frequency fusion prediction model are updated respectively using the mini-batch gradient descent method to obtain the updated adaptive decision tree model and the updated adaptive time-frequency fusion prediction model. The model parameters of the adaptive decision tree model include the node splitting structure and leaf node weight parameters of the decision tree, the weights and bias parameters of the fully connected network, and the adaptive penalty weight coefficient. The model parameters of the adaptive time-frequency fusion prediction model include the parameters of the time-frequency dual-domain coding layer, the scene-based fusion weight parameters in the attention-gated fusion layer, and the weight and bias parameters of the decoding layer.

9. The method according to claim 1, characterized in that, Also includes: If the abnormal electricity consumption identification result is the first abnormal category, the first push information will be sent to the person in charge of inspection and the on-site verification personnel to trigger the immediate response process. The first push information includes the identity of the object to be identified, the abnormal time, the abnormal type, the probability of electricity theft, the abnormal score, and the push content of the on-site verification suggestion. If the abnormal electricity consumption identification result is the second abnormal category, then the second push information is sent to the person in charge of the inspection to trigger the time-limited verification process. The second push information includes the identity of the object to be identified, the abnormal time, the abnormal type, the probability of electricity theft, and the abnormal score. If the abnormal power consumption identification result is the third abnormal category, the third push information will be sent to the operation and maintenance personnel to trigger the equipment maintenance and data recovery process. The third push information includes the identity identifier of the object to be identified, the identity identifier of the faulty equipment, the fault time, and the abnormal score.

10. A system for identifying abnormal electricity consumption behavior, characterized in that, include: The acquisition module is used to acquire sample data corresponding to the electricity consumption behavior of the object to be identified, wherein the sample data includes each first sample feature and the feature label corresponding to the first sample feature; The filtering module is used to dynamically filter each first sample feature based on the correlation and collinearity between each first sample feature and the feature label to obtain second sample features. The electricity theft probability prediction module is used to predict the electricity theft probability of the feature vector in the second sample features through an adaptive decision tree model, so as to obtain the target electricity theft probability of the object to be identified. An anomaly prediction module is used to perform anomaly prediction on the feature sequence in the second sample features through an adaptive time-frequency fusion prediction model, so as to obtain the abnormal power consumption score of the object to be identified. The anomaly detection module is used to determine the anomaly of the target electricity theft probability and abnormal electricity consumption score of the object to be identified based on a dynamic probability threshold, and to obtain the abnormal electricity consumption identification result of the object to be identified.

Images