Abnormal power utilization behavior monitoring and early warning method, device and equipment triggered based on abnormal alarm event cluster, and medium

Abstract

The application discloses an abnormal power utilization behavior monitoring and early warning method and device triggered based on an abnormal alarm event cluster, equipment and a medium, relates to the field of power system anomaly monitoring, and comprises the following steps: classifying user load scenes based on power supply user data and extracting target monitoring users to construct a dynamic variable frequency measurement architecture; collecting user power measurement data and operation alarm event data in a normal collection mode; analyzing alarm events based on operation alarm event data, a preset time window and a spatial and temporal correlation of a distribution network topology; if the abnormal alarm event cluster obtained through analysis meets the conditions, sending a high-frequency collection trigger instruction to the dynamic variable frequency measurement architecture, switching to a high-frequency collection mode to collect data and construct a behavior monitoring model, obtaining online monitoring and early warning results by using the behavior monitoring model and the dynamic variable frequency measurement architecture to execute target services, and updating the behavior monitoring model according to service execution results. The application can improve the real-time performance, accuracy and applicability of intelligent power system monitoring and early warning.

Description

Technical Field

[0001] This invention relates to the field of power system anomaly monitoring, and in particular to a method, device, equipment, and medium for monitoring and early warning of abnormal electricity consumption behavior based on anomaly alarm event clusters. Background Technology

[0002] With the rapid development of smart grids and the high proportion of new energy integration, the power system faces a severe challenge in monitoring abnormal electricity consumption behavior. Traditional abnormal electricity consumption monitoring methods are no longer adequate to meet the requirements of smart power systems.

[0003] However, existing monitoring technologies for detecting abnormal electricity consumption based on line loss data suffer from poor early warning performance and timeliness. This is mainly because traditional data acquisition frequencies are low, making it impossible to capture subtle changes in abnormal electricity consumption behavior; at the same time, the monitoring methods do not have in-depth research on the timing mechanisms of abnormal electricity consumption data fluctuations and metering failure mechanisms, resulting in limited early warning accuracy.

[0004] Currently, commonly used abnormal electricity consumption monitoring solutions mainly fall into two categories: one is rule-based traditional monitoring, which is simple and easy to implement, but has poor adaptability to new abnormal electricity consumption behaviors and a high false alarm rate; the other is machine learning-based monitoring, which improves the accuracy of identification to a certain extent, but does not delve deeply enough into the mining of time-series features and the correlation of abnormal events, making it difficult to achieve accurate early warning.

[0005] Furthermore, most existing abnormal electricity consumption monitoring systems focus on post-event analysis and lack real-time early warning capabilities. They fail to issue timely alerts in the early stages of abnormal behavior, leading to delays in investigation and causing economic losses to power companies. Particularly in notarized scenarios, the lack of effective electronic data extraction and tracing methods affects the efficiency and effectiveness of handling theft disputes. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a method, device, equipment, and medium for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters. This method can solve the problems existing in current related solutions, improve the real-time performance, accuracy, and applicability of abnormal electricity consumption behavior monitoring and early warning for smart power systems, and reduce false alarm and false negative rates. This, in turn, improves the automation, standardization, and pre-investigation capabilities of abnormal electricity consumption management. The specific solution is as follows: Firstly, this application provides a method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters, applied to smart power systems, including: User load scenarios are classified based on power supply user data within the target power supply area, and target monitoring users are extracted for each load scenario to determine the extraction results; wherein, the power supply user data includes basic user information and historical electricity consumption data; Using the extraction results, a dynamic frequency conversion measurement architecture is constructed for the target monitoring user. In normal acquisition mode, user electricity consumption measurement data and operation alarm event data are collected according to the first acquisition cycle. Based on the preset abnormal alarm event cluster identification rules, the operation alarm event data, the preset time window, and the power distribution network topology, spatiotemporal correlation analysis is performed on different devices and different types of alarm events to obtain abnormal alarm event clusters; When the abnormal alarm event cluster meets the preset triggering conditions, a high-frequency acquisition trigger command is sent to the dynamic frequency conversion measurement architecture to switch to the high-frequency acquisition mode and acquire target data according to the second acquisition cycle; the target data is electricity consumption behavior data covering the period before, during and after the abnormal alarm occurs, and the electricity consumption behavior data includes the user's electricity consumption measurement data. Based on the target data, an abnormal electricity consumption behavior monitoring model is constructed. Combined with the dynamic frequency conversion measurement architecture, the electricity consumption behavior of the target monitored users is identified and warned in multiple categories to determine the online monitoring and warning results. The target business is executed using the online monitoring and early warning results, and the abnormal electricity consumption behavior monitoring model is updated based on the corresponding business execution results; the target business includes marketing audit business and non-technical line loss analysis business.

[0007] Optionally, the step of classifying user load scenarios based on power supply user data within the target power supply area, and extracting target monitoring users for each load scenario, includes: Obtain basic user information and historical electricity consumption data of power users within the target power supply area; the basic user information includes user industry category, geographical location, access voltage level, wiring method, type of installed electricity meter, and electricity meter capacity information. Based on the user's basic information and historical electricity consumption data, cluster analysis is performed on the electricity consumption characteristics of the power supply user to obtain load scenario classification results; wherein, the load scenario classification results include residential load scenarios, commercial load scenarios, industrial load scenarios, and new energy access load scenarios; the electricity consumption characteristics include electricity consumption time period distribution characteristics, load fluctuation characteristics, power factor characteristics, harmonic characteristics, and peak period load utilization characteristics. For each load scenario in the load scenario classification results, user groups are divided according to the corresponding historical electricity consumption characteristics to determine the division results; The target monitoring users for each load scenario are determined by using stratified sampling and based on the segmentation results. Generate tag information for the target monitoring user, and use the tag information to mark the target monitoring user; the tag information includes a load scenario tag and a user identification number; For each load scenario in the load scenario classification results, the target transformer area is determined based on the corresponding historical electricity consumption characteristics.

[0008] Optionally, the step of constructing a dynamic frequency conversion measurement architecture for the target monitoring user using the extraction results, and collecting user electricity consumption measurement data and operation alarm event data according to the first collection cycle in normal acquisition mode, includes: A dynamic frequency conversion measurement architecture is obtained by deploying high-frequency acquisition modules on the concentrator or edge gateway side of each target distribution area; the high-frequency acquisition modules are respectively connected to smart energy meters, power distribution equipment monitoring devices and new energy access devices. In normal acquisition mode, user electricity consumption data is acquired based on the high-frequency acquisition module and the first acquisition cycle; the user electricity consumption data includes user voltage, current, active power, reactive power, power factor and harmonic component data; Operational alarm event data is acquired based on the high-frequency acquisition module and target recording information; the target recording information includes smart energy meter event records, concentrator alarm records, distribution automation system switch action records, and new energy inverter operation event records; the operational alarm event data includes event type, occurrence time, device code, and alarm level; Based on the user electricity consumption measurement data, a measurement database at the substation level and the user level is determined, and a basic quality check is performed on the data in the measurement database.

[0009] Optionally, the step of performing spatiotemporal correlation analysis on different devices and different types of alarm events to obtain abnormal alarm event clusters based on preset abnormal alarm event cluster identification rules, the operational alarm event data, preset time windows, and power distribution network topology includes: Based on the degree of abnormal impact of different types of operational alarm events in the operational alarm event data, the basic weight parameters of each type of operational alarm event are determined; Based on the power distribution network topology and equipment spatial relationships, equipment with electrical connections or power supply relationships are grouped into the same associated area; A preset time window is set in each of the associated regions, and cluster analysis is performed on the various types of operational alarm events that occur within the preset time window to determine the abnormal alarm event clusters in each of the associated regions. The comprehensive weight of the abnormal alarm event cluster is determined based on the aforementioned basic weight parameters.

[0010] Optionally, when the abnormal alarm event cluster meets the preset triggering conditions, sending a high-frequency acquisition trigger command to the dynamic frequency conversion measurement architecture to switch to high-frequency acquisition mode and acquire target data according to the second acquisition cycle includes: If any of the aforementioned comprehensive weights is greater than a preset threshold and satisfies a preset abnormal event combination pattern, then the corresponding associated region is determined as the target associated region. Send a high-frequency acquisition trigger command corresponding to the target-associated area to the dynamic frequency conversion measurement architecture to switch to high-frequency acquisition mode; The high-frequency acquisition module collects the user's electricity consumption measurement data based on the second acquisition cycle and the target associated area, and performs data backtracking based on the measurement database to complete the high-frequency sampling operation and obtain the target data. After the high-frequency sampling operation is completed, the high-frequency acquisition module corresponding to the target associated region automatically returns to the normal acquisition mode.

[0011] Optionally, the step of constructing an abnormal electricity consumption behavior monitoring model based on the target data, and combining it with the dynamic frequency conversion measurement architecture to perform multi-category anomaly identification and early warning for the electricity consumption behavior of the target monitored users, includes: A time series feature set is constructed based on the target data; the time series feature set includes short-term load change rate, power factor change trajectory, phase current imbalance, harmonic amplitude change characteristics, and daily power consumption deviation characteristics; An initial monitoring model is obtained by establishing a combination model of a multi-layer neural network model and a statistical discriminant model; the multi-layer neural network model is used to learn the nonlinear time-series characteristics of high-frequency electricity consumption behavior, and the statistical discriminant model is used to constrain the anomaly probability and generate anomaly category probability vectors. Based on the measurement database and the time series feature set, historical abnormal electricity consumption behavior sample data are determined; The abnormal electricity consumption behavior monitoring model is obtained by training the initial monitoring model using the historical abnormal electricity consumption behavior sample data; the historical abnormal electricity consumption behavior sample data includes sample data of different abnormal electricity consumption behavior categories, including suspected electricity theft, abnormal metering device, abnormal wiring, abnormal grid connection of new energy sources, and abnormal load change. During the online inference phase, the abnormal electricity consumption behavior monitoring model and the dynamic frequency conversion measurement architecture are used to perform multi-category anomaly identification and early warning on the electricity consumption behavior of the target monitored user, so as to obtain online inference results; the online inference results include the anomaly probability of different abnormal electricity consumption behavior categories; Based on the online reasoning results and the corresponding target abnormal alarm event clusters, a time-series deduction is performed to determine the time period of the abnormality and the category of the target abnormal electricity consumption behavior. The online monitoring and early warning results are determined based on the time period of the anomaly and the category of the target abnormal electricity consumption behavior.

[0012] Optionally, the step of performing time-series deduction based on the online inference results and the corresponding target abnormal alarm event clusters to determine the time period of the abnormality and the category of the target abnormal electricity consumption behavior includes: Based on the online inference results and the target comprehensive weight of the corresponding target anomaly alarm event cluster, the start and end times and duration of the anomaly occurrence are analyzed to determine the time period of the anomaly occurrence. When the probability of any abnormal electricity consumption behavior category is greater than a preset probability threshold, the current abnormal electricity consumption behavior category is determined as the target abnormal electricity consumption behavior category. Anomaly warning records are determined based on preset anomaly location rules corresponding to the target abnormal electricity consumption behavior category; the anomaly warning records include transformer area identifier, user identifier, abnormal alarm event cluster identifier, suspected abnormal equipment location, and anomaly level.

[0013] Secondly, this application provides a monitoring and early warning device for abnormal electricity consumption behavior triggered by abnormal alarm event clusters, applied to a smart power system, comprising: The user data processing module is used to classify user load scenarios based on power supply user data within the target power supply area, and to extract target monitoring users for each load scenario to determine the extraction results; wherein, the power supply user data includes basic user information and historical electricity consumption data; The data acquisition module is used to construct a dynamic frequency conversion measurement architecture for the target monitoring user using the extraction results. In normal acquisition mode, it collects user electricity consumption measurement data and operation alarm event data according to the first acquisition cycle. The event cluster determination module is used to perform spatiotemporal correlation analysis on different devices and different types of alarm events to obtain abnormal alarm event clusters based on preset abnormal alarm event cluster identification rules, the operation alarm event data, preset time windows and power distribution network topology. The high-frequency data acquisition module is used to send a high-frequency acquisition trigger command to the dynamic frequency conversion measurement architecture when the abnormal alarm event cluster meets the preset trigger conditions, so as to switch to the high-frequency acquisition mode and acquire target data according to the second acquisition cycle; the target data is electricity consumption behavior data covering the abnormal alarm before, during and after the alarm occurs, and the recovery phase, and the electricity consumption behavior data includes the user's electricity consumption measurement data. The online monitoring and early warning module is used to construct an abnormal electricity consumption behavior monitoring model based on the target data, and combine the dynamic frequency conversion measurement architecture to perform multi-category abnormality identification and early warning of the electricity consumption behavior of the target monitored user, so as to determine the online monitoring and early warning results. The model update module is used to execute target business using the online monitoring and early warning results, and update the abnormal electricity consumption behavior monitoring model according to the corresponding business execution results; the target business includes marketing audit business and non-technical line loss analysis business.

[0014] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the aforementioned method for monitoring and warning of abnormal electricity consumption behavior based on abnormal alarm event clusters.

[0015] Fourthly, this application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the steps of the aforementioned method for monitoring and warning of abnormal electricity consumption behavior based on abnormal alarm event clusters.

[0016] As can be seen, this application is applied to a smart power system. User load scenarios are classified based on power supply user data within the target power supply area, and target monitoring users are extracted from each load scenario to determine the extraction results. The power supply user data includes basic user information and historical electricity consumption data. A dynamic frequency conversion measurement architecture for the target monitoring users is constructed using the extraction results. In normal acquisition mode, user electricity consumption measurement data and operational alarm event data are collected according to the first acquisition cycle. Based on preset abnormal alarm event cluster identification rules, the operational alarm event data, preset time windows, and distribution network topology, spatiotemporal correlation analysis is performed on different devices and different types of alarm events to obtain abnormal alarm event clusters. When the abnormal alarm event cluster meets the following conditions... When the preset trigger conditions are met, a high-frequency acquisition trigger command is sent to the dynamic frequency conversion measurement architecture to switch to high-frequency acquisition mode and acquire target data according to the second acquisition cycle. The target data is electricity consumption behavior data covering the period before, during, and after an abnormal alarm occurs, including the user's electricity consumption measurement data. An abnormal electricity consumption behavior monitoring model is constructed based on the target data, and the dynamic frequency conversion measurement architecture is used to identify and warn of multiple types of abnormalities in the electricity consumption behavior of the target monitored user to determine the online monitoring and warning results. The target business is executed using the online monitoring and warning results, and the abnormal electricity consumption behavior monitoring model is updated according to the corresponding business execution results. The target business includes marketing audit business and non-technical line loss analysis business.

[0017] In other words, this application first classifies user load scenarios using power supply user data within the target power supply area, and then extracts target monitoring users for each load scenario. Next, it constructs a dynamic frequency conversion measurement architecture using the extraction results, and collects user electricity consumption measurement data and operational alarm event data according to the first collection cycle in normal acquisition mode. It then uses the operational alarm event data, preset time windows, and distribution network topology to perform spatiotemporal correlation analysis to identify abnormal alarm event clusters. Subsequently, when an abnormal alarm event cluster meets preset trigger conditions, a high-frequency acquisition trigger command is sent to the dynamic frequency conversion measurement architecture to switch to high-frequency acquisition mode and collect target data according to the second collection cycle. Then, based on the target data, an abnormal electricity consumption behavior monitoring model is constructed, and combined with the dynamic frequency conversion measurement architecture, online monitoring and early warning are performed on the target monitoring users. The online monitoring and early warning results are used to execute target services, and the abnormal electricity consumption behavior monitoring model is updated based on the service execution results. This approach can address the problems existing in current solutions, improve the real-time performance, accuracy, and applicability of monitoring and early warning of abnormal electricity consumption behavior in smart power systems, and reduce false alarm and missed alarm rates. This, in turn, enhances the automation, standardization, and pre-evidence collection capabilities of abnormal electricity consumption management. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 A flowchart of a method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters provided in this application; Figure 2 A schematic diagram of a specific method for monitoring and early warning of abnormal electricity consumption behavior based on an abnormal alarm event cluster provided in this application; Figure 3 A schematic diagram of the structure of an abnormal power consumption behavior monitoring and early warning device based on an abnormal alarm event cluster provided in this application; Figure 4 This application provides a structural diagram of an electronic device. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Existing monitoring technologies for detecting abnormal electricity consumption based on line loss data suffer from poor early warning performance and timeliness. This is mainly because traditional data acquisition frequencies are low, making it impossible to capture subtle changes in abnormal electricity consumption behavior. Furthermore, the monitoring methods lack in-depth research into the timing mechanisms of abnormal electricity consumption data fluctuations and metering failure mechanisms, resulting in limited early warning accuracy.

[0022] Currently, commonly used abnormal electricity consumption monitoring solutions mainly fall into two categories: one is rule-based traditional monitoring, which is simple and easy to implement, but has poor adaptability to new abnormal electricity consumption behaviors and a high false alarm rate; the other is machine learning-based monitoring, which improves the accuracy of identification to a certain extent, but does not delve deeply enough into the mining of time-series features and the correlation of abnormal events, making it difficult to achieve accurate early warning.

[0023] Furthermore, most existing abnormal electricity consumption monitoring systems focus on post-event analysis and lack real-time early warning capabilities. They fail to issue timely alerts in the early stages of abnormal behavior, leading to delays in investigation and causing economic losses to power companies. Particularly in notarized scenarios, the lack of effective electronic data extraction and tracing methods affects the efficiency and effectiveness of handling theft disputes.

[0024] To address this, this application provides a monitoring and early warning scheme for abnormal electricity consumption behavior based on abnormal alarm event clusters. This scheme can solve the problems existing in the current related schemes, improve the real-time performance, accuracy and applicability of monitoring and early warning of abnormal electricity consumption behavior for smart power systems, and reduce the false alarm rate and missed alarm rate. In turn, it improves the automation, standardization and evidence collection capabilities of abnormal electricity consumption management.

[0025] See Figure 1 As shown, this invention discloses a method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters, applied to a smart power system, including: Step S11: Classify user load scenarios based on power supply user data within the target power supply area, and extract target monitoring users for each load scenario to determine the extraction results; wherein, the power supply user data includes basic user information and historical electricity consumption data.

[0026] In this embodiment, combined with Figure 2The method described above utilizes relevant data to classify users based on their electricity consumption behavior, and then extracts target users from each category. Specifically, it acquires basic user information and historical electricity consumption data for users within the target power supply area. The basic user information includes user industry category, geographical location, access voltage level, wiring method, type of installed electricity meter, and electricity meter capacity. Based on the basic user information and historical electricity consumption data, cluster analysis is performed on the electricity consumption characteristics of the power supply users to obtain load scenario classification results. These load scenario classification results include residential load scenarios, commercial load scenarios, industrial load scenarios, and renewable energy access load scenarios. The electricity consumption characteristics include electricity consumption... The load scenario classification process considers time-period distribution characteristics, load fluctuation characteristics, power factor characteristics, harmonic characteristics, and peak-period load utilization characteristics. For each load scenario in the classification results, user groups are segmented based on corresponding historical electricity consumption characteristics to determine the segmentation results. A stratified sampling method is used, and target monitoring users for each load scenario are determined based on the segmentation results. Tag information for the target monitoring users is generated and used to mark them. The tag information includes load scenario tags and user identification numbers. For each load scenario in the classification results, target transformer substations are determined based on the corresponding historical electricity consumption characteristics. A transformer substation is an area powered by one or more transformers.

[0027] It's important to understand that the process of classifying user load scenarios and extracting target users described above first involves obtaining basic information about all users within the designated area from the marketing and measurement systems (i.e.,...). Figure 2 User master data) and historical electricity consumption data (i.e. Figure 2 Historical electricity consumption curves are used. Basic information includes industry category (e.g., residential, commercial, industrial), geographical location (e.g., main roads, urban-rural fringe areas, rural areas), access voltage level (220 volts, 380 volts, 10kV, etc.), wiring method (single-phase three-wire system, three-phase four-wire system, etc.), type of electricity meter installed (single-phase, three-phase, multi-function meter, etc.), and capacity information. Then, clustering algorithms (e.g., K-means, hierarchical clustering, etc.) are used to cluster the user's electricity consumption characteristics, including the shape of the daily load curve, weekday / holiday electricity consumption patterns, peak-hour load utilization rate, power factor level, harmonic content, etc., forming multiple load scenarios such as "residential load", "commercial continuous load", "industrial impact load", and "distributed new energy access".

[0028] In each load scenario, areas with historically high line loss, areas with a large number of historical electricity theft investigation records, and areas with centralized access to distributed renewable energy are given priority for labeling. Representative target users and key areas are then extracted from these areas, and a unique identifier is established for each target user. Information such as the area to which the user belongs, the type of load scenario, and historical anomaly records are recorded for subsequent association of high-frequency data and alarm events.

[0029] In addition, it should be pointed out that, Figure 2 The process shown applies to a distribution transformer area in a certain power supply zone of an urban power distribution network. The area includes general industrial and commercial users, residential users, as well as new loads such as distributed photovoltaic and electric vehicle charging facilities.

[0030] Step S12: Construct a dynamic frequency conversion measurement architecture for the target monitoring user using the extraction results, and collect user electricity consumption measurement data and operation alarm event data according to the first collection cycle in normal acquisition mode.

[0031] In this embodiment, a high-frequency intelligent measurement and flexible frequency conversion acquisition architecture (i.e., a dynamic frequency conversion measurement architecture) oriented towards target users will be constructed to collect high-frequency electricity consumption measurement data and operational alarm event data of target users. Specifically, a dynamic frequency conversion measurement architecture is obtained by deploying high-frequency acquisition modules on the concentrator or edge gateway side of each target distribution area. The high-frequency acquisition modules are communicatively connected to smart meters, power distribution equipment monitoring devices, and new energy access devices, respectively. In normal acquisition mode, user electricity consumption measurement data is collected based on the high-frequency acquisition modules and the first acquisition cycle. The user electricity consumption measurement data includes user voltage, current, active power, reactive power, power factor, and harmonic component data. Operational alarm event data is obtained based on the high-frequency acquisition modules and target record information. The target record information includes smart meter event records, concentrator alarm records, power distribution automation system switch action records, and new energy inverter operation event records. The operational alarm event data includes event type, occurrence time, device code, and alarm level. Based on the user electricity consumption measurement data, distribution area-level and user-level measurement databases are determined, and basic quality checks are performed on the data in the measurement databases.

[0032] It is important to understand that in this embodiment, a high-frequency acquisition module is embedded in the concentrator or edge computing terminal on the low-voltage side of each target distribution area. This module communicates with smart meters, smart switchgear components, fault indicators, and new energy inverter monitoring units within the distribution area via RS485 (Recommended Standard 485, a serial communication standard), carrier communication, or Ethernet. In the normal mode (i.e., normal acquisition mode), the high-frequency acquisition module acquires data such as voltage, current, active power, reactive power, power factor, demand, and harmonics every 15 minutes (which can also be adjusted according to actual needs), forming a normal measurement database at the distribution area and user levels, and performing basic quality checks on the data.

[0033] Furthermore, in high-frequency mode (i.e., high-frequency acquisition mode), when an abnormal alarm event cluster trigger signal is received, the high-frequency acquisition module automatically switches the acquisition period to 1 second (which can also be adjusted according to actual needs, but must be shorter than the period in normal acquisition mode), or switches to a higher sampling frequency (such as 5 kHz to 10 kHz) instantaneous measurement mode for waveform analysis scenarios, performing short-term sampling of the current and voltage waveforms of critical circuits. The sampling duration can be set to tens of seconds to several minutes depending on the event cluster type. The normal mode is automatically restored after high-frequency sampling ends.

[0034] To reduce communication pressure, the high-frequency acquisition module extracts features from the sampled waveform locally, calculating features such as short-time load change rate, zero-sequence current, negative-sequence current, harmonic current amplitude, three-phase current imbalance, and power factor mutation. The feature sequence is then sent to the abnormal electricity consumption behavior monitoring and early warning platform (which is a distribution master station or a municipal-level abnormal electricity consumption analysis platform used to implement the scheme proposed in this embodiment) at a granularity of 1 second. The original waveform is only cached locally as needed and uploaded according to instructions when there is a need for evidence collection later.

[0035] Step S13: Based on the preset abnormal alarm event cluster identification rules, the operation alarm event data, the preset time window, and the power distribution network topology, perform spatiotemporal correlation analysis on different devices and different types of alarm events to obtain abnormal alarm event clusters.

[0036] This embodiment also establishes an abnormal alarm event cluster triggering rule, which identifies abnormal alarm event clusters based on time windows and spatial correlation, so that subsequent determination of whether to trigger high-frequency acquisition can be made based on the identified abnormal alarm event clusters. Specifically: based on the degree of abnormal impact of different types of operational alarm events in the operational alarm event data, the basic weight parameters of each type of operational alarm event are determined; based on the power distribution network topology and equipment spatial correlation, equipment with electrical connection or power supply correlation is divided into the same correlation area; a preset time window is set in each correlation area, and cluster analysis is performed on multiple types of operational alarm events occurring within the preset time window to determine the abnormal alarm event clusters of each correlation area; the comprehensive weight of the abnormal alarm event cluster is determined based on the basic weight parameters.

[0037] It is important to understand that, regarding the process of identifying the aforementioned abnormal alarm event clusters, in this embodiment, the alarm event data originates from smart meter event records, concentrator alarms, distribution automation system switch action records, and renewable energy inverter operation events. Each alarm includes fields such as event type, occurrence time, device code, and alarm level. Based on the metering failure mechanism and field experience with abnormal electricity consumption behavior, event types are categorized into metering link events (such as voltage loss, current loss, reverse active power, phase loss, phase sequence error, demand reset, etc.), operating condition events (such as voltage exceeding the upper limit, voltage exceeding the lower limit, current exceeding the upper limit, switch tripping, protection action, etc.), and renewable energy operation events (such as inverter disconnection from the grid, grid connection failure, frequent restarts, etc.). Basic weights are configured for different event types, and correction factors are configured based on information such as the historical line loss level of the distribution area and user importance. Spatial association rules are constructed: the main meter, sub-meters, concentrators, switchgear, and renewable energy access points within the same distribution area are grouped into an associated region; for cases with tie lines or public transformers, multiple distribution areas are merged into an extended associated region.

[0038] Meanwhile, a sliding time window, such as 5 minutes, 15 minutes, or 1 hour, is set in each associated area to perform cluster analysis on various alarms occurring within the window: if metering-related events such as power meter voltage loss, reverse active power, and demand exceeding limits occur simultaneously within a short period of time, accompanied by significant fluctuations in transformer area line loss, it is identified as a "suspected electricity theft event cluster"; if they occur in the upstream and downstream circuits of a certain metering point, and are accompanied by repeated voltage and current loss of the same metering device, it is identified as a "metering device failure event cluster"; if they occur simultaneously with frequent grid disconnection and grid connection failure of new energy inverters, it is identified as a "new energy abnormality event cluster".

[0039] Step S14: When the abnormal alarm event cluster meets the preset triggering conditions, a high-frequency acquisition triggering command is sent to the dynamic frequency conversion measurement architecture to switch to the high-frequency acquisition mode and acquire target data according to the second acquisition cycle; the target data is electricity consumption behavior data covering the period before, during and after the abnormal alarm occurs, and the electricity consumption behavior data includes the user's electricity consumption measurement data.

[0040] In this embodiment, when the overall weight of the identified event cluster exceeds a preset threshold, a trigger command is sent to the corresponding high-frequency acquisition module to initiate high-frequency acquisition. Simultaneously, the event cluster number is written into the tag field of the high-frequency data for subsequent model training and tracing. Specifically: if any of the overall weights exceeds the preset threshold and satisfies a preset abnormal event combination pattern, the corresponding associated region is identified as the target associated region; a high-frequency acquisition trigger command corresponding to the target associated region is sent to the dynamic frequency conversion measurement architecture to switch to high-frequency acquisition mode; based on the second acquisition cycle and the high-frequency acquisition module corresponding to the target associated region, the user's electricity consumption measurement data is collected, and data backtracking is performed based on the measurement database to complete the high-frequency sampling operation and obtain the target data; after completing the high-frequency sampling operation, the high-frequency acquisition module corresponding to the target associated region automatically returns to the normal acquisition mode. In this way, when an abnormal alarm event cluster is triggered, the local measurement frequency of the target user is increased, forming a high-frequency electricity consumption behavior data segment covering the time periods before and after the alarm.

[0041] It's important to understand that upon receiving a trigger command, the high-frequency acquisition module, on the one hand, collects data such as voltage, current, power, and power factor at 1-second granularity starting from the trigger moment, and initiates instantaneous waveform sampling at certain key nodes; on the other hand, it retrospectively stores historical data from a certain period before the trigger (e.g., 2 to 5 minutes) to fully cover the entire process before, during, and after the alarm. The collected high-frequency data segments, after local feature extraction and compression, are archived and uploaded to the abnormal electricity consumption behavior monitoring and early warning platform according to event cluster number, user identifier, and transformer area identifier. The abnormal electricity consumption behavior monitoring and early warning platform performs quality verification on the high-frequency data segments, including time alignment correction, anomaly filtering, and missing segment interpolation, and forms a sample library for model training and online inference.

[0042] Step S15: Construct an abnormal electricity consumption behavior monitoring model based on the target data, and combine it with the dynamic frequency conversion measurement architecture to perform multi-category abnormal identification and early warning of the electricity consumption behavior of the target monitored user, so as to determine the online monitoring and early warning results.

[0043] In this embodiment, based on high-frequency electricity consumption behavior data fragments and historical labeled data collected under high-frequency acquisition mode, an abnormal electricity consumption behavior monitoring and early warning model considering multi-classification and time-series extrapolation is constructed. This model is used to identify and warn of abnormal user electricity consumption behavior. Specifically, a time-series feature set is constructed based on the target data. The time-series feature set includes short-term load change rate, power factor change trajectory, phase current imbalance, harmonic amplitude change characteristics, and daily electricity consumption deviation characteristics. An initial monitoring model is obtained by establishing a combination model of a multi-layer neural network model and a statistical discriminant model. The multi-layer neural network model is used to learn the nonlinear time-series characteristics of high-frequency electricity consumption behavior, and the statistical discriminant model is used to constrain the anomaly probability and generate anomaly category probability vectors. Historical abnormal electricity consumption behavior sample data is determined based on the measurement database and the time-series feature set. The historical abnormal electricity consumption behavior sample data is then used to... A monitoring model for abnormal electricity consumption behavior is trained using common electricity consumption behavior sample data to obtain the model. The historical abnormal electricity consumption behavior sample data includes sample data for different categories of abnormal electricity consumption behavior, such as suspected electricity theft, metering device anomalies, wiring anomalies, new energy grid connection anomalies, and load surge anomalies. In the online inference phase, the abnormal electricity consumption behavior monitoring model and the dynamic frequency conversion measurement architecture are used to perform multi-category anomaly identification and early warning for the electricity consumption behavior of the target monitored user, to obtain online inference results. The online inference results include the anomaly probability for different categories of abnormal electricity consumption behavior. Based on the online inference results and the corresponding target abnormal alarm event clusters, time-series extrapolation is performed to determine the time period of anomaly occurrence and the target abnormal electricity consumption behavior category. The online monitoring and early warning results are determined based on the time period of anomaly occurrence and the target abnormal electricity consumption behavior category. It is understood that the target abnormal alarm event cluster is the abnormal alarm event cluster identified in the online inference phase.

[0044] Furthermore, regarding the determination of the abnormal occurrence time period and target abnormal electricity consumption behavior category in the above process, this embodiment includes: analyzing the start and end time and duration of the abnormal occurrence based on the online inference results and the target comprehensive weight of the corresponding target abnormal alarm event cluster to determine the abnormal occurrence time period; when the abnormal probability of any abnormal electricity consumption behavior category is greater than a preset probability threshold, the current abnormal electricity consumption behavior category is determined as the target abnormal electricity consumption behavior category; an abnormal warning record is determined based on the preset abnormal location rule corresponding to the target abnormal electricity consumption behavior category; the abnormal warning record includes the transformer area identifier, user identifier, abnormal alarm event cluster identifier, suspected abnormal equipment location, and abnormal level.

[0045] It is important to understand that, regarding the construction of the abnormal electricity consumption behavior monitoring and early warning model (i.e., the abnormal electricity consumption behavior monitoring model), in this embodiment, in the sample library, combined with historical audit results, on-site verification records, and metering verification reports, some high-frequency data segments are manually or semi-automatically labeled. The labeling categories include, but are not limited to: suspected electricity theft: such as unauthorized parallel connection of loads, bypassing of the electricity meter, unauthorized wiring modifications, etc.; inaccurate metering devices (i.e., abnormal metering devices): such as incorrect transformer ratio, degraded meter performance, wiring errors, etc.; abnormal wiring: such as abnormal three-phase imbalance, reversed neutral wire connection, non-standard neutral wire grounding, etc.; abnormal grid connection of new energy sources: such as reverse power exceeding the limit, frequent disconnection from the grid, low voltage ride-through failure, etc.; abnormal operating conditions but not electricity theft (i.e., abnormal load change): such as abnormal fluctuations caused by equipment failure and operation and maintenance. Based on the above labeled samples, a temporal feature extraction network containing deep learning structures such as convolutional neural networks and long short-term memory networks is constructed to map multi-dimensional high-frequency feature sequences to a low-dimensional feature space. Then, combined with a statistical discrimination module based on Gaussian mixture model or Markov model, the anomaly probability is constrained to generate the final anomaly category probability vector.

[0046] It should be noted that in the model training process, this embodiment adopts a combination of scenario-specific training and transfer learning: first, the scenario-specific model is trained on typical transformer substations (such as high-loss transformer substations and distributed photovoltaic centralized access transformer substations), and then the model parameters are transferred to general transformer substations and fine-tuned with a small number of samples to improve the generalization ability of the model in different scenarios.

[0047] Step S16: Execute the target business using the online monitoring and early warning results, and update the abnormal electricity consumption behavior monitoring model according to the corresponding business execution results; the target business includes marketing audit business and non-technical line loss analysis business.

[0048] This embodiment utilizes a pre-trained model for online monitoring, targeting users' electricity consumption behavior and identifying and issuing warnings for anomalies. Based on the warning results, it outputs information such as the category of abnormal electricity consumption behavior, the time period of occurrence, and the location of suspected equipment, and links with business systems such as marketing audit and metering operation and maintenance. In other words, during the online operation phase, when the abnormal electricity consumption behavior monitoring and warning platform receives newly triggered high-frequency data segments, it calls the pre-trained monitoring and warning model in real time for inference, outputting the probability of each segment belonging to each anomaly category and the predicted start and end times of the anomaly. When the probability of a certain category exceeds the corresponding threshold, an anomaly warning record is generated. The record includes: transformer area and user identification, anomaly category, anomaly level, event cluster information, anomaly occurrence time period, location of suspected abnormal equipment, and estimated affected electricity range. The warning record is pushed to the marketing audit system via an interface to automatically generate audit work orders; it is also pushed to the metering operation and maintenance system to trigger metering device calibration or equipment inspection tasks; and simultaneously, it is used in the non-technical line loss analysis platform for line loss analysis and governance effect evaluation. After the inspection or on-site verification is completed, the verification results will be sent back to the abnormal electricity consumption behavior monitoring and early warning platform for incremental model learning and adaptive adjustment of the early warning threshold, forming a closed loop.

[0049] In addition, combined Figure 2 As shown, this embodiment may also include a model evaluation and strategy optimization module, which is used to periodically calculate the hit rate, false alarm rate, false alarm rate and average investigation time of different types of anomaly warnings, and to adaptively optimize the monitoring model threshold and event cluster weight configuration to ensure that the warning accuracy and economy are maintained at different stages and in different regions.

[0050] In one specific implementation, in certain rural long feeder areas, alarms caused by operational conditions are relatively frequent due to the long lines and large voltage fluctuations. To reduce the false alarm rate in this scenario, this embodiment can adjust the event cluster weight configuration and high-frequency trigger threshold according to the specific scenario. For example, the basic weight of operational condition events such as voltage exceeding limits can be reduced, while the weight of metering device voltage and current loss can be increased. At the same time, the time sliding window length can be appropriately extended so that high-frequency acquisition is only triggered when metering events and abnormal line loss fluctuations occur simultaneously.

[0051] In one specific implementation, in a park area where distributed photovoltaic power is centrally connected, event cluster rules can be configured separately for new energy-related events such as inverter off-grid, grid connection failure, and reverse power exceeding limits. In addition, feature acquisition items such as inverter point voltage waveform and reverse power fluctuation are added to the high-frequency acquisition, so as to better identify the difference between new energy grid connection anomalies caused by voltage abnormalities and power quality problems and abnormal power deviations caused by electricity theft.

[0052] In summary, this embodiment addresses the technical problems of existing abnormal electricity consumption behavior monitoring methods, such as poor early warning timeliness, low reliability of clues, heavy reliance on high-frequency data acquisition across the entire network, and difficulty in balancing large-scale deployment with cost-effectiveness. It proposes an abnormal electricity consumption behavior monitoring and early warning scheme based on high-frequency data acquisition and abnormal alarm event cluster triggering. This scheme constructs a high-frequency intelligent measurement and flexible frequency conversion acquisition architecture at the distribution transformer substation side, introduces an abnormal alarm event cluster triggering mechanism, and combines the temporal occurrence mechanism of abnormal electricity consumption behavior data anomalies and metering failure mechanisms to build a multi-classified, traceable abnormal electricity consumption behavior monitoring and early warning model. This enables real-time monitoring and hierarchical early warning of various abnormal electricity consumption behaviors, including suspected electricity theft, inaccurate metering devices, wiring abnormalities, and abnormal grid connection of new energy sources. While ensuring early warning accuracy, it significantly reduces communication and computing pressure, and can be applied on a large scale in non-technical line loss management scenarios.

[0053] Therefore, in this embodiment, user load scenarios are first classified using power supply user data within the target power supply area, and target monitoring users are extracted for each load scenario. Then, a dynamic frequency conversion measurement architecture is constructed using the extraction results. In normal acquisition mode, user electricity consumption measurement data and operational alarm event data are collected according to the first acquisition cycle. Spatiotemporal correlation analysis is performed using the operational alarm event data, a preset time window, and the distribution network topology to identify abnormal alarm event clusters. Then, when an abnormal alarm event cluster meets preset trigger conditions, a high-frequency acquisition trigger command is sent to the dynamic frequency conversion measurement architecture to switch to high-frequency acquisition mode and collect target data according to the second acquisition cycle. Finally, an abnormal electricity consumption behavior monitoring model is constructed based on the target data. Combined with the dynamic frequency conversion measurement architecture, online monitoring and early warning are performed on the target monitoring users. Target services are executed using the online monitoring and early warning results, and the abnormal electricity consumption behavior monitoring model is updated based on the service execution results. This approach can address the problems existing in current solutions, improve the real-time performance, accuracy, and applicability of monitoring and early warning of abnormal electricity consumption behavior in smart power systems, and reduce false alarm and missed alarm rates. This, in turn, enhances the automation, standardization, and pre-evidence collection capabilities of abnormal electricity consumption management.

[0054] See Figure 3 As shown in the figure, this application also discloses a monitoring and early warning device for abnormal electricity consumption behavior triggered by abnormal alarm event clusters, which is applied to a smart power system and includes: The user data processing module 11 is used to classify user load scenarios based on power supply user data within the target power supply area, and to extract target monitoring users for each load scenario to determine the extraction results; wherein, the power supply user data includes basic user information and historical electricity consumption data; Data acquisition module 12 is used to construct a dynamic frequency conversion measurement architecture for the target monitoring user using the extraction results, and to collect user electricity consumption measurement data and operation alarm event data according to the first acquisition cycle in normal acquisition mode. The event cluster determination module 13 is used to perform spatiotemporal correlation analysis on different devices and different types of alarm events to obtain abnormal alarm event clusters based on preset abnormal alarm event cluster identification rules, the operation alarm event data, preset time windows and power distribution network topology. The high-frequency acquisition module 14 is used to send a high-frequency acquisition trigger command to the dynamic frequency conversion measurement architecture when the abnormal alarm event cluster meets the preset trigger conditions, so as to switch to the high-frequency acquisition mode and acquire target data according to the second acquisition cycle; the target data is electricity consumption behavior data covering the abnormal alarm before, during and after the alarm occurs, and the recovery phase, and the electricity consumption behavior data includes the user's electricity consumption measurement data. The online monitoring and early warning module 15 is used to construct an abnormal electricity consumption behavior monitoring model based on the target data, and combine the dynamic frequency conversion measurement architecture to perform multi-category abnormal identification and early warning of the electricity consumption behavior of the target monitored user, so as to determine the online monitoring and early warning results. The model update module 16 is used to execute target business using the online monitoring and early warning results, and update the abnormal electricity consumption behavior monitoring model according to the corresponding business execution results; the target business includes marketing audit business and non-technical line loss analysis business.

[0055] For more detailed information on the working process of each of the above modules, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0056] Furthermore, embodiments of this application also disclose an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0057] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the abnormal power consumption behavior monitoring and early warning method based on abnormal alarm event clusters disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be a computer.

[0058] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0059] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0060] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the abnormal power consumption behavior monitoring and early warning method based on abnormal alarm event clusters triggered by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0061] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed method for monitoring and warning of abnormal electricity consumption behavior based on abnormal alarm event clusters. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0062] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0063] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0064] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0065] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0066] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters, characterized in that, Applications in smart power systems include: User load scenarios are classified based on power supply user data within the target power supply area, and target monitoring users are extracted for each load scenario to determine the extraction results; wherein, the power supply user data includes basic user information and historical electricity consumption data; Using the extraction results, a dynamic frequency conversion measurement architecture is constructed for the target monitoring user. In normal acquisition mode, user electricity consumption measurement data and operation alarm event data are collected according to the first acquisition cycle. Based on the preset abnormal alarm event cluster identification rules, the operation alarm event data, the preset time window, and the power distribution network topology, spatiotemporal correlation analysis is performed on different devices and different types of alarm events to obtain abnormal alarm event clusters; When the abnormal alarm event cluster meets the preset triggering conditions, a high-frequency acquisition trigger command is sent to the dynamic frequency conversion measurement architecture to switch to the high-frequency acquisition mode and acquire target data according to the second acquisition cycle; the target data is electricity consumption behavior data covering the period before, during and after the abnormal alarm occurs, and the electricity consumption behavior data includes the user's electricity consumption measurement data. Based on the target data, an abnormal electricity consumption behavior monitoring model is constructed. Combined with the dynamic frequency conversion measurement architecture, the electricity consumption behavior of the target monitored users is identified and warned in multiple categories to determine the online monitoring and warning results. The target business is executed using the online monitoring and early warning results, and the abnormal electricity consumption behavior monitoring model is updated based on the corresponding business execution results; the target business includes marketing audit business and non-technical line loss analysis business.

2. The method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters as described in claim 1, characterized in that, The process of classifying user load scenarios based on power supply user data within the target power supply area, and extracting target monitoring users for each load scenario, includes: Obtain basic user information and historical electricity consumption data of power users within the target power supply area; the basic user information includes user industry category, geographical location, access voltage level, wiring method, type of installed electricity meter, and electricity meter capacity information. Based on the user's basic information and historical electricity consumption data, cluster analysis is performed on the electricity consumption characteristics of the power supply user to obtain load scenario classification results; wherein, the load scenario classification results include residential load scenarios, commercial load scenarios, industrial load scenarios, and new energy access load scenarios; the electricity consumption characteristics include electricity consumption time period distribution characteristics, load fluctuation characteristics, power factor characteristics, harmonic characteristics, and peak period load utilization characteristics. For each load scenario in the load scenario classification results, user groups are divided according to the corresponding historical electricity consumption characteristics to determine the division results; The target monitoring users for each load scenario are determined by using stratified sampling and based on the segmentation results. Generate tag information for the target monitoring user, and use the tag information to mark the target monitoring user; the tag information includes a load scenario tag and a user identification number; For each load scenario in the load scenario classification results, the target transformer area is determined based on the corresponding historical electricity consumption characteristics.

3. The method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters as described in claim 2, characterized in that, The process involves constructing a dynamic frequency conversion measurement architecture for the target monitoring user using the extraction results. In normal acquisition mode, this architecture collects user electricity consumption measurement data and operational alarm event data according to the first acquisition cycle, including: A dynamic frequency conversion measurement architecture is obtained by deploying high-frequency acquisition modules on the concentrator or edge gateway side of each target distribution area; the high-frequency acquisition modules are respectively connected to smart energy meters, power distribution equipment monitoring devices and new energy access devices. In normal acquisition mode, user electricity consumption data is acquired based on the high-frequency acquisition module and the first acquisition cycle; the user electricity consumption data includes user voltage, current, active power, reactive power, power factor and harmonic component data; Operational alarm event data is acquired based on the high-frequency acquisition module and target recording information; the target recording information includes smart energy meter event records, concentrator alarm records, distribution automation system switch action records, and new energy inverter operation event records; the operational alarm event data includes event type, occurrence time, device code, and alarm level; Based on the user electricity consumption measurement data, a measurement database at the substation level and the user level is determined, and a basic quality check is performed on the data in the measurement database.

4. The method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters as described in claim 3, characterized in that, The abnormal alarm event clusters are obtained by performing spatiotemporal correlation analysis on different devices and different types of alarm events based on preset abnormal alarm event cluster identification rules, operational alarm event data, preset time windows, and power distribution network topology, including: Based on the degree of abnormal impact of different types of operational alarm events in the operational alarm event data, the basic weight parameters of each type of operational alarm event are determined; Based on the power distribution network topology and equipment spatial relationships, equipment with electrical connections or power supply relationships are grouped into the same associated area; A preset time window is set in each of the associated regions, and cluster analysis is performed on the various types of operational alarm events that occur within the preset time window to determine the abnormal alarm event clusters in each of the associated regions. The comprehensive weight of the abnormal alarm event cluster is determined based on the aforementioned basic weight parameters.

5. The method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters according to claim 4, characterized in that, When the abnormal alarm event cluster meets the preset triggering conditions, a high-frequency acquisition trigger command is sent to the dynamic frequency conversion measurement architecture to switch to the high-frequency acquisition mode and acquire target data according to the second acquisition cycle, including: If any of the aforementioned comprehensive weights is greater than a preset threshold and satisfies a preset abnormal event combination pattern, then the corresponding associated region is determined as the target associated region. Send a high-frequency acquisition trigger command corresponding to the target-associated area to the dynamic frequency conversion measurement architecture to switch to high-frequency acquisition mode; The high-frequency acquisition module collects the user's electricity consumption measurement data based on the second acquisition cycle and the target associated area, and performs data backtracking based on the measurement database to complete the high-frequency sampling operation and obtain the target data. After the high-frequency sampling operation is completed, the high-frequency acquisition module corresponding to the target associated region automatically returns to the normal acquisition mode.

6. The method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters according to any one of claims 3 to 5, characterized in that, The abnormal electricity consumption behavior monitoring model is constructed based on the target data, and combined with the dynamic frequency conversion measurement architecture, it performs multi-category anomaly identification and early warning for the electricity consumption behavior of the target monitored users, including: A time series feature set is constructed based on the target data; the time series feature set includes short-term load change rate, power factor change trajectory, phase current imbalance, harmonic amplitude change characteristics, and daily power consumption deviation characteristics; An initial monitoring model is obtained by establishing a combination model of a multi-layer neural network model and a statistical discriminant model; the multi-layer neural network model is used to learn the nonlinear time-series characteristics of high-frequency electricity consumption behavior, and the statistical discriminant model is used to constrain the anomaly probability and generate anomaly category probability vectors. Based on the measurement database and the time series feature set, historical abnormal electricity consumption behavior sample data are determined; The abnormal electricity consumption behavior monitoring model is obtained by training the initial monitoring model using the historical abnormal electricity consumption behavior sample data; the historical abnormal electricity consumption behavior sample data includes sample data of different abnormal electricity consumption behavior categories, including suspected electricity theft, abnormal metering device, abnormal wiring, abnormal grid connection of new energy sources, and abnormal load change. During the online inference phase, the abnormal electricity consumption behavior monitoring model and the dynamic frequency conversion measurement architecture are used to perform multi-category anomaly identification and early warning on the electricity consumption behavior of the target monitored user, so as to obtain online inference results; the online inference results include the anomaly probability of different abnormal electricity consumption behavior categories; Based on the online reasoning results and the corresponding target abnormal alarm event clusters, a time-series deduction is performed to determine the time period of the abnormality and the category of the target abnormal electricity consumption behavior. The online monitoring and early warning results are determined based on the time period of the anomaly and the category of the target abnormal electricity consumption behavior.

7. The method for monitoring and early warning of abnormal electricity consumption behavior based on abnormal alarm event clusters as described in claim 6, characterized in that, The time-series deduction based on the online inference results and the corresponding target abnormal alarm event clusters is used to determine the time period of the abnormality and the category of the target abnormal electricity consumption behavior, including: Based on the online inference results and the target comprehensive weight of the corresponding target anomaly alarm event cluster, the start and end times and duration of the anomaly occurrence are analyzed to determine the time period of the anomaly occurrence. When the probability of any abnormal electricity consumption behavior category is greater than a preset probability threshold, the current abnormal electricity consumption behavior category is determined as the target abnormal electricity consumption behavior category. Anomaly warning records are determined based on preset anomaly location rules corresponding to the target abnormal electricity consumption behavior category; the anomaly warning records include transformer area identifier, user identifier, abnormal alarm event cluster identifier, suspected abnormal equipment location, and anomaly level.

8. A monitoring and early warning device for abnormal electricity consumption behavior triggered by abnormal alarm event clusters, characterized in that, Applications in smart power systems include: The user data processing module is used to classify user load scenarios based on power supply user data within the target power supply area, and to extract target monitoring users for each load scenario to determine the extraction results; wherein, the power supply user data includes basic user information and historical electricity consumption data; The data acquisition module is used to construct a dynamic frequency conversion measurement architecture for the target monitoring user using the extraction results. In normal acquisition mode, it collects user electricity consumption measurement data and operation alarm event data according to the first acquisition cycle. The event cluster determination module is used to perform spatiotemporal correlation analysis on different devices and different types of alarm events to obtain abnormal alarm event clusters based on preset abnormal alarm event cluster identification rules, the operation alarm event data, preset time windows and power distribution network topology. The high-frequency data acquisition module is used to send a high-frequency acquisition trigger command to the dynamic frequency conversion measurement architecture when the abnormal alarm event cluster meets the preset trigger conditions, so as to switch to the high-frequency acquisition mode and acquire target data according to the second acquisition cycle; the target data is electricity consumption behavior data covering the abnormal alarm before, during and after the alarm occurs, and the recovery phase, and the electricity consumption behavior data includes the user's electricity consumption measurement data. The online monitoring and early warning module is used to construct an abnormal electricity consumption behavior monitoring model based on the target data, and combine the dynamic frequency conversion measurement architecture to perform multi-category abnormality identification and early warning of the electricity consumption behavior of the target monitored user, so as to determine the online monitoring and early warning results. The model update module is used to execute target business using the online monitoring and early warning results, and update the abnormal electricity consumption behavior monitoring model according to the corresponding business execution results; the target business includes marketing audit business and non-technical line loss analysis business.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor is configured to execute the computer program to implement the abnormal electricity consumption behavior monitoring and early warning method based on abnormal alarm event clusters as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the abnormal power consumption behavior monitoring and early warning method based on abnormal alarm event clusters as described in any one of claims 1 to 7.

Images