Power data adaptive anomaly detection method and system supporting stream processing

Abstract

The application discloses a kind of power data adaptive anomaly detection method and system supporting stream processing, belong to electric power stream data processing technical field.Solution first obtains the power data stream containing electric meter, area terminal, user interaction;According to the adaptive adjustment time window width of buffer data volume, obtain the variable width window;In window, three types of data are fused to construct joint data unit, and real-time power consumption state information is obtained by stream computing;Compare it with dynamic baseline library, and determine abnormality if it exceeds adaptive threshold;Analysis exception generates structured disposal information containing type, confidence, influence range and pushes work order system;According to the reverse correction threshold and baseline library of work order disposal result, form adaptive closed loop.The application can dynamically adapt data flow, fuse multi-source power data, realize detection standard autonomous iteration, open abnormal identification and operation dispatching process, improve power anomaly detection real-time and accuracy.

Description

Technical Field

[0001] This application relates to the fields of power system automation, data processing and streaming computing, anomaly detection and intelligent operation and maintenance, and specifically to an adaptive anomaly detection method and system for power data that supports streaming processing. Background Technology

[0002] Currently, there are several main methods for anomaly detection in power data: The first type is batch processing, which involves storing collected power data over a period of time and then analyzing and judging anomalies once a batch is accumulated. The second type is based on fixed time windows, which involves pre-setting a fixed time period, such as every 5 minutes or 1 hour, and analyzing and detecting data within that time frame. The third type uses offline training models, which involve training a detection model on historical data, fixing the model parameters, and then using it in an online operating environment.

[0003] While the above methods are effective in certain scenarios, they still have several obvious shortcomings: First, the detection window cannot be dynamically adjusted. A fixed window width results in significant data flow fluctuations during peak and off-peak electricity usage periods. During peak periods, a large amount of data can accumulate within the window, making processing difficult, while during off-peak periods, too little data in the window leads to wasted computing resources, impacting both real-time performance and resource utilization efficiency.

[0004] Second: The detection model lacks the ability to continuously evolve. The parameters of the offline-trained model are fixed. When the user's power consumption pattern changes with the seasons or the equipment ages, the detection accuracy will gradually decrease, and the model cannot adjust and optimize itself according to the actual situation.

[0005] Third: The detection results are disconnected from business processing. Many methods only output an anomaly label, such as normal or abnormal, without providing information such as the specific type of anomaly, severity, or scope of impact. They also cannot be integrated with business systems such as customer service work orders and repair dispatch orders. As a result, after an anomaly is discovered, it still needs to be manually analyzed and processed, making the whole process inefficient and slow.

[0006] In summary, existing technologies lack a truly adaptive, continuously evolving power data anomaly detection solution that can work in conjunction with business systems. Therefore, improvements to existing technologies are necessary. Summary of the Invention

[0007] The purpose of this invention is to provide an adaptive anomaly detection method and system for power data that supports streaming processing.

[0008] To achieve the objectives of this invention, the technical solution provided by this invention is as follows: First aspect This invention provides an adaptive anomaly detection method for power data supporting streaming processing, comprising the following steps: Step 101: Obtain the power data stream, which includes user meter data, transformer terminal data, and user interaction data; Step 102: For the power data stream, construct a time-series buffer structure based on a time window, and adaptively adjust the window width of the time window according to the dynamic changes in the amount of data within the time-series buffer structure to obtain a variable-width time window; Step 103: Within the widened time window, associate the user meter data, the transformer terminal data, and the user interaction data into a joint data unit and perform streaming processing to generate real-time electricity consumption status information; Step 104: Compare the real-time power consumption status information with the historical baselines in the preset dynamic baseline library. When the comparison result shows that the deviation exceeds the preset adaptive threshold, an abnormal event is identified. Step 105: Analyze the abnormal event to obtain abnormality type information, confidence level information, and impact range information, and integrate them into structured handling information; Step 106: Push the structured processing information to the customer service work order system to generate a dispatch instruction, and obtain the processing result data returned by the customer service work order system. Based on the processing result data, correct the adaptive threshold and the dynamic baseline library to form an adaptive closed-loop feedback for anomaly detection.

[0009] Further, step 102 includes the following steps: A timing buffer structure is established based on the initial window width, and the power data stream is stored in the timing buffer structure in the order of arrival. Real-time monitoring of the amount of data stored in the time-series buffer structure exceeding the preset capacity upper limit and the amount of data falling short of the preset capacity lower limit; When the excess amount is detected, the window width is reduced according to the ratio of the excess amount to the preset capacity upper limit; or when the insufficient amount is detected, the window width is increased according to the ratio of the insufficient amount to the preset capacity lower limit. The timing buffer structure is rebuilt based on the reduced or increased window width, and the rebuilt timing buffer structure is used as the variable-width time window.

[0010] Further, step 103 includes the following steps: Within the widened time window, the electricity consumption readings from the user's electricity meter data, the operating parameters from the transformer terminal data, and the interaction records from the user interaction data are acquired. The electricity consumption readings, the operating parameters, and the interaction records are each separated into data items according to time identifiers and data source identifiers; Extract timestamps and source codes from each of the data items, and combine multiple data items with the same timestamp and source codes belonging to a preset association rule set into a joint data unit; The combined data unit is stream-processed to substitute the electricity consumption reading, the operating parameters and the interaction record in the combined data unit into a preset mapping relationship for numerical conversion to obtain a first value, a second value and a third value. The first value, the second value, and the third value are summed according to their combined weights to obtain real-time power consumption status information.

[0011] Further, the step of combining multiple data items with the same timestamp and whose source code belongs to a preset association rule set into a joint data unit includes: The data type of each data item is determined based on the source code, and the data type includes electricity consumption type, operation type and interaction type; The data items are grouped according to the timestamp, and data items with the same timestamp are grouped into the same time group. Within the same time group, three data items of the data type belonging to electricity consumption type, operation type and interaction type are combined into a test group, and the source code of the three data items in the test group is obtained; The source codes of the three data items in the combination to be inspected are matched with the rules in the preset association rule set. If the match is successful, the three data items in the combination to be inspected are merged into a joint data unit. Repeat the step of forming a test group from three data items of the data type belonging to electricity consumption type, operation type and interaction type, until all data items in the same time group are traversed.

[0012] Further, step 104 includes the following steps: Read historical baselines that match the real-time power consumption information from the dynamic baseline library, and calculate the difference between the real-time power consumption information and the historical baselines as the degree of deviation; The deviation degree is compared with the adaptive threshold. When the deviation degree is greater than the adaptive threshold, the real-time power consumption status information at the current moment is marked as an abnormal event.

[0013] Further, step 105 includes the following steps: Based on the real-time power consumption status information associated with the abnormal event, the corresponding abnormal type information is searched from the preset type mapping table; Based on the degree of deviation corresponding to the abnormal event, the confidence information is determined according to the pre-set confidence interval division rules; Based on the user meter data and transformer terminal data associated with the abnormal event, extract the relevant user identifier set and transformer identifier set as the scope of impact information; The anomaly type information, the confidence level information, and the scope of impact information are combined into structured handling information.

[0014] Further, step 106 includes the following steps: The structured processing information is sent to the customer service ticket system, triggering the customer service ticket system to generate a dispatch instruction based on the structured processing information; Receive the processing result data returned by the customer service work order system in response to the dispatch instruction, the processing result data including an anomaly confirmation tag and a processing completion identifier; The value of the adaptive threshold is adjusted by increasing or decreasing according to the anomaly confirmation label, and the historical baseline in the dynamic baseline library corresponding to the real-time power consumption status information that triggered the anomaly event is updated according to the processing completion identifier.

[0015] Second aspect This invention provides an adaptive anomaly detection system for power data that supports streaming processing, comprising the following modules: The power data stream acquisition module is used to acquire power data streams, which include user meter data, transformer terminal data, and user interaction data. A variable-width time window module is used to construct a time-series buffer structure based on a time window for the power data stream, and adaptively adjust the window width of the time window according to the dynamic changes in the amount of data within the time-series buffer structure to obtain a variable-width time window. The real-time electricity consumption status information generation module is used to associate the user's electricity meter data, the transformer terminal data and the user interaction data into a joint data unit and perform streaming processing within the widened time window to generate real-time electricity consumption status information. An abnormal event identification module is used to compare the real-time power consumption status information with historical baselines in a preset dynamic baseline library. When the comparison result shows that the deviation exceeds a preset adaptive threshold, an abnormal event is identified. The integration module is used to parse the abnormal event, obtain abnormality type information, confidence level information, and impact range information, and integrate them into structured handling information; The instruction generation module is used to push the structured processing information to the customer service work order system to generate a dispatch instruction, and to obtain the processing result data returned by the customer service work order system. Based on the processing result data, the module corrects the adaptive threshold and the dynamic baseline library to form an adaptive closed-loop feedback for anomaly detection.

[0016] Furthermore, the module for obtaining the widened time window is specifically used to perform the following steps: A timing buffer structure is established based on the initial window width, and the power data stream is stored in the timing buffer structure in the order of arrival. Real-time monitoring of the amount of data stored in the time-series buffer structure exceeding the preset capacity upper limit and the amount of data falling short of the preset capacity lower limit; When the excess amount is detected, the window width is reduced according to the ratio of the excess amount to the preset capacity upper limit; or when the insufficient amount is detected, the window width is increased according to the ratio of the insufficient amount to the preset capacity lower limit. The timing buffer structure is rebuilt based on the reduced or increased window width, and the rebuilt timing buffer structure is used as the variable-width time window.

[0017] Furthermore, the real-time power consumption status information generation module is specifically used to perform the following steps: Within the widened time window, the electricity consumption readings from the user's electricity meter data, the operating parameters from the transformer terminal data, and the interaction records from the user interaction data are acquired. The electricity consumption readings, the operating parameters, and the interaction records are each separated into data items according to time identifiers and data source identifiers; Extract timestamps and source codes from each of the data items, and combine multiple data items with the same timestamp and source codes belonging to a preset association rule set into a joint data unit; The combined data unit is stream-processed to substitute the electricity consumption reading, the operating parameters and the interaction record in the combined data unit into a preset mapping relationship for numerical conversion to obtain a first value, a second value and a third value. The first value, the second value, and the third value are summed according to their combined weights to obtain real-time power consumption status information.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: (1) This application dynamically adjusts the window width by monitoring the changes in the amount of data in the buffer structure in real time, so that the detection rhythm can be automatically adjusted according to the speed of the data flow. (2) This application achieves unified processing of multi-source data by accurately associating the three types of data according to timestamp and source code within a widened time window and merging them into a joint data unit; (3) This application enables the detection standard to be automatically adjusted to follow changes in actual electricity consumption through a dynamic baseline library and an adaptive threshold continuous update mechanism; (4) This application generates structured handling information by parsing abnormal events and pushes it directly to the customer service work order system to realize automated linkage from abnormal event discovery to task assignment; (5) This application obtains the processing result data returned by the customer service work order system, and reverses the adaptive threshold and dynamic baseline library based on the on-site verification and processing situation to form a self-evolving closed loop. Attached Figure Description

[0019] Figure 1 This is a schematic flowchart of an adaptive anomaly detection method for power data that supports streaming processing, provided in an embodiment of this application. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0021] It should be noted that the acquisition of data and collection of information in this application are legal, compliant, or obtained with the consent of the subject of the data collection.

[0022] This application provides an adaptive anomaly detection method for power data that supports streaming processing. A flowchart of one specific implementation is shown below. Figure 1 As shown, the method includes: Step 101: Obtain the power data stream, which includes user meter data, transformer terminal data, and user interaction data.

[0023] In step 101, the power data stream refers to the set of digital data generated in real time by smart metering devices, distribution network monitoring devices, and customer service interaction systems. User meter data includes electricity readings, voltage values, and current values ​​recorded by smart meters. Distribution area terminal data includes operating frequency, load rate, and communication status parameters collected by distribution area monitoring terminals. User interaction data includes consultation records, repair records, and complaint records generated by users through customer service channels.

[0024] In this embodiment, the power data stream is first accessed in real time through a data acquisition interface. This power data stream consists of user meter data, transformer terminal data, and user interaction data. Specifically, user meter data is obtained from the smart meter data acquisition platform, transformer terminal data is obtained from the transformer concentrator, and user interaction data is obtained from the customer service database. Then, the above three types of data are aggregated according to a unified data format to obtain a complete power data stream. The above example is only one example of this application. In practical applications, the data acquisition method can also be set according to the requirements. This application does not limit this.

[0025] Step 102: For the power data stream, construct a time-series buffer structure based on a time window, and adaptively adjust the window width of the time window according to the dynamic changes in the amount of data within the time-series buffer structure to obtain a variable-width time window.

[0026] Among them, the time-series buffer structure refers to the memory area used to temporarily store power data streams. This structure organizes the storage queue according to the order in which the data arrives; the data volume refers to the total number of data entries currently stored in the time-series buffer structure; the window width refers to the length of time covered by the time window, and the value of this width determines the upper limit of the amount of data that can be accommodated in a processing cycle.

[0027] In this embodiment, step 102 includes the following process: Step 1021: Establish a timing buffer structure based on the initial window width, and store the power data stream into the timing buffer structure in the order of arrival.

[0028] In this embodiment, an initial window width is first set, which can be pre-configured according to the average arrival rate of the power data stream. Then, a continuous storage area is divided in memory according to the initial window width, which is the timing buffer structure. After the timing buffer structure is established, the power data streams received in real time are written into the timing buffer structure in the order of arrival time. Each power data is appended to the end of the timing buffer structure.

[0029] In practical applications, assuming the average arrival rate of the power data stream is 1000 data points per second, and the initial window width is set to 1 second, the timing buffer structure is established as a storage space that can accommodate 1000 data points. Subsequently, each power data point received is stored in this timing buffer structure. The above example is only one example of this application. In practical applications, the initial window width can also be set according to the requirements. This application does not limit this.

[0030] Step 1022: Monitor in real time the amount of data stored in the time-series buffer structure that exceeds the preset capacity upper limit and the amount that is insufficient compared to the preset capacity lower limit.

[0031] In step 1022, the preset capacity upper limit refers to the maximum number of data entries that the time buffer structure can accommodate. This value is used to determine whether the data is overloaded. The preset capacity lower limit refers to the minimum number of data entries required for the time buffer structure to maintain normal processing efficiency. This value is used to determine whether the data is sparse. The excess amount refers to the difference between the amount of stored data and the preset capacity upper limit. The insufficient amount refers to the difference between the preset capacity lower limit and the amount of stored data.

[0032] In this embodiment, during the continuous storage of power data streams into the time-series buffer structure, the total number of data entries currently stored in the time-series buffer structure is counted in real time to obtain the amount of stored data. The amount of stored data is compared with a preset capacity upper limit. When the amount of stored data is greater than the preset capacity upper limit, the difference between the amount of stored data and the preset capacity upper limit is calculated, and this difference is the excess amount. At the same time, the amount of stored data is compared with a preset capacity lower limit. When the amount of stored data is less than the preset capacity lower limit, the difference between the preset capacity lower limit and the amount of stored data is calculated, and this difference is the insufficient amount.

[0033] In practical applications, assuming the preset upper limit of the time-series buffer structure is 1200 data entries and the preset lower limit is 800 data entries, if the current stored data volume is 1350 data entries, then the stored data volume is greater than the preset upper limit, and the excess is 1350-1200=150 data entries; if the current stored data volume is 650 data entries, then the stored data volume is less than the preset lower limit, and the deficiency is 800-650=150 data entries. The above example is only one example of this application. In practical applications, the preset upper limit and preset lower limit can also be set according to the requirements, and this application does not limit this.

[0034] Step 1023: When the excess amount is detected, the window width is reduced according to the ratio of the excess amount to the preset capacity upper limit; or when the insufficient amount is detected, the window width is increased according to the ratio of the insufficient amount to the preset capacity lower limit.

[0035] In step 1023, the ratio refers to the ratio obtained by dividing the excess amount by the preset upper limit of capacity, or the ratio obtained by dividing the insufficient amount by the preset lower limit of capacity; reducing the window width means multiplying the current window width by a coefficient less than 1, which is positively correlated with the above ratio; increasing the window width means multiplying the current window width by a coefficient greater than 1, which is positively correlated with the above ratio.

[0036] In this embodiment, it is first determined whether an excess or deficiency is detected in step 1022. When an excess is detected, the ratio of the excess to the preset upper limit of capacity is calculated, and this ratio is used as a reduction coefficient. Then, the current window width is multiplied by 1 and the difference of the reduction coefficient is subtracted to obtain a new window width, which is smaller than the original window width. When a deficiency is detected, the ratio of the deficiency to the preset lower limit of capacity is calculated, and this ratio is used as an expansion coefficient. Then, the current window width is multiplied by 1 and the sum of the expansion coefficient is added to obtain a new window width, which is larger than the original window width.

[0037] In practical applications, assuming the current window width is 1 second, the preset capacity limit is 1200 data entries, and 150 data entries are detected as exceeding the limit, then the reduction factor = 150 ÷ ​​1200 = 0.125, and the new window width = 1 × (1 - 0.125) = 0.875 seconds; assuming the current window width is 1 second, the preset capacity limit is 800 data entries, and 150 data entries are detected as falling short, then the expansion factor = 150 ÷ ​​800 = 0.1875, and the new window width = 1 × (1 + 0.1875) = 1.1875 seconds. The above examples are only one example of this application. In practical applications, the reduction and expansion methods can be set according to requirements, and this application does not limit them.

[0038] Step 1024: Rebuild the timing buffer structure based on the reduced or increased window width, and use the rebuilt timing buffer structure as the variable-width time window.

[0039] In this embodiment, the new window width calculated in step 1023 is obtained, and the storage capacity required for the timing buffer structure is recalculated based on the new window width. The storage capacity is equal to the new window width multiplied by the average arrival rate of the power data stream. Then, a new timing buffer structure is established in memory according to the recalculated storage capacity, and the unprocessed data in the original timing buffer structure is migrated to the new timing buffer structure. The time coverage range corresponding to the re-established timing buffer structure is used as a variable-width time window, and the width of the variable-width time window is the new window width calculated in step 1023.

[0040] In practical applications, assuming the new window width is 0.875 seconds and the average arrival rate of the power data stream is 1000 data entries per second, the recalculated storage capacity is 0.875 × 1000 = 875 data entries. A new time-series buffer structure is established based on the capacity of 875 data entries, and the remaining unprocessed data in the original time-series buffer structure is migrated to the new time-series buffer structure. The time coverage range with a width of 0.875 seconds is used as the widened time window. The above example is only one example of this application. In practical applications, the calculation method of storage capacity can also be set according to the requirements. This application does not limit this.

[0041] This application enables the timing buffer structure to dynamically adjust its capacity according to real-time changes in data flow by adaptively adjusting the window width, thereby avoiding data backlog and resource waste, and improving the real-time performance and resource utilization of detection.

[0042] Step 103: Within the widened time window, the user meter data, the transformer terminal data, and the user interaction data are associated as a joint data unit and streamed to generate real-time electricity status information.

[0043] Among them, a joint data unit refers to a temporary data set formed by merging three different types of data generated at the same time; streaming processing refers to the operation mode of performing real-time calculations on each of the continuously arriving joint data units; and real-time power consumption status information refers to a quantitative value used to describe the overall status of a user's power consumption behavior within a widened time window.

[0044] In this embodiment, step 103 includes the following process: Step 1031: Within the widened time window, acquire the electricity consumption readings from the user's electricity meter data, the operating parameters from the transformer terminal data, and the interaction records from the user interaction data.

[0045] In step 1031, the electricity consumption reading refers to the cumulative electricity consumption value recorded by the user's electricity meter, the operating parameters refer to the power grid operating frequency value collected by the distribution terminal, and the interaction record refers to the count of user operation behaviors generated through customer service channels.

[0046] In this embodiment of the application, the time coverage range of the variable-width time window generated in step 102 is first determined. Then, the electricity consumption reading is read from the user meter data stored in the variable-width time window, the operating parameters are read from the transformer terminal data, and the interaction records are read from the user interaction data. The electricity consumption reading, operating parameters and interaction records all have the same time identifier, which is used to indicate the time when the data was generated.

[0047] In practical applications, assuming the time coverage of the widened time window is from the 1.0 second to the 1.875th second, the electricity consumption reading obtained from the user's meter data within this time range is 3.2 kWh, the operating parameter obtained from the transformer terminal data is 49.8 Hz, and the interaction record obtained from the user interaction data is 1 query operation. The above example is only one example of this application. In practical applications, the acquisition method can also be set according to the requirements, and this application does not limit it.

[0048] Step 1032: The electricity consumption readings, the operating parameters, and the interaction records are split into data items according to the time identifier and the data source identifier, respectively.

[0049] In step 1032, the time identifier refers to the timestamp value attached to each data entry, which is used to mark the time when the data was generated; the data source identifier refers to the coded value used to distinguish whether the data comes from the user's electricity meter, the distribution terminal, or the user interaction system; and the data item refers to the smallest processing unit formed by binding the electricity consumption reading, operating parameters, or interaction records with the corresponding time identifier and data source identifier.

[0050] In this embodiment, firstly, the time identifier and data source identifier are extracted from the electricity consumption reading obtained in step 1031, and the electricity consumption reading is combined with the extracted time identifier and data source identifier into a data item; similarly, the time identifier and data source identifier are extracted from the operating parameters, and the operating parameters are combined with the extracted time identifier and data source identifier into another data item; the time identifier and data source identifier are extracted from the interaction record, and the interaction record is combined with the extracted time identifier and data source identifier into another data item; after the above operations, the electricity consumption reading, operating parameters, and interaction record are respectively converted into three independent data items.

[0051] In practical applications, assuming the electricity reading is 3.2 kWh, the time marker is 1.5 seconds, and the data source identifier is 01 representing the user's meter, the combined data item is {time marker 1.5 seconds, data source identifier 01, electricity reading 3.2 kWh}; the operating parameter is 49.8 Hz, the time marker is 1.5 seconds, and the data source identifier is 02 representing the distribution terminal, the combined data item is {time marker 1.5 seconds, data source identifier 02, operating parameter 49.8 Hz}; the interaction record is 1 query operation, the time marker is 1.5 seconds, and the data source identifier is 03 representing the user interaction system, the combined data item is {time marker 1.5 seconds, data source identifier 03, 1 interaction record}. The above examples are only one example of this application. In practical applications, the encoding method of the data source identifier can also be set according to requirements, and this application does not limit this.

[0052] Step 1033: Extract timestamps and source codes from each of the data items, and combine multiple data items with the same timestamp and source codes belonging to a preset association rule set into a joint data unit.

[0053] Among them, timestamp refers to the specific numerical value of the time identifier carried in the data item; source code refers to the specific coded value of the data source identifier carried in the data item; and preset association rule set refers to the pre-configured rule set used to determine which data items corresponding to which source codes can be combined together.

[0054] Step 1033 may specifically include the following steps: A1: The data type of each data item is determined according to the source code, and the data type includes electricity consumption type, operation type and interaction type.

[0055] In step A1, electricity consumption type refers to the classification identifier of the data item originating from the user's electricity meter data; operation type refers to the classification identifier of the data item originating from the transformer terminal data; and interaction type refers to the classification identifier of the data item originating from the user's interaction data.

[0056] In this embodiment of the application, for each data item generated in step 1032, the source code is extracted and compared with a pre-set type mapping table; when the value of the source code falls within the first value range, the data type of the data item is determined to be the electricity consumption type; when the value of the source code falls within the second value range, the data type of the data item is determined to be the operation type; when the value of the source code falls within the third value range, the data type of the data item is determined to be the interaction type.

[0057] In practical applications, assuming a pre-defined type mapping table, source code 01 corresponds to the application type, source code 02 corresponds to the operation type, and source code 03 corresponds to the interaction type; then for the data item {time marker 1.5 seconds, source code 01, electricity consumption reading 3.2 kWh}, after extracting source code 01, its data type is determined to be the application type; for the data item {time marker 1.5 seconds, source code 02, operation parameter 49.8 Hz}, its data type is determined to be the operation type; for the data item {time marker 1.5 seconds, source code 03, 1 interaction record}, ​​its data type is determined to be the interaction type. The above example is only one example of this application. In practical applications, the type mapping table can also be set according to requirements, and this application does not limit this.

[0058] A2: Group the data items according to the timestamp, and group data items with the same timestamp into the same time group.

[0059] In step A2, a time group refers to a set of multiple data items that have the same timestamp value.

[0060] In this embodiment of the application, all data items generated in step 1032 are obtained, and the timestamp in each data item is extracted; data items with the same timestamp value are divided into the same set, which is called a time group; different timestamp values ​​correspond to different time groups, and each time group contains one or more data items.

[0061] In practical applications, if there are three data items with timestamps all at 1.5 seconds, then these three data items will be grouped into the same time group; if there are two other data items with timestamps all at 1.6 seconds, then these two data items will be grouped into another time group. The above example is only one example of this application. In practical applications, the grouping method can also be set according to the requirements. This application does not limit this.

[0062] A3: Within the same time group, the three data items of the data type belonging to the electricity consumption type, operation type and interaction type are combined into a test group, and the source code of the three data items in the test group is obtained.

[0063] In step A3, the combination to be inspected refers to a temporary data set consisting of one power consumption type data item, one operation type data item, and one interaction type data item within the same time group.

[0064] In this embodiment of the application, within the same time group obtained in step A2, a data item of data type with electricity consumption, a data item of data type with operation, and a data item of data type with interaction are selected from the time group; the three selected data items are taken as a test group; and then the source code of the electricity consumption data item, the source code of the operation data item, and the source code of the interaction data item in the test group are extracted respectively.

[0065] In practical applications, assuming that the same time group contains electricity consumption type data item {time marker 1.5 seconds, source code 01, electricity consumption reading 3.2 kWh}, operation type data item {time marker 1.5 seconds, source code 02, operation parameter 49.8 Hz}, and interaction type data item {time marker 1.5 seconds, source code 03, interaction record 1 time}, then these three data items are combined into a test group, and the source codes of the three data items in the test group are obtained as 01, 02, and 03, respectively. The above example is only one example of this application. In practical applications, the selection method can also be set according to the requirements, and this application does not limit it.

[0066] A4: Match the source codes of the three data items in the combination to be inspected with the rules in the preset association rule set. If the match is successful, merge the three data items in the combination to be inspected into a joint data unit.

[0067] In step A4, the "preset association rule set" in this application adopts exact matching logic. This set pre-stores multiple sets of allowed combination source code triples. Each triple is composed of the source code corresponding to the power consumption type, the source code corresponding to the operation type, and the source code corresponding to the interaction type arranged in a fixed order. During matching, the source codes of the three data items in the combination to be checked are extracted and the triples to be checked are formed in the order of power consumption type, operation type, and interaction type. The triples to be checked are compared element by element with each triple in the preset association rule set. Only when the three source code values ​​in the triples to be checked are completely consistent with the three source code values ​​of a triple in the set, is the match determined to be successful and the corresponding three data items are merged into a joint data unit.

[0068] In this embodiment, the source codes of the three data items in the test combination obtained in step A3 are obtained, and the three source codes are input as a combination into a preset association rule set for matching; each rule entry in the preset association rule set is traversed, and it is checked whether the source code combination specified in the rule entry is completely consistent with the three input source codes; if there is a rule entry that is completely consistent with the three input source codes, the matching is successful, and the three data items in the test combination are merged into a joint data unit; if there is no matching rule entry, the test combination is abandoned and no merging operation is performed.

[0069] In practical applications, assuming that the preset association rule set contains a rule that specifies that the source codes for allowed combinations are 01, 02, and 03; and the source codes of the three data items in the combination to be tested are 01, 02, and 03, which are completely consistent with the rule, then the match is successful. The electricity consumption type data item, the operation type data item, and the interaction type data item are merged into a joint data unit. This joint data unit contains an electricity consumption reading of 3.2 kWh, an operation parameter of 49.8 Hz, and one interaction record. The above example is only one example of this application. In practical applications, the association rule set can also be set according to the requirements, and this application does not limit this.

[0070] A5: Repeat the step of forming a test group from the three data items whose data type belongs to electricity consumption type, operation type and interaction type, until all data items in the same time group are traversed.

[0071] In this embodiment of the application, within the same time group obtained in step A2, all data items in the time group are traversed; each time, a power consumption type data item, an operation type data item, and an interaction type data item are selected from the remaining unprocessed data items to form a new test combination, and the test combination is matched and merged in accordance with the method of step A4; the above selection and matching process is repeated until all data items in the time group that can form test combinations are processed.

[0072] In practical applications, assuming that the same time group contains 2 electricity consumption type data items, 2 operation type data items, and 2 interaction type data items, the first three data items of the first group are selected to form the first test group for processing. Then, the second three data items of the second group are selected to form the second test group for processing, until all data items have been traversed. The above example is only one example of this application. In practical applications, the traversal order can also be set according to the requirements. This application does not limit this.

[0073] Step 1034: Perform streaming processing on the combined data unit to substitute the electricity consumption reading, the operating parameters and the interaction record in the combined data unit into a preset mapping relationship for numerical conversion to obtain a first value, a second value and a third value.

[0074] In step 1034, the preset mapping relationship refers to the pre-configured corresponding rules for converting the original readings into dimensionless values; the first value refers to the intermediate value obtained after the power consumption reading is converted; the second value refers to the intermediate value obtained after the operating parameters are converted; and the third value refers to the intermediate value obtained after the interactive record is converted.

[0075] In this embodiment of the application, the joint data unit generated in step 1033 is obtained, and the electricity consumption reading, operating parameters and interaction records are extracted from the joint data unit respectively; the electricity consumption reading is substituted into the electricity consumption mapping relationship, and the corresponding first value is calculated according to the electricity consumption mapping relationship; the operating parameters are substituted into the operating mapping relationship, and the corresponding second value is calculated according to the operating mapping relationship; the interaction records are substituted into the interaction mapping relationship, and the corresponding third value is calculated according to the interaction mapping relationship.

[0076] In practical applications, assuming the electricity mapping relationship is: first value = electricity reading ÷ 10, and the electricity reading is 3.2 kWh, then the first value = 3.2 ÷ 10 = 0.32; the operation mapping relationship is: second value = operation parameter ÷ 50, and the operation parameter is 49.8 Hz, then the second value = 49.8 ÷ 50 = 0.996; the interaction mapping relationship is: third value = interaction record × 0.1, and the interaction record is 1 time, then the third value = 1 × 0.1 = 0.1. The above examples are only one example of this application. In practical applications, mapping relationships can also be set according to requirements, and this application does not limit this.

[0077] Step 1035: Summarize the first value, the second value, and the third value according to their combined weights to obtain real-time power consumption status information.

[0078] In step 1035, the combined weight refers to the weighting coefficients pre-assigned to the first, second, and third values, which are used to represent the importance of different types of data in the state assessment.

[0079] In this embodiment of the application, the first value, the second value, and the third value obtained in step 1034 are obtained, and the first weight corresponding to the power consumption type, the second weight corresponding to the operation type, and the third weight corresponding to the interaction type are read from the preset configuration; the first value is multiplied by the first weight to obtain the first weighted value, the second value is multiplied by the second weight to obtain the second weighted value, and the third value is multiplied by the third weight to obtain the third weighted value; the first weighted value, the second weighted value, and the third weighted value are added together to obtain the real-time power consumption status information.

[0080] In practical applications, assuming the first weight is 0.5, the second weight is 0.3, the third weight is 0.2, the first value is 0.32, the second value is 0.996, and the third value is 0.1, then the first weighted value = 0.32 × 0.5 = 0.16, the second weighted value = 0.996 × 0.3 = 0.2988, the third weighted value = 0.1 × 0.2 = 0.02, and the real-time power consumption status information = 0.16 + 0.2988 + 0.02 = 0.4788. The above example is only one example of this application. In practical applications, combined weights can be set according to needs, and this application does not limit this.

[0081] This application achieves the simultaneous fusion and transformation of multiple types of data in a single processing flow by associating multi-source data into a joint data unit and performing streaming processing. This avoids the intermediate step of processing and then merging the data separately, thereby improving processing efficiency and data consistency.

[0082] Step 104: Compare the real-time power consumption status information with the historical baselines in the preset dynamic baseline library. When the comparison result shows that the deviation exceeds the preset adaptive threshold, an abnormal event is identified.

[0083] Among them, the dynamic baseline library refers to an updatable database collection that stores historical baseline data; the historical baseline refers to a reference value extracted from the real-time power consumption status information at a historical moment, which is used as the basis for judging whether the current status is normal; the deviation degree refers to the size of the difference between the real-time power consumption status information and the historical baseline; the preset adaptive threshold refers to a judgment boundary value that is pre-configured and can be dynamically adjusted, which is used to determine whether the deviation degree reaches the abnormal standard; and the abnormal event refers to the real-time power consumption status information at a specific moment that is marked as having an abnormal power consumption situation.

[0084] In this embodiment, step 104 includes the following process: Step 1041: Read the historical baseline that matches the real-time power consumption information from the dynamic baseline library, and calculate the difference between the real-time power consumption information and the historical baseline as the degree of deviation.

[0085] In step 1041, the difference value refers to the absolute value of the difference obtained by subtracting the historical baseline value from the real-time power consumption status information value.

[0086] In this embodiment of the application, the real-time power consumption status information generated in step 103 is first obtained. Then, based on the time identifier corresponding to the real-time power consumption status information, the historical baseline corresponding to the same time identifier is read from the dynamic baseline library. The value of the real-time power consumption status information is subtracted from the value of the historical baseline to obtain the difference between the two. The absolute value of the difference is then taken as the degree of deviation.

[0087] In practical applications, assuming the real-time power consumption status information generated in step 103 is 0.4788, and the time stamp corresponding to this real-time power consumption status information is the 1.5th second, and the historical baseline corresponding to the 1.5th second is read from the dynamic baseline library as 0.5000, then the deviation degree = |0.4788-0.5000| = 0.0212. The above example is only one example of this application. In practical applications, the method of reading the historical baseline can also be set according to the requirements. This application does not limit this.

[0088] Step 1042: Compare the degree of deviation with the adaptive threshold. When the comparison result is that the degree of deviation is greater than the adaptive threshold, mark the real-time power consumption status information at the current moment as an abnormal event.

[0089] In this embodiment of the application, the deviation degree calculated in step 1041 is obtained, and the adaptive threshold at the current time is also obtained; the value of the deviation degree is compared with the value of the adaptive threshold; when the value of the deviation degree is greater than the value of the adaptive threshold, the real-time power consumption status information corresponding to the deviation degree and the time to which it belongs are marked as an abnormal event; when the value of the deviation degree is less than or equal to the value of the adaptive threshold, no marking operation is performed.

[0090] In practical applications, assuming the deviation is 0.0212 and the adaptive threshold at the current moment is 0.0200, since 0.0212 is greater than 0.0200, the real-time power consumption information 0.4788 at the 1.5th second is marked as an abnormal event. If the adaptive threshold is 0.0250, since 0.0212 is less than 0.0250, no marking is performed. The above example is only one example of this application. In practical applications, the value of the adaptive threshold can be set according to the requirements. This application does not limit this.

[0091] This application achieves accurate identification of abnormal events by comparing real-time power consumption status information with historical baselines in a dynamic baseline library and using adaptive thresholds to determine the degree of deviation. At the same time, the continuous updating mechanism of the dynamic baseline library ensures that the detection standard can be adjusted with changes in power consumption patterns.

[0092] Step 105: Analyze the abnormal event to obtain abnormality type information, confidence level information, and scope of impact information, and integrate them into structured handling information.

[0093] Among them, anomaly type information refers to the classification identifier used to describe the category to which the anomaly event belongs; confidence information refers to the probability value used to represent the reliability of the anomaly judgment; impact range information refers to the set of identifiers used to describe the users and transformer areas affected by the anomaly event; and structured handling information refers to the standardized data block formed by organizing the anomaly type information, confidence information and impact range information according to a preset format.

[0094] In this embodiment, step 105 includes the following process: Step 1051: Based on the real-time power consumption status information associated with the abnormal event, search for the corresponding abnormal type information from the preset type mapping table.

[0095] In step 1051, the preset type mapping table refers to a pre-configured lookup table used to map the numerical range of real-time power consumption status information to anomaly type classification identifiers, as shown in Table 1: Table 1. Examples of Type Mapping

[0096] The above example is only one example of this application. In practical applications, the content of the preset type mapping table can also be set according to the requirements. This application does not limit this.

[0097] In this embodiment of the application, the abnormal event marked in step 104 is first obtained, and the value of the real-time power consumption status information associated with the abnormal event is extracted; then, a preset type mapping table is obtained, which records the correspondence between multiple value ranges and abnormal type classification identifiers; the value of the real-time power consumption status information is compared with each value range in the preset type mapping table to find the value range to which the value belongs, and then the abnormal type classification identifier corresponding to the value range is read, and the read classification identifier is used as the abnormal type information.

[0098] In practical applications, assuming that the preset type mapping table records the voltage anomaly type corresponding to the value range of 0.00 to 0.20, the current anomaly type corresponding to the value range of 0.20 to 0.40, and the power anomaly type corresponding to the value range of 0.40 to 0.60; and the real-time power consumption status information generated in step 103 is 0.4788, which falls within the value range of 0.40 to 0.60, then the anomaly type information found is the power anomaly type. The above example is only one example of this application. In practical applications, the content of the preset type mapping table can also be set according to the requirements, and this application does not limit it in this regard.

[0099] Step 1052: Determine the confidence information according to the degree of deviation corresponding to the abnormal event and the pre-set confidence interval division rules.

[0100] In step 1052, the confidence interval refers to multiple pre-divided numerical ranges, each corresponding to a confidence value; the pre-set confidence interval division rules refer to the correspondence used to map the deviation degree values ​​to the confidence values, as shown in Table 2: Table 2 Examples of Preset Reliability Interval Division Rules

[0101] The above example is only one example of this application. In practical applications, the rules for dividing the confidence interval can be set according to the needs. This application does not limit this.

[0102] In this embodiment of the application, the deviation value calculated in step 1041 is first obtained; then the pre-set confidence interval division rule is obtained, which records the correspondence between multiple deviation value intervals and confidence values; the deviation value is compared with each deviation value interval in the division rule to find the interval to which the deviation value belongs, and then the confidence value corresponding to the interval is read, and the read confidence value is used as confidence information.

[0103] In practical applications, assuming that the pre-set confidence interval division rules record a confidence level of 0.3 for the deviation range of 0.00 to 0.01, a confidence level of 0.5 for the deviation range of 0.01 to 0.02, and a confidence level of 0.7 for the deviation range of 0.02 to 0.03; and the deviation calculated in step 1041 is 0.0212, which falls within the deviation range of 0.02 to 0.03, then the determined confidence level is 0.7. The above example is only one example of this application. In practical applications, the pre-set confidence interval division rules can also be set according to requirements, and this application does not limit this.

[0104] Step 1053: Based on the user meter data and transformer terminal data associated with the abnormal event, extract the relevant user identifier set and transformer identifier set as the scope of impact information.

[0105] In step 1053, the user identifier set refers to a set of multiple user identifiers, each of which is used to uniquely identify a user; the transformer area identifier set refers to a set of multiple transformer area identifiers, each of which is used to uniquely identify a transformer area.

[0106] In this embodiment of the application, the abnormal events marked in step 104 are first obtained, and the user meter data and transformer terminal data associated with the abnormal events are extracted; the user identifier to which the data belongs is read from the user meter data, and the user identifier is added to the user identifier set; the transformer area identifier to which the data belongs is read from the transformer terminal data, and the transformer area identifier is added to the transformer area identifier set; the obtained user identifier set and transformer area identifier set are used together as the scope of influence information.

[0107] In practical applications, assuming that the user identifier recorded in the user meter data associated with the abnormal event marked in step 104 is user A, and the transformer area identifier recorded in the associated transformer area terminal data is transformer area B, then the extracted scope of influence information is that the user identifier set contains user A, and the transformer area identifier set contains transformer area B. The above example is only one example of this application. In practical applications, the extraction method can also be set according to the requirements, and this application does not limit it.

[0108] Step 1054: Combine the anomaly type information, the confidence level information, and the impact range information into structured processing information.

[0109] In this embodiment of the application, the anomaly type information obtained in step 1051, the confidence level information obtained in step 1052, and the impact range information obtained in step 1053 are obtained; the anomaly type information, confidence level information, and impact range information are sequentially filled into the corresponding field positions according to the preset structured data format; and the structured data after filling is used as structured processing information.

[0110] In practical applications, assuming the anomaly type information obtained in step 1051 is a power anomaly type, the confidence level information obtained in step 1052 is 0.7, and the impact range information obtained in step 1053 is that the user identifier set contains user A and the transformer area identifier set contains transformer area B, then the combined structured processing information is {anomaly type information: power anomaly type, confidence level information: 0.7, impact range information: user identifier set {user A}, transformer area identifier set {transformer area B}}. The above example is only one example of this application. In practical applications, the structured data format can also be set according to the requirements, and this application does not limit it.

[0111] This application obtains multi-dimensional detailed information by parsing abnormal events and integrates it into structured handling information, making the anomaly detection results interpretable and operable, and providing a complete decision-making basis for subsequent business handling.

[0112] Step 106: Push the structured processing information to the customer service work order system to generate a dispatch instruction, and obtain the processing result data returned by the customer service work order system. Based on the processing result data, correct the adaptive threshold and the dynamic baseline library to form an adaptive closed-loop feedback for anomaly detection.

[0113] Among them, the customer service work order system refers to the external business system used to receive handling information and generate work task orders; the dispatch instruction refers to the task dispatch command generated by the customer service work order system based on structured handling information; and the handling result data refers to the set of result information returned by the customer service work order system after completing the dispatch processing.

[0114] In this embodiment, step 106 includes the following process: Step 1061: Send the structured processing information to the customer service ticket system, triggering the customer service ticket system to generate a dispatch instruction based on the structured processing information.

[0115] In this embodiment of the application, the structured handling information generated in step 105 is first obtained; then the structured handling information is sent to the receiving port of the customer service ticket system in the form of a data packet through the network interface; after receiving the structured handling information, the customer service ticket system reads the exception type information, confidence information and impact scope information from the information, and automatically generates a dispatch instruction based on the content of the above information. The dispatch instruction contains a description of the task to be dispatched and the information of the designated personnel.

[0116] In practical applications, assuming the structured handling information is {anomaly type information: power anomaly type, confidence level information: 0.7, impact range information: user identifier set {User A}, transformer area identifier set {Transformer Area B}}, after sending this structured handling information to the customer service work order system, the customer service work order system generates a dispatch instruction. The content of this dispatch instruction is to dispatch maintenance personnel to transformer area B to check the power anomaly problem of User A. The above example is only one example of this application. In practical applications, the method of sending structured handling information can also be set according to needs. This application does not limit this.

[0117] Step 1062: Receive the processing result data returned by the customer service work order system in response to the dispatch instruction. The processing result data includes an anomaly confirmation tag and a processing completion identifier.

[0118] In step 1062, the anomaly confirmation label refers to the identifier value used to mark whether the anomaly event has been verified as a real anomaly on site. The identifier value is 0 or 1. When the value is 1, it means that the anomaly has been verified and confirmed. When the value is 0, it means that the anomaly has not been verified. The handling completion label refers to the identifier value used to mark whether the anomaly event has been handled. The identifier value is 0 or 1. When the value is 1, it means that the handling has been completed. When the value is 0, it means that the handling has not been completed.

[0119] In this embodiment of the application, after the structured handling information is sent to the customer service ticket system in step 1061, the system waits for the customer service ticket system to complete the dispatch instruction processing flow. After processing the dispatch instruction, the customer service ticket system generates handling result data based on the verification results and processing results fed back from the site. The handling result data includes an anomaly confirmation tag and a handling completion identifier. The system receives the handling result data returned by the customer service ticket system through the network interface and extracts the values ​​of the anomaly confirmation tag and the handling completion identifier from the data.

[0120] In practical applications, assuming that after the customer service work order system completes the dispatch process, the on-site maintenance personnel verify and confirm that there is a power abnormality problem and have completed the repair, the handling result data returned by the customer service work order system will include an abnormality confirmation tag of 1 and a handling completion identifier of 1. If the on-site maintenance personnel verify and confirm that there is no abnormality problem, the abnormality confirmation tag will be 0. If an abnormality is verified but has not yet been handled, the handling completion identifier will be 0. The above example is only one example of this application. In practical applications, the value rules for the abnormality confirmation tag and the handling completion identifier can also be set according to the requirements. This application does not limit this.

[0121] Step 1063: Adjust the value of the adaptive threshold by increasing or decreasing according to the anomaly confirmation label, and update the historical baseline in the dynamic baseline library corresponding to the real-time power consumption status information that triggered the anomaly event according to the processing completion identifier.

[0122] In step 1063, the adjustment of increasing or decreasing means decreasing the value of the adaptive threshold when the anomaly confirmation label indicates that the anomaly has been verified, and increasing the value of the adaptive threshold when the anomaly confirmation label indicates that the anomaly has not been verified.

[0123] In this embodiment, firstly, the anomaly confirmation tag and the handling completion flag are obtained from the handling result data received in step 1062; when the value of the anomaly confirmation tag is 1, the current value of the adaptive threshold is multiplied by a coefficient less than 1 to obtain a reduced adaptive threshold value; when the value of the anomaly confirmation tag is 0, the current value of the adaptive threshold is multiplied by a coefficient greater than 1 to obtain an increased adaptive threshold value; then, when the value of the handling completion flag is 1, the real-time power consumption status information that triggered the anomaly event is obtained, the value of the real-time power consumption status information is used as the new historical baseline, and updated to the corresponding time flag position in the dynamic baseline library, replacing the original historical baseline value; when the value of the handling completion flag is 0, the update operation of the dynamic baseline library is not performed temporarily.

[0124] In practical applications, assuming the current value of the adaptive threshold is 0.0200 and the anomaly confirmation label is 1, the reduced adaptive threshold = 0.0200 × 0.9 = 0.0180; if the anomaly confirmation label is 0, the increased adaptive threshold = 0.0200 × 1.1 = 0.0220; simultaneously assuming the handling completion flag is 1, the real-time power consumption status information that triggered the abnormal event is 0.4788, and the time flag corresponding to this information is the 1.5th second, then this real-time power consumption status information 0.4788 is used as the new historical baseline, and the historical baseline corresponding to the 1.5th second in the dynamic baseline library is updated, replacing the original 0.5000 with 0.4788. The above example is only one example of this application. In practical applications, adjustment coefficients and update rules can also be set according to requirements, and this application does not limit this.

[0125] This application forms a complete closed-loop feedback from anomaly detection to business handling and parameter adjustment by pushing structured handling information to the customer service ticket system and correcting adaptive thresholds and dynamic baselines based on the returned handling results data. This enables the detection standards to be continuously optimized according to the actual handling results, achieving adaptive evolution of detection accuracy.

[0126] In addition, the present invention also provides an adaptive anomaly detection system for power data supporting streaming processing, comprising the following modules: The power data stream acquisition module is used to acquire power data streams, which include user meter data, transformer terminal data, and user interaction data. A variable-width time window module is used to construct a time-series buffer structure based on a time window for the power data stream, and adaptively adjust the window width of the time window according to the dynamic changes in the amount of data within the time-series buffer structure to obtain a variable-width time window. The real-time electricity consumption status information generation module is used to associate the user's electricity meter data, the transformer terminal data and the user interaction data into a joint data unit and perform streaming processing within the widened time window to generate real-time electricity consumption status information. An abnormal event identification module is used to compare the real-time power consumption status information with historical baselines in a preset dynamic baseline library. When the comparison result shows that the deviation exceeds a preset adaptive threshold, an abnormal event is identified. The integration module is used to parse the abnormal event, obtain abnormality type information, confidence level information, and impact range information, and integrate them into structured handling information; The instruction generation module is used to push the structured processing information to the customer service work order system to generate a dispatch instruction, and to obtain the processing result data returned by the customer service work order system. Based on the processing result data, the module corrects the adaptive threshold and the dynamic baseline library to form an adaptive closed-loop feedback for anomaly detection.

[0127] Finally, it should be noted that the above embodiments are merely illustrative and explanatory of the present invention, and are not intended to limit the present invention to the scope of the described embodiments. Furthermore, those skilled in the art will understand that the present invention is not limited to the above embodiments, and many more variations and modifications can be made based on the teachings of the present invention, all of which fall within the scope of protection claimed by the present invention.

Claims

1. An adaptive anomaly detection method for power data supporting streaming processing, characterized in that, Includes the following steps: Step 101: Obtain the power data stream, which includes user meter data, transformer terminal data, and user interaction data; Step 102: For the power data stream, construct a time-series buffer structure based on a time window, and adaptively adjust the window width of the time window according to the dynamic changes in the amount of data within the time-series buffer structure to obtain a variable-width time window; Step 103: Within the widened time window, associate the user meter data, the transformer terminal data, and the user interaction data into a joint data unit and perform streaming processing to generate real-time electricity consumption status information; Step 104: Compare the real-time power consumption status information with the historical baselines in the preset dynamic baseline library. When the comparison result shows that the deviation exceeds the preset adaptive threshold, an abnormal event is identified. Step 105: Analyze the abnormal event to obtain abnormality type information, confidence level information, and scope of impact information, and integrate them into structured handling information; Step 106: Push the structured processing information to the customer service work order system to generate a dispatch instruction, and obtain the processing result data returned by the customer service work order system. Based on the processing result data, correct the adaptive threshold and the dynamic baseline library to form an adaptive closed-loop feedback for anomaly detection.

2. The adaptive anomaly detection method for power data supporting streaming processing according to claim 1, characterized in that, Step 102 includes the following steps: A timing buffer structure is established based on the initial window width, and the power data stream is stored in the timing buffer structure in the order of arrival. Real-time monitoring of the amount of data stored in the time-series buffer structure exceeding the preset capacity upper limit and the amount of data falling short of the preset capacity lower limit; When the excess amount is detected, the window width is reduced according to the ratio of the excess amount to the preset capacity upper limit; or when the insufficient amount is detected, the window width is increased according to the ratio of the insufficient amount to the preset capacity lower limit. The timing buffer structure is rebuilt based on the reduced or increased window width, and the rebuilt timing buffer structure is used as the variable-width time window.

3. The adaptive anomaly detection method for power data supporting streaming processing according to claim 1, characterized in that, Step 103 includes the following steps: Within the widened time window, the electricity consumption readings from the user's electricity meter data, the operating parameters from the transformer terminal data, and the interaction records from the user interaction data are acquired. The electricity consumption readings, the operating parameters, and the interaction records are each separated into data items according to time identifiers and data source identifiers; Extract timestamps and source codes from each of the data items, and combine multiple data items with the same timestamp and source codes belonging to a preset association rule set into a joint data unit; The combined data unit is stream-processed to substitute the electricity consumption reading, the operating parameters and the interaction record in the combined data unit into a preset mapping relationship for numerical conversion to obtain a first value, a second value and a third value; The first value, the second value, and the third value are summed according to their combined weights to obtain real-time power consumption status information.

4. The adaptive anomaly detection method for power data supporting streaming processing according to claim 3, characterized in that, The step of combining multiple data items with the same timestamp and whose source code belongs to a preset association rule set into a joint data unit includes: The data type of each data item is determined based on the source code, and the data type includes electricity consumption type, operation type and interaction type; The data items are grouped according to the timestamp, and data items with the same timestamp are grouped into the same time group. Within the same time group, three data items of the data type belonging to electricity consumption type, operation type and interaction type are combined into a test group, and the source code of the three data items in the test group is obtained; The source codes of the three data items in the combination to be inspected are matched with the rules in the preset association rule set. If the match is successful, the three data items in the combination to be inspected are merged into a joint data unit. Repeat the step of forming a test group from three data items of the data type belonging to electricity consumption type, operation type and interaction type, until all data items in the same time group are traversed.

5. The adaptive anomaly detection method for power data supporting streaming processing according to claim 1, characterized in that, Step 104 includes the following steps: Read historical baselines that match the real-time power consumption information from the dynamic baseline library, and calculate the difference between the real-time power consumption information and the historical baselines as the degree of deviation; The deviation degree is compared with the adaptive threshold. When the deviation degree is greater than the adaptive threshold, the real-time power consumption status information at the current moment is marked as an abnormal event.

6. The adaptive anomaly detection method for power data supporting streaming processing according to claim 1, characterized in that, Step 105 includes the following steps: Based on the real-time power consumption status information associated with the abnormal event, the corresponding abnormal type information is searched from the preset type mapping table; Based on the degree of deviation corresponding to the abnormal event, the confidence information is determined according to the pre-set confidence interval division rules; Based on the user meter data and transformer terminal data associated with the abnormal event, extract the relevant user identifier set and transformer identifier set as the scope of impact information; The anomaly type information, the confidence level information, and the scope of impact information are combined into structured handling information.

7. The adaptive anomaly detection method for power data supporting streaming processing according to claim 1, characterized in that, Step 106 includes the following steps: The structured processing information is sent to the customer service ticket system, triggering the customer service ticket system to generate a dispatch instruction based on the structured processing information; Receive the processing result data returned by the customer service work order system in response to the dispatch instruction, the processing result data including an anomaly confirmation tag and a processing completion identifier; The value of the adaptive threshold is adjusted by increasing or decreasing according to the anomaly confirmation label, and the historical baseline in the dynamic baseline library corresponding to the real-time power consumption status information that triggered the anomaly event is updated according to the processing completion identifier.

8. An adaptive anomaly detection system for power data supporting streaming processing, characterized in that, Includes the following modules: The power data stream acquisition module is used to acquire power data streams, which include user meter data, transformer terminal data, and user interaction data. A variable-width time window module is used to construct a time-series buffer structure based on a time window for the power data stream, and adaptively adjust the window width of the time window according to the dynamic changes in the amount of data within the time-series buffer structure to obtain a variable-width time window. The real-time electricity consumption status information generation module is used to associate the user's electricity meter data, the transformer terminal data and the user interaction data into a joint data unit and perform streaming processing within the widened time window to generate real-time electricity consumption status information. An abnormal event identification module is used to compare the real-time power consumption status information with historical baselines in a preset dynamic baseline library. When the comparison result shows that the deviation exceeds a preset adaptive threshold, an abnormal event is identified. The integration module is used to parse the abnormal event, obtain abnormality type information, confidence level information, and impact range information, and integrate them into structured handling information; The instruction generation module is used to push the structured processing information to the customer service work order system to generate a dispatch instruction, and to obtain the processing result data returned by the customer service work order system. Based on the processing result data, the module corrects the adaptive threshold and the dynamic baseline library to form an adaptive closed-loop feedback for anomaly detection.

9. The adaptive anomaly detection system for power data supporting streaming processing according to claim 8, characterized in that, The module that obtains the widened time window is specifically used to perform the following steps: A timing buffer structure is established based on the initial window width, and the power data stream is stored in the timing buffer structure in the order of arrival. Real-time monitoring of the amount of data stored in the time-series buffer structure exceeding the preset capacity upper limit and the amount of data falling short of the preset capacity lower limit; When the excess amount is detected, the window width is reduced according to the ratio of the excess amount to the preset capacity upper limit; or when the insufficient amount is detected, the window width is increased according to the ratio of the insufficient amount to the preset capacity lower limit. The timing buffer structure is rebuilt based on the reduced or increased window width, and the rebuilt timing buffer structure is used as the variable-width time window.

10. The adaptive anomaly detection system for power data supporting streaming processing according to claim 8, characterized in that, The real-time power consumption status information generation module is specifically used to perform the following steps: Within the widened time window, the electricity consumption readings from the user's electricity meter data, the operating parameters from the transformer terminal data, and the interaction records from the user interaction data are acquired. The electricity consumption readings, the operating parameters, and the interaction records are each separated into data items according to time identifiers and data source identifiers; Extract timestamps and source codes from each of the data items, and combine multiple data items with the same timestamp and source codes belonging to a preset association rule set into a joint data unit; The combined data unit is stream-processed to substitute the electricity consumption reading, the operating parameters and the interaction record in the combined data unit into a preset mapping relationship for numerical conversion to obtain a first value, a second value and a third value; The first value, the second value, and the third value are summed according to their combined weights to obtain real-time power consumption status information.

Images