Electric energy meter electricity stealing behavior correlation feature intelligent detection method based on graph neural network

Abstract

The application provides a kind of electric energy meter electricity stealing behavior correlation feature intelligent detection method based on graph neural network.Application in the technical field of smart grid, the method includes obtaining the electric energy meter instantaneous power consumption characteristics of target power supply area through high-frequency acquisition channel, generating node state sequence;Through the low-frequency acquisition channel, the electric energy meter space topology parameter is obtained, and a topological correlation sequence is generated.Based on the node state sequence, the local abnormality representation value is calculated, and based on the topological correlation sequence, the global distortion representation value is calculated, and whether the electricity stealing risk check signal is generated is comprehensively judged.If generated, the topological continuous evolution feature is extracted, and the target electricity stealing behavior correlation feature is generated according to the topological stability degree in a corresponding way.Finally, its spatial distribution feature is extracted, the incremental optimization or reconstruction training instruction of graph neural network is generated and the detection gain is predicted, and the validity of the regulation and control instruction is verified according to the detection gain deviation after execution.This improves the accuracy of electric energy meter electricity stealing behavior correlation feature detection.

Description

Technical Field

[0001] This invention relates to the field of smart grid technology, and in particular to an intelligent detection method for the correlation features of electricity theft behavior in electricity meters based on graph neural networks. Background Technology

[0002] With the comprehensive advancement of smart grid construction, electricity meters have been deployed on a large scale, providing fundamental support for electricity consumption data collection and electricity consumption behavior analysis. However, electricity theft based on individual meters is showing a trend towards greater concealment, diversification, and organized activity, making traditional detection methods based on single meter consumption data insufficient to meet the needs of safe grid operation.

[0003] Currently, the detection of electricity theft from electricity meters mainly relies on statistical analysis of historical electricity consumption data from individual meters. Abnormal electricity consumption behavior is identified by setting fixed thresholds. Some improved solutions introduce machine learning algorithms to extract and classify the temporal features of electricity consumption data. However, these methods generally have the following drawbacks: First, they only focus on the local electricity consumption characteristics of individual meters, ignoring the inherent spatial topological relationships between meters within the power supply area, and cannot effectively identify group electricity theft activities carried out by tampering with the topology. Second, they fail to distinguish between the different effects of high-frequency instantaneous electricity consumption anomalies and low-frequency topological distortions, making it difficult to locate the location and specific method of electricity theft. Third, the feature extraction process lacks dynamic adaptive capabilities and cannot adjust the feature generation strategy according to real-time changes in the power grid topology, resulting in insufficient generalization ability for new types of electricity theft. Fourth, model training and optimization adopt an offline batch mode, which cannot be adjusted online incrementally according to the actual detection results, and the model performance will significantly degrade over time. The aforementioned problems prevent existing technologies from fully and accurately capturing the correlation features of electricity theft in both the temporal and spatial dimensions, resulting in low accuracy in detecting correlation features of electricity theft by electricity meters. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides an intelligent detection method for the correlation features of electricity theft behavior in electricity meters based on graph neural networks. The method includes: The instantaneous power consumption characteristics of several energy meters within the target power supply area are obtained based on the high-frequency acquisition channel to obtain the node state sequence; the spatial topology parameters between the energy meters are obtained based on the low-frequency acquisition channel to obtain the topology association sequence. Based on the node state sequence, several predicted behavioral features are determined for a future preset monitoring period to determine local anomaly characterization values; based on the topological association sequence, several key connection features are determined for a target monitoring period to determine global distortion characterization values. Based on the local anomaly characterization value and the global distortion characterization value, it is determined whether to generate an electricity theft risk verification signal; if so, several continuous evolution features are obtained based on the topological association sequence to determine the topological stability value. If the topological stability value is less than the preset stability value, then the topological offset index is determined based on the global distortion characterization value, and the graph structure is reconstructed for each of the continuous evolution features to generate target electricity theft behavior association features; if the topological stability value is greater than or equal to the preset stability value, then the target electricity theft behavior association features are directly generated based on each of the continuous evolution features. Extract the spatial distribution features of the target electricity theft behavior association features, obtain the feature aggregation evaluation index, so as to determine whether the high-level control instructions for the graph neural network are incremental optimization instructions or reconstruction training instructions, and predict the relative detection gain coefficient; After the advanced control instruction has been executed for a complete control cycle, the validity of the advanced control instruction for the graph neural network is determined based on the detected gain deviation value.

[0005] Furthermore, the step of determining several predictive behavioral characteristics within a future preset monitoring period based on the node state sequence includes: The node state sequence is divided into several behavioral sub-sequences, and key behavioral sub-sequences are determined based on the data fluctuation characteristics corresponding to each behavioral sub-sequence. The key behavioral subsequences are input into the target prediction model to obtain several predicted behavioral features within a future preset monitoring period output by the target prediction model.

[0006] Further, determining the local anomaly representation value includes: Behavioral trajectory analysis is performed on each of the predicted behavioral features to obtain the corresponding predicted behavioral profile; The local anomaly representation value is determined based on the comparison results between the predicted behavior profile and the preset normal behavior profile.

[0007] Furthermore, the determination of several key connectivity features within the target monitoring period based on the topological association sequence includes: The target monitoring period is divided into several time segments, and the topological association sequences within each time segment are subjected to graph analysis to obtain the time series graph features corresponding to each time segment. Based on the comparison results of the temporal graph features corresponding to each time segment, several key time segments are determined, and based on the spatial topology parameters within each key time segment, several key connectivity features are determined.

[0008] Further, determining the global distortion characterization value includes: Correlation extraction is performed on each of the key connectivity features to obtain the corresponding key topological features; The global distortion characterization value is determined based on the comparison results between the key topological features and the preset normal topological features.

[0009] Further, determining whether to generate an electricity theft risk verification signal based on the local anomaly characterization value and the global distortion characterization value includes: A comprehensive risk comparison value is determined based on the local anomaly characterization value and the global distortion characterization value. If the comprehensive risk comparison value is greater than the preset comparison value, then the electricity theft risk verification signal is generated.

[0010] Further, a feature aggregation evaluation index is obtained to determine whether the high-level control instructions for the graph neural network are incremental optimization instructions or reconstructive training instructions, and the relative detection gain coefficient is predicted, including: Obtain the node cluster density and connectivity of the connected graph in the spatial distribution features; The feature aggregation evaluation index is obtained by calculating the weighted product of the node cluster density and the connectivity of the connected graph; If the feature aggregation evaluation index is less than or equal to the first preset evaluation index, the reconstruction training instruction is executed, and the first relative detection gain coefficient is predicted as the relative detection gain coefficient. If the feature aggregation evaluation index is greater than the first preset evaluation index and less than or equal to the second preset evaluation index, the incremental optimization instruction is executed, and the second relative detection gain coefficient is predicted as the relative detection gain coefficient. Wherein, the first preset evaluation index is less than the second preset evaluation index, and the first relative detection gain coefficient is greater than the second relative detection gain coefficient.

[0011] Further, determining whether the high-level control instruction for the graph neural network is qualified based on the detection gain deviation value includes: Obtain the pre-regulation characteristic aggregation evaluation index and the post-regulation characteristic aggregation evaluation index; The difference between the post-regulation feature aggregation evaluation index and the pre-regulation feature aggregation evaluation index is calculated to obtain the evaluation index difference. The actual relative detection gain coefficient is obtained by calculating the ratio of the difference in the evaluation index to the pre-regulation feature aggregation evaluation index. The difference between the actual relative detection gain coefficient and the relative detection gain coefficient is used to obtain the detection gain deviation value; If the detected gain deviation value is greater than the preset deviation value, the advanced control command is deemed unqualified. If the detected gain deviation value is less than or equal to the preset deviation value, then the advanced control command is deemed qualified.

[0012] Furthermore, the method also includes: If the advanced control command is not qualified, the convergence process of the loss function of the graph neural network is monitored in real time, and the parameter rollback or structural search optimization is performed on the advanced control command based on the convergence change coefficient. The process of determining whether to perform parameter rollback or structural search optimization on the advanced control command based on the convergence change coefficient includes: Set a statistical window that includes a period of time containing a series of the aforementioned advanced control commands; The feature aggregation evaluation index obtained at the start time of the statistical window is denoted as the initial evaluation index; The feature aggregation evaluation index at the current moment is obtained and recorded as the current evaluation index; The convergence change coefficient is obtained by calculating the ratio of the difference between the current evaluation index and the initial evaluation index to the initial evaluation index. If the convergence change coefficient is less than or equal to the first preset change coefficient, then it is determined that the parameter rollback will be performed. If the convergence change coefficient is greater than the first preset change coefficient and less than or equal to the second preset change coefficient, then it is determined that fine-tuning and rollback combined with parameter optimization will be performed. If the convergence change coefficient is greater than the second preset change coefficient, then the structure search optimization is performed; wherein the first preset change coefficient is less than the second preset change coefficient. This invention employs dual-channel data acquisition—using a high-frequency acquisition channel to obtain instantaneous electricity consumption characteristics and a low-frequency acquisition channel to obtain spatial topology parameters—to simultaneously acquire single-meter time-series electricity consumption characteristics and inter-meter spatial correlation characteristics, thereby improving the dimensionality and comprehensiveness of electricity theft correlation characteristics. By separately calculating the local anomaly representation value of single-meter predicted behavior and the global distortion representation value of topological key connections, it achieves joint judgment of isolated single-meter anomalies and regional correlation anomalies, improving the accuracy of initial screening for electricity theft anomalies. Based on the topology stability value, it generates target electricity theft behavior correlation characteristics using either direct generation or graph structure reconstruction, adapting to both stable and dynamically changing power grid topology scenarios, thus improving the scenario adaptability of correlation feature generation. By extracting the spatial distribution characteristics of target correlation features to generate advanced model control instructions, and verifying the control effect based on detection gain deviation, it achieves closed-loop adaptive optimization of the graph neural network, improving the model's detection robustness in complex electricity consumption environments.

[0013] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of the present invention, nor is it intended to restrict the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0014] The above and other features, advantages, and aspects of the various embodiments of the present invention will become more apparent from the accompanying drawings and the following detailed description. The drawings are provided for a better understanding of the invention and are not intended to limit the scope of the invention. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein: Figure 1 A flowchart illustrating an intelligent detection method for the correlation features of electricity theft behavior based on graph neural networks according to an embodiment of the present invention is shown. Figure 2 A detailed flowchart illustrating the prediction of the relative detection gain coefficient according to an embodiment of the present invention is shown. Figure 3 A detailed flowchart illustrating the process of determining whether the advanced control command for the graph neural network is qualified based on the detection gain deviation value, according to an embodiment of the present invention, is provided. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0017] Figure 1 A flowchart of an intelligent detection method for electricity theft behavior association features based on graph neural networks according to an embodiment of the present invention is shown. The method includes: S101, based on the high-frequency acquisition channel, the instantaneous power consumption characteristics of several energy meters in the target power supply area are obtained to obtain the node state sequence; based on the low-frequency acquisition channel, the spatial topology parameters between the energy meters are obtained to obtain the topology association sequence.

[0018] S102, based on the node state sequence, determine several predicted behavioral features within a future preset monitoring period to determine local anomaly characterization values; based on the topological association sequence, determine several key connection features within the target monitoring period to determine global distortion characterization values.

[0019] S103, determine whether to generate an electricity theft risk verification signal based on the local anomaly characterization value and the global distortion characterization value; if so, obtain several continuous evolution features based on the topological association sequence to determine the topological stability value.

[0020] S104, if the topological stability value is less than the preset stability value, then the topological offset index is determined based on the global distortion characterization value, and the graph structure is reconstructed for each of the continuous evolution features to generate target electricity theft behavior association features; if the topological stability value is greater than or equal to the preset stability value, then the target electricity theft behavior association features are directly generated based on each of the continuous evolution features.

[0021] S105, extract the spatial distribution features of the target electricity theft behavior related features, obtain the feature aggregation evaluation index, so as to determine whether the high-level control instruction for the graph neural network is an incremental optimization instruction or a reconstruction training instruction, and predict the relative detection gain coefficient.

[0022] S106, after the advanced control instruction has completed a full control cycle, determine whether the advanced control instruction for the graph neural network is qualified based on the detected gain deviation value.

[0023] In some embodiments, determining several predicted behavioral features within a future preset monitoring period based on the node state sequence includes: dividing the node state sequence into several behavioral sub-sequences, and determining key behavioral sub-sequences based on the data fluctuation characteristics corresponding to each behavioral sub-sequence; inputting the key behavioral sub-sequences into a target prediction model to obtain several predicted behavioral features within the future preset monitoring period output by the target prediction model; wherein the behavioral sub-sequences are divided into equal-length segments using a sliding time window method, the key behavioral sub-sequences are behavioral sub-sequences whose data fluctuation amplitude exceeds a preset statistical threshold, and the target prediction model is a time-series prediction model based on a Long Short-Term Memory (LSTM) network. According to embodiments of the present invention, by dividing behavioral sub-sequences and filtering key sub-sequences, invalid data is eliminated, improving the relevance of the predicted data; by inputting key sub-sequences into the prediction model, future electricity consumption behavior is predicted, improving the accuracy of the calculation basis for local anomaly characterization values; and by focusing on key data, prediction efficiency is improved, increasing the overall response speed of the detection process.

[0024] For example, a target power supply area contains 100 residential electricity meters. A high-frequency acquisition channel collects instantaneous power, voltage, and current data from each meter at a frequency of 10 seconds per acquisition, forming a node state sequence. The sequence length for each meter is 24 hours × 360 acquisitions / hour = 8640 data points. A sliding time window method is used to divide the sequence into sub-sequences. The window length is set to 10 minutes (60 data points), and the sliding step size is set to 5 minutes, dividing the node state sequence of each meter into 288 equal-length sub-sequences. A preset statistical threshold is set to 5% (i.e., the ratio of the standard deviation to the mean of the data within a sub-sequence exceeds 5% is considered a fluctuation). (Excessive fluctuation amplitude) The behavioral subsequences with fluctuation amplitudes exceeding 5% in each energy meter were selected as key behavioral subsequences, with an average of 32 key behavioral subsequences selected per energy meter; the input dimension of the target LSTM prediction model is 60 (window length) × 3 (three features: instantaneous power, voltage, and current), the hidden layer dimension is set to 128, and the output layer dimension is 48 (corresponding to a future preset monitoring period of 2 hours, with 1 prediction value every 5 minutes). The key behavioral subsequences are input into the LSTM model, and the instantaneous power, voltage, and current prediction values ​​are output every 5 minutes in the next 2 hours, thus obtaining 48 predicted behavioral features for each energy meter.

[0025] In some embodiments, determining the local anomaly characterization value includes: performing behavioral trajectory analysis on each of the predicted behavioral features to obtain a corresponding predicted behavioral profile; determining the local anomaly characterization value based on the comparison result between the predicted behavioral profile and a preset normal behavioral profile; wherein, the behavioral trajectory analysis includes multi-dimensional analysis of electricity consumption change trends, peak-valley electricity consumption ratio, and electricity consumption time distribution; the predicted behavioral profile is a normalized multi-dimensional feature vector containing the above dimensions; the comparison result is the cosine similarity between the predicted behavioral profile and the preset normal behavioral profile; and the local anomaly characterization value is negatively correlated with the cosine similarity. According to embodiments of the present invention, by performing trajectory analysis on the predicted behavioral features, a concrete representation of electricity consumption behavior is achieved, improving the accuracy of anomaly feature identification; by comparing with a preset normal profile, a quantitative assessment of the degree of anomaly is achieved, improving the reliability of the local anomaly characterization value; and by accurately characterizing behavioral differences, rapid capture of local anomalies in the early stages of electricity theft is achieved, improving the timeliness of detection.

[0026] For example, for the 48 predicted behavioral features of each electricity meter, a multi-dimensional behavioral trajectory analysis is performed: the slope of the power consumption change trend is calculated using linear fitting; the peak-valley electricity consumption ratio is calculated as the ratio of the total electricity consumption during peak hours (8:00-11:00, 18:00-22:00) to the total electricity consumption during the predicted period; and the electricity consumption distribution is calculated using entropy, resulting in three-dimensional feature data. These three features are then normalized to form a three-dimensional predicted behavioral profile (e.g., the predicted behavioral profile of a certain electricity meter is [0.32, 0.65, 0.48]). The preset normal behavioral profile is based on historical data from 80 electricity meters in the area with no electricity theft records in the past three months, and is uniformly set to [0.28, 0.58, 0.42]. The cosine similarity between the two is calculated to be 0.972. The formula for calculating the local anomaly representation value is set as 1 - cosine similarity, therefore the local anomaly representation value of this electricity meter is 1 - 0.972 = 0.028; If a certain electricity meter has a tendency to steal electricity, its predicted behavioral profile is [0.75, 0.21, 0.83], and its cosine similarity with the preset normal behavioral profile is 0.615, with a corresponding local anomaly representation value of 0.385.

[0027] In some embodiments, determining several key connectivity features within a target monitoring period based on the topological association sequence includes: dividing the target monitoring period into several time segments, and performing graph analysis on each of the topological association sequences within each time segment to obtain time-series graph features corresponding to each time segment; determining several key time segments based on the comparison results of the time-series graph features corresponding to each time segment, and determining several key connectivity features based on the spatial topological parameters within each key time segment; wherein, the time segments are continuous time intervals of equal length, the graph analysis uses a graph embedding method to map the spatial topological parameters into low-dimensional dense vectors to obtain the time-series graph features, the key time segments are time segments where the Euclidean distance between the time-series graph features and the reference time-series graph features exceeds a preset threshold, and the key connectivity features are the features of inter-meter connection edges where connection weights change abruptly within the key time segments. According to embodiments of the present invention, by dividing time segments and analyzing time series graph features, the temporal decomposition of topological associations is realized, thereby improving the positioning accuracy of key time periods; by comparing time series graph features to screen key segments, invalid time periods are eliminated, thereby improving the extraction efficiency of key connection features; by focusing on the topological parameters of key segments, global association features are captured, thereby improving the calculation quality of global distortion characterization values.

[0028] For example, the target monitoring period is set to 24 hours, which is divided into 24 equal-length segments. The low-frequency acquisition channel collects the spatial topology parameters (including the line distance between adjacent meters, line resistance, and connection stability) of each electricity meter at a frequency of 1 hour / time, forming a topology association sequence (1 set per hour, for a total of 24 sets, each set containing parameters of 4950 connection edges between 100 electricity meters). The Node2Vec graph embedding method is used to map each set of topology association sequences into a low-dimensional dense vector of dimension 64, thus obtaining the time series map features corresponding to the 24 time segments. The baseline time series map features are obtained by embedding the average topology association sequence of the area with no electricity theft records in the past 7 days, with the preset Euclidean distance threshold set to 0. 8. Calculate the Euclidean distance between the time series graph features of each time segment and the baseline time series graph features, and select three time segments with an Euclidean distance exceeding 0.8 (10:00-11:00, 19:00-20:00, and 23:00-24:00, respectively) as key time segments; analyze the spatial topology parameters within each key time segment, set the connection weight mutation threshold to 20% (i.e., the difference between the weight of the connection edge and the average weight of the edge in the same period of the past 7 days exceeds 20%), and select the connection edges that have undergone weight mutations within each key time segment, resulting in 12 key connection features. Each key connection feature includes four parameters: the electricity meter numbers at both ends of the connection edge, the line distance, the resistance value after the mutation, and the magnitude of the weight mutation.

[0029] In some embodiments, determining the global distortion characterization value includes: performing correlation extraction on each of the key connectivity features to obtain corresponding key topological features; determining the global distortion characterization value based on the comparison result between the key topological features and preset normal topological features; wherein, the correlation extraction uses a graph attention mechanism to adaptively weight and aggregate each key connectivity feature, the key topological features include node degree distribution, clustering coefficient, and average path length, and the global distortion characterization value is the mean square error between the key topological features and the preset normal topological features. According to embodiments of the present invention, by extracting the correlation of key connectivity features, the focus of core topological features is achieved, improving the targeting of global anomaly identification; by comparing with preset normal topological features, the degree of global distortion is quantified, improving the scientific nature of the global distortion characterization value; by capturing topological distortion differences, the overall investigation of potential electricity theft within the region is achieved, improving the comprehensiveness of detection.

[0030] For example, for the 12 key connectivity features mentioned above, a graph attention mechanism is used for correlation extraction. The initial value of the attention weight is set to 0.5. After optimization using the gradient descent method, adaptive weights for each key connectivity feature are obtained. After normalization of the weights, aggregation is completed. The key topological features extracted after aggregation are: node degree distribution (the number of connection edges for each electricity meter is counted, resulting in 100 node degree data with an average value of 2.4), clustering coefficient (measuring the tightness of the electricity meter connections, the overall clustering coefficient is calculated to be 0.38), and average path length (the average number of connection steps between any two electricity meters, calculated to be 3.2 steps). The preset normal topological features are obtained based on the topological data of the area with no electricity theft records in the past 3 months, with an average node degree distribution of 2.1, a clustering coefficient of 0.42, and an average path length of 3.0 steps. The global distortion characterization value is calculated using the mean square error, with the formula "[(2.4-2.1)² + (0.38-0.42)² + The global distortion characterization value was calculated to be 0.0187 using (3.2-3.0)² / 3”.

[0031] In some embodiments, determining whether to generate an electricity theft risk verification signal based on the local anomaly characterization value and the global distortion characterization value includes: determining a comprehensive risk comparison value based on the local anomaly characterization value and the global distortion characterization value; if the comprehensive risk comparison value is greater than a preset comparison value, then determining to generate the electricity theft risk verification signal; wherein, the comprehensive risk comparison value is a weighted sum of the local anomaly characterization value and the global distortion characterization value, and the weighting coefficient is preset according to the contribution of local anomalies and global distortions to electricity theft in historical electricity theft cases. According to embodiments of the present invention, by fusing local and global characterization values ​​to calculate a comprehensive risk value, a comprehensive assessment of electricity theft risk is achieved, improving the accuracy of risk judgment; by setting a preset comparison value as a judgment standard, a clear definition of risk levels is achieved, improving the standardization of verification signal generation; by triggering verification signals, invalid verifications are reduced, improving the efficiency and targeting of electricity theft investigation.

[0032] For example, based on statistics of 120 electricity theft cases in the region over the past 5 years, local anomalies contribute 60% to electricity theft, while global distortion contributes 40%. Therefore, the weighting coefficient for local anomaly representation values ​​is set to 0.6, and the weighting coefficient for global distortion representation values ​​is set to 0.4. The formula for calculating the comprehensive risk comparison value is "local anomaly representation value × 0.6 + global distortion representation value × 0.4". For the electricity meter, the local anomaly representation value is 0.385, and the global distortion representation value is 0.0187. The calculated comprehensive risk comparison value is 0.385 × 0.6 + 0.0187 × 0.4 = 0.231 + 0.0075 = 0.2385; The preset comparison value is set based on the comprehensive risk comparison value statistics of historical electricity theft cases, and the 95th percentile is 0.20. Since 0.2385 > 0.20, it is determined that an electricity theft risk verification signal is generated. If the local abnormality characterization value of a normal electricity meter is 0.028 and the global distortion characterization value is 0.0187, the comprehensive risk comparison value is 0.028×0.6 + 0.0187×0.4 = 0.0168 + 0.0075 = 0.0243 < 0.20, and no electricity theft risk verification signal is generated.

[0033] In some embodiments, Figure 2This document illustrates a detailed flowchart of a method for predicting the relative detection gain coefficient using a graph neural network-based intelligent detection method for electricity theft behavior associated with electricity meters, according to an embodiment of the present invention. The method includes: acquiring the node cluster density and connectivity of the connected graph in the spatial distribution features; calculating the weighted product of the node cluster density and the connectivity of the connected graph to obtain the feature aggregation evaluation index; if the feature aggregation evaluation index ≤ a first preset evaluation index, determining to execute the reconstruction training instruction and predicting a first relative detection gain coefficient as the relative detection gain coefficient; if the feature aggregation evaluation index > the first preset evaluation index and ≤ a second preset evaluation index, determining to execute the incremental optimization instruction and predicting a second phase... The detection gain coefficient is used as the relative detection gain coefficient; wherein, the first preset evaluation index is less than the second preset evaluation index, and the first relative detection gain coefficient is greater than the second relative detection gain coefficient; the node cluster density is the density of the local subgraph formed by abnormal nodes in the target electricity theft behavior associated features, the connectivity rate of the connected graph is the ratio of the number of connected subgraphs formed by abnormal nodes to the total number of abnormal nodes, and the weighting coefficient is optimized on the labeled validation set by the grid search method; the incremental optimization instruction is to update only the output layer and graph attention layer parameters of the graph neural network, and the reconstruction training instruction is to reinitialize all parameters of the graph neural network and perform full training based on the full historical data. According to the embodiments of the present invention, by extracting node cluster density and connectivity rate, the feature aggregation state is quantified, improving the reliability of the evaluation index; by calculating the evaluation index by weighted product, the fusion of multi-dimensional features is realized, improving the scientific nature of the determination of the control instruction; by matching the control instruction by interval and predicting the gain coefficient, the accurate adaptation of the model control is realized, improving the optimization effect of detection performance.

[0034] For example, in a scenario where a signal for verifying the risk of electricity theft is generated, the spatial distribution features associated with the target electricity theft behavior are extracted: there are 8 abnormal nodes, forming a local subgraph containing 8 nodes and 12 connecting edges. The local subgraph density is calculated using the formula "2 × number of connecting edges / (number of nodes × (number of nodes - 1))", resulting in a node cluster density of 2 × 12 / (8 × 7) = 24 / 56 ≈ 0.4286. The number of connected subgraphs formed by the abnormal nodes is 2 (6 nodes form one connected subgraph, and 2 nodes form another). The connectivity rate is calculated using the formula "number of connected subgraphs / total number of abnormal nodes", resulting in a connectivity rate of 2 / 8 = 0.25. Through grid search optimization on a validation set containing 5000 labeled data sets, the weighting coefficient for node cluster density is 0.7, the weighting coefficient for connected graph connectivity rate is 0.3, and the feature aggregation evaluation index = 0.4286 × 0.7 + 0.25 × 0.3 = 0.2999 + 0.075 = 0.3749; The first preset evaluation index is set to 0.3 and the second preset evaluation index is set to 0.5. Since 0.3 < 0.3749 ≤ 0.5, the incremental optimization command is executed; Based on the statistics of historical control data, the second relative detection gain coefficient corresponding to the incremental optimization command is predicted to be 8.5% (that is, the detection accuracy is improved by 8.5% after control).

[0035] In some embodiments, Figure 3This document illustrates a detailed flowchart of an intelligent detection method for electricity theft behavior associated with graph neural networks, based on an embodiment of the present invention. The method determines the validity of a high-level control instruction for the graph neural network based on a detection gain deviation value. The process includes: acquiring a pre-control feature aggregation evaluation index and a post-control feature aggregation evaluation index; calculating the difference between the post-control feature aggregation evaluation index and the pre-control feature aggregation evaluation index to obtain an evaluation index difference; calculating the ratio of the evaluation index difference to the pre-control feature aggregation evaluation index to obtain an actual relative detection gain coefficient; calculating the difference between the actual relative detection gain coefficient and the relative detection gain coefficient to obtain a detection gain deviation value; if the detection gain deviation value > a preset deviation value, the high-level control instruction is deemed invalid; if the detection gain deviation value ≤ the preset deviation value, the high-level control instruction is deemed valid; wherein the pre-control feature aggregation evaluation index is the average feature aggregation evaluation index of all samples within the last complete detection cycle before the execution of the high-level control instruction, and the post-control feature aggregation evaluation index is the average feature aggregation evaluation index of all detection cycles within a complete control cycle. According to embodiments of the present invention, by comparing evaluation indices before and after regulation, the regulation effect can be intuitively quantified, improving the accuracy of command qualification judgment; by calculating the deviation between the actual gain coefficient and the predicted value, the regulation precision can be evaluated, improving the pertinence of command optimization; by setting a preset deviation value as a judgment standard, the qualification and non-qualification can be clearly defined, improving the standardization and reliability of model regulation.

[0036] For example, in a scenario where incremental optimization commands are executed, the complete control cycle of the advanced control command is set to 24 hours (including 6 detection cycles, each detection cycle being 4 hours). The feature aggregation evaluation index before control is the average feature aggregation evaluation index of all 100 energy meter samples within the last detection cycle (4 hours) before executing the incremental optimization command, calculated to be 0.3749. The feature aggregation evaluation index after control is the average feature aggregation evaluation index of the 6 detection cycles within the 24-hour control cycle, calculated to be 0.4056. The evaluation index difference = 0.4056 - 0.3749 = 0.0307. The actual relative detection gain coefficient = 0.0307 / 0.3749 ≈ 8.19%. For the predicted second relative detection gain coefficient, which is 8.5%, the detection gain deviation value = |8.19% - 8.5%|=0.31%; The preset deviation value is set to 1.0% based on historical control data. Since 0.31%≤1.0%, the incremental optimization instruction is deemed qualified; If the actual relative detection gain coefficient in a certain scenario is 7.2%, and the detection gain deviation value =|7.2% - 8.5%|=1.3%>1.0%, then the advanced control instruction is deemed unqualified.

[0037] In some embodiments, the method further includes: if the advanced control instruction is unqualified, monitoring the convergence process of the loss function of the graph neural network in real time, and determining whether to perform parameter rollback or structure search optimization on the advanced control instruction based on the convergence change coefficient; wherein, determining whether to perform parameter rollback or structure search optimization on the advanced control instruction based on the convergence change coefficient includes: setting a statistical window containing a period of time containing a number of consecutive advanced control instructions; obtaining the feature aggregation evaluation index at the beginning of the statistical window as the initial evaluation index; obtaining the feature aggregation evaluation index at the current time as the current evaluation index; calculating the ratio of the difference between the current evaluation index and the initial evaluation index to the initial evaluation index to obtain the convergence change coefficient; if the convergence change coefficient is ≤ a first preset change coefficient, then determining to perform parameter rollback; If the convergence change coefficient is greater than the first preset change coefficient and less than or equal to the second preset change coefficient, then fine-tuning and rollback combined with parameter optimization are performed; if the convergence change coefficient is greater than the second preset change coefficient, then structure search optimization is performed; wherein, the first preset change coefficient is less than the second preset change coefficient; the loss function convergence process monitoring includes changes in the loss function's descent rate, gradient norm, and validation set electricity theft detection accuracy; the parameter rollback is a rollback to the optimal model parameter version before the execution of this advanced control instruction; the fine-tuning and rollback combined with parameter optimization is a rollback to the parameter version with the highest validation set accuracy within this control cycle, and on this basis, parameter fine-tuning is performed using a small learning rate; the structure search optimization uses a neural architecture search method to automatically search and optimize the number of graph convolutional layers, the number of attention heads, and the hidden layer dimension of the graph neural network. According to the embodiments of the present invention, by monitoring the convergence process of the loss function, the cause of the control anomaly can be located, improving the targeting of the instruction adjustment; by calculating the convergence change coefficient, the model convergence state can be quantitatively evaluated, improving the scientific nature of the adjustment method selection; by using a segmented matching adjustment strategy, the model performance can be quickly restored, improving the stability and reliability of the detection method.

[0038] For example, in scenarios where the aforementioned advanced control commands are not met, the convergence process of the graph neural network's loss function is monitored in real time. Monitoring indicators include: loss function descent rate, gradient norm, and validation set accuracy for detecting electricity theft. The statistical window is set to include a period of three consecutive advanced control commands (each control cycle is 24 hours, for a total statistical window of 72 hours). The feature aggregation evaluation index (initial evaluation index) at the start of the statistical window is 0.3749, and the feature aggregation evaluation index (current evaluation index) at the current time (end of the statistical window) is 0.3215. The convergence change coefficient = (0.3215) -0.3749) / 0.3749≈-0.1424 (the negative sign indicates a decrease in the evaluation index); the first preset change coefficient is set to -0.2 (evaluation index decrease exceeds 20%), and the second preset change coefficient is set to -0.1 (evaluation index decrease is between 10% and 20%); since -0.2 < -0.1424 ≤ -0.1, it is determined that fine-tuning and rollback combined with parameter optimization will be performed; rollback to the parameter version with the highest accuracy on the validation set during this adjustment cycle, and fine-tune the parameters using a small learning rate (0.0001), with 10 iterations for fine-tuning. The process involves 0 iterations with a batch size of 32 for each iteration. If the convergence coefficient is -0.25 ≤ -0.2 in a certain scenario, parameter rollback is performed to revert to the optimal model parameter version before the current advanced control command was executed. If the convergence coefficient is -0.08 > -0.1, structural search optimization is performed using a neural architecture search method. The search range is set to 2-4 graph convolutional layers, 4-8 attention heads, and 64-256 hidden layer dimensions. The number of search iterations is 50, and the optimal structure is finally determined to be 3 graph convolutional layers, 6 attention heads, and 128 hidden layer dimensions.

[0039] It should be understood that the various processes described above can be used to rearrange, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0040] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for intelligent detection of electricity theft behavior association features based on graph neural networks, characterized in that, include: The instantaneous power consumption characteristics of several energy meters within the target power supply area are obtained based on the high-frequency acquisition channel, and the node state sequence is obtained. The spatial topology parameters between the energy meters are obtained based on the low-frequency acquisition channel to obtain the topology association sequence. Based on the node state sequence, several predicted behavioral characteristics are determined for a future preset monitoring period in order to determine local anomaly characterization values. Based on the topological association sequence, several key connectivity features within the target monitoring period are determined to determine the global distortion characterization value; Based on the local anomaly characterization value and the global distortion characterization value, it is determined whether to generate an electricity theft risk verification signal; if so, several continuous evolution features are obtained based on the topological association sequence to determine the topological stability value. If the topological stability value is less than the preset stability value, then the topological offset index is determined based on the global distortion characterization value, and the graph structure is reconstructed for each of the continuous evolution features to generate target electricity theft behavior association features; if the topological stability value is greater than or equal to the preset stability value, then the target electricity theft behavior association features are directly generated based on each of the continuous evolution features. Extract the spatial distribution features of the target electricity theft behavior association features, obtain the feature aggregation evaluation index, so as to determine whether the high-level control instructions for the graph neural network are incremental optimization instructions or reconstruction training instructions, and predict the relative detection gain coefficient; After the advanced control instruction has been executed for a complete control cycle, the validity of the advanced control instruction for the graph neural network is determined based on the detected gain deviation value.

2. The intelligent detection method for electricity theft behavior association features based on graph neural networks according to claim 1, characterized in that, The determination of several predicted behavioral characteristics within a preset monitoring period based on the node state sequence includes: The node state sequence is divided into several behavioral sub-sequences, and key behavioral sub-sequences are determined based on the data fluctuation characteristics corresponding to each behavioral sub-sequence. The key behavioral subsequences are input into the target prediction model to obtain several predicted behavioral features within a future preset monitoring period output by the target prediction model.

3. The intelligent detection method for electricity theft behavior association features based on graph neural networks according to claim 2, characterized in that, The determination of local anomaly representation values ​​includes: Behavioral trajectory analysis is performed on each of the predicted behavioral features to obtain the corresponding predicted behavioral profile; The local anomaly representation value is determined based on the comparison results between the predicted behavior profile and the preset normal behavior profile.

4. The intelligent detection method for electricity theft behavior association features based on graph neural networks according to claim 3, characterized in that, The determination of several key connectivity features within the target monitoring period based on the topological association sequence includes: The target monitoring period is divided into several time segments, and the topological association sequences within each time segment are subjected to graph analysis to obtain the time series graph features corresponding to each time segment. Based on the comparison results of the temporal graph features corresponding to each time segment, several key time segments are determined, and based on the spatial topology parameters within each key time segment, several key connectivity features are determined.

5. The intelligent detection method for electricity theft behavior association features based on graph neural networks according to claim 4, characterized in that, The determination of the global distortion characterization value includes: Correlation extraction is performed on each of the key connectivity features to obtain the corresponding key topological features; The global distortion characterization value is determined based on the comparison results between the key topological features and the preset normal topological features.

6. The intelligent detection method for electricity theft behavior association features based on graph neural networks according to claim 5, characterized in that, Determining whether to generate an electricity theft risk verification signal based on the local anomaly characterization value and the global distortion characterization value includes: A comprehensive risk comparison value is determined based on the local anomaly characterization value and the global distortion characterization value. If the comprehensive risk comparison value is greater than the preset comparison value, then the electricity theft risk verification signal is generated.

7. The intelligent detection method for electricity theft behavior association features based on graph neural networks according to claim 6, characterized in that, Obtaining a feature aggregation evaluation index to determine whether the high-level control instructions for the graph neural network are incremental optimization instructions or reconstructive training instructions, and predicting the relative detection gain coefficient, including: Obtain the node cluster density and connectivity of the connected graph in the spatial distribution features; The feature aggregation evaluation index is obtained by calculating the weighted product of the node cluster density and the connectivity of the connected graph; If the feature aggregation evaluation index is less than or equal to the first preset evaluation index, the reconstruction training instruction is executed, and the first relative detection gain coefficient is predicted as the relative detection gain coefficient. If the feature aggregation evaluation index is greater than the first preset evaluation index and less than or equal to the second preset evaluation index, the incremental optimization instruction is executed, and the second relative detection gain coefficient is predicted as the relative detection gain coefficient. Wherein, the first preset evaluation index is less than the second preset evaluation index, and the first relative detection gain coefficient is greater than the second relative detection gain coefficient.

8. The intelligent detection method for electricity theft behavior association features based on graph neural networks according to claim 7, characterized in that, The step of determining whether the high-level control instructions for the graph neural network are qualified based on the detected gain deviation value includes: Obtain the pre-regulation characteristic aggregation evaluation index and the post-regulation characteristic aggregation evaluation index; The difference between the post-regulation feature aggregation evaluation index and the pre-regulation feature aggregation evaluation index is calculated to obtain the evaluation index difference. The actual relative detection gain coefficient is obtained by calculating the ratio of the difference in the evaluation index to the pre-regulation feature aggregation evaluation index. The difference between the actual relative detection gain coefficient and the relative detection gain coefficient is used to obtain the detection gain deviation value; If the detected gain deviation value is greater than the preset deviation value, the advanced control command is deemed unqualified. If the detected gain deviation value is less than or equal to the preset deviation value, then the advanced control command is deemed qualified.

9. The intelligent detection method for electricity theft behavior association features based on graph neural networks according to claim 8, characterized in that, The method further includes: If the advanced control command is not qualified, the convergence process of the loss function of the graph neural network is monitored in real time, and the parameter rollback or structural search optimization is performed on the advanced control command based on the convergence change coefficient. The process of determining whether to perform parameter rollback or structural search optimization on the advanced control command based on the convergence change coefficient includes: Set a statistical window that includes a period of time containing a series of the aforementioned advanced control commands; The feature aggregation evaluation index obtained at the start time of the statistical window is denoted as the initial evaluation index; The feature aggregation evaluation index at the current moment is obtained and recorded as the current evaluation index; The convergence change coefficient is obtained by calculating the ratio of the difference between the current evaluation index and the initial evaluation index to the initial evaluation index. If the convergence change coefficient is less than or equal to the first preset change coefficient, then it is determined that the parameter rollback will be performed. If the convergence change coefficient is greater than the first preset change coefficient and less than or equal to the second preset change coefficient, then it is determined that fine-tuning and rollback combined with parameter optimization will be performed. If the convergence change coefficient is greater than the second preset change coefficient, then the structure search optimization is performed; wherein the first preset change coefficient is less than the second preset change coefficient.

Images