A power collection data cooperation method and system for digital twin federation anomaly detection

Abstract

The application discloses a power collection data cooperation method and system for digital twin federation anomaly detection, and relates to the technical field of power anomaly detection. The method collects data at the collection point through the edge terminal, detects according to the time window by the initiator, obtains data-driven anomaly metrics based on the local anomaly detection model, calculates physical consistency anomaly metrics based on the reference model, and fuses to generate local threat scores. When the score exceeds the threshold, a cooperative confirmation is initiated, a threat consensus score is calculated based on the response information, and when the participation quantity condition is met, the event is determined to be established, then the result is disposed and recorded. When the update cycle arrives, the terminal uploads the parameter update amount, the server federates and aggregates, and combines the twin data set to correct the training to obtain a global detection model, and the residual error statistics are issued. The application can improve the robustness and consistency of anomaly recognition, reduce the false alarm risk, and improve the cross-collection point adaptability and long-term operation stability.

Description

Technical Field

[0001] This invention relates to the field of power anomaly detection technology, and in particular to a collaborative method and system for power data acquisition in digital twin federated anomaly detection. Background Technology

[0002] Power data acquisition systems are used for power grid operation monitoring, metering, and condition assessment. Data acquisition terminals are widely distributed and operate in complex environments. As the scale of acquisition points expands and sampling frequency increases, the acquired data is susceptible to changes in equipment status, sensor drift, communication interference, clock deviations, topology adjustments, and fluctuations in operating conditions during acquisition, transmission, and processing. This can lead to data anomalies or decreased reliability, consequently affecting the reliability of subsequent analysis and decision-making.

[0003] Existing anomaly detection technologies mainly include centralized detection and unified modeling, edge-side local detection, distributed collaborative and joint modeling, and consistency verification based on mechanism constraints. Centralized solutions are convenient for utilizing global data, but they face bandwidth and latency pressures under large-scale deployments and their applicability is limited under data security and compliance constraints. Local detection can reduce latency and data transmission, but single-point data coverage is limited and scenarios vary significantly, easily leading to problems such as insufficient generalization, difficulty in long-term stable threshold adaptation, and difficulty in balancing false positives and false negatives. Joint modeling is prone to convergence instability and performance fluctuations under conditions of inconsistent data distribution and varying quality, and lacks robust protection against unreliable participants or abnormal updates. Mechanism consistency verification has a certain degree of interpretability, but its stability and transferability are limited under parameter uncertainty, model mismatch, noise disturbances, and dynamic topology changes.

[0004] In engineering operations, anomalies often require confirmation from multiple sources to reduce misjudgments. Existing collaborative confirmation methods largely rely on fixed-rule voting, manual review, or simple consistency checks. When there are differences in the reliability of participating parties or potential adversarial interference, the reliability of collaborative decisions is difficult to guarantee. Furthermore, the lack of effective connection between collaborative confirmation and handling results makes it difficult to form a continuous evaluation and correction loop, resulting in insufficient long-term adaptability to operating conditions and topology evolution. Therefore, it is necessary to improve the accuracy and stability of anomaly detection while meeting data security and compliance constraints, and to enhance the robustness and adaptability of distributed collaborative confirmation and joint modeling processes to meet the engineering needs of complex dynamic scenarios. Summary of the Invention

[0005] The purpose of this invention is to provide a collaborative method and system for power data acquisition in digital twin federated anomaly detection, in order to solve the limitations of existing technologies in the conditions of large differences in data distribution among multiple acquisition points, continuous evolution of operating conditions and topology, and non-centralized data. These limitations include insufficient accuracy and stability of anomaly detection, low reliability of collaborative confirmation, and susceptibility of model updates to unreliable participants. By realizing collaborative judgment and continuous correction of multi-source information, the invention significantly reduces false alarms and missed alarms and improves the reliability of anomaly event confirmation and handling while meeting data security and compliance constraints. At the same time, it enhances the robustness and adaptability of the global model in dynamic scenarios.

[0006] To achieve the above objectives, the present invention employs the following technical solution: On the one hand, this invention provides a collaborative method for power acquisition data in digital twin federated anomaly detection, comprising the following steps: S1: Multiple edge terminals collect power data at corresponding power collection points; S2: One of the multiple edge terminals acts as the initiating edge terminal. The initiating edge terminal calculates the data-driven anomaly metric based on the power acquisition data through a local anomaly detection model. The initiating edge terminal outputs a reference result based on the power acquisition data through a reference model. The initiating edge terminal calculates the physical consistency anomaly metric based on the deviation between the power acquisition data and the reference result. The initiating edge terminal merges the data-driven anomaly metric and the physical consistency anomaly metric to obtain a local threat score. S3: When the local threat score exceeds the first threshold, the initiating edge terminal sends a collaborative confirmation request to the receiving edge terminal. The collaborative confirmation request carries time window information. The receiving edge terminal returns response information based on the collaborative confirmation request. The initiating edge terminal calculates the threat consensus score based on the response information. When the threat consensus score exceeds the second threshold and the number of response information reaches the participation number threshold, the threat event is determined to be established. S4: After a threat event is established, initiate a response action on the edge terminal and record the response result; S5: When the global detection model update cycle arrives, multiple edge terminals generate local parameter update quantities based on locally stored power acquisition data and processing results and upload them to the server. The server performs federated aggregation on the local parameter update quantities and performs correction training based on the twin dataset generated by the digital twin model to obtain the updated global detection model. The server calculates residual statistics for the twin model objects based on the twin dataset. The server distributes the updated global detection model and residual statistics to multiple edge terminals. Multiple edge terminals update their local anomaly detection models based on the updated global detection model.

[0007] As a preferred embodiment of the present invention, the process of acquiring the power data includes: The edge terminal collects power data at the corresponding power collection point and obtains the topology identification information and time synchronization information corresponding to the power collection point; The edge terminal performs time alignment processing on the power acquisition data based on time synchronization information to obtain preprocessed data. The edge terminal generates a collection evidence summary based on the preprocessed data. The collection evidence summary is stored in association with the power collection data. The collection evidence summary is used to verify the integrity of the response information during the edge collaboration process and to verify the integrity of the data corresponding to the local parameter update during the federated learning process. The server establishes a mapping relationship between the power acquisition point identifier and the twin model object identifier of the digital twin model, and distributes the mapping relationship to each edge terminal. The mapping relationship is used to reference the model output reference results and to generate twin datasets by the server. The mapping relationship is updated when a topology change event or equipment change event occurs.

[0008] As a preferred embodiment of the present invention, the process of generating the local threat score includes: The edge terminal initiates the construction of window samples from power acquisition data based on a preset detection time window, and obtains data-driven anomaly measurement based on the input of the window samples into the local anomaly detection model; The initiating edge terminal determines the twin model object corresponding to the window sample based on the mapping relationship, the reference model outputs the reference result based on the window sample, and the initiating edge terminal calculates the physical consistency anomaly measure based on the deviation between the window sample and the reference result. The edge terminal calculates the physical consistency confidence level based on the physical consistency anomaly metric and the preset local normalization parameters. The edge terminal adaptively adjusts the fusion weight of data-driven anomaly measurement and physical consistency anomaly measurement based on physical consistency confidence to generate a local threat score; The edge terminal initiates a consistency check on the window samples based on the collected evidence summary, and the consistency check result is used to adjust the physical consistency confidence level.

[0009] As a preferred embodiment of the present invention, the local normalization parameters include the residual mean and residual variance calculated based on historical data, or a preset residual quantile threshold. The calculation of physical consistency confidence includes standardization based on residual mean and residual variance, or piecewise normalization based on residual quantile thresholds.

[0010] As a preferred embodiment of the present invention, the calculation of the physical consistency anomaly metric includes: The edge terminal initiates the acquisition of the voltage difference component of line terminal A, the voltage difference component of line terminal B, and the predicted current difference of line terminal A output by the reference model for window samples within the detection time window. The edge terminal initiates the construction of a terminal voltage difference term based on the voltage difference component of line terminal B and the voltage difference component of line terminal A, constructs an equivalent resistance term based on the equivalent resistance parameter of the line and the predicted current difference of line terminal A, and constructs an equivalent inductance term based on the equivalent inductance parameter of the line, the change in the predicted current difference of line terminal A corresponding to the sample sequence number of adjacent windows, and the sampling time interval. The edge terminal initiates the synthesis of the terminal voltage differential term, equivalent resistance term, and equivalent inductance term into a physical consistency residual term, and takes the absolute value of the physical consistency residual term to obtain the residual amplitude; The initiating edge terminal uses the sum of the voltage difference amplitude at line end A and the voltage difference amplitude at line end B as a stability term as a normalization factor to normalize the residual amplitude and obtain the normalized residual. The edge terminal performs a square operation on the normalized residual, adds one, and performs a natural logarithm operation to obtain a physical consistency anomaly measure.

[0011] As a preferred embodiment of the present invention, the physical consistency anomaly measure is obtained according to the following calculation rules: The terminal voltage difference term is obtained by subtracting the voltage difference component at line terminal A from the voltage difference component at line terminal B. The equivalent resistance term is obtained by multiplying the line equivalent resistance parameter by the differential prediction of the line terminal A current of the current window sample number; The change in current difference is obtained by subtracting the predicted difference in current difference at line terminal A corresponding to the sample number of the previous window from the predicted difference in current difference at line terminal A corresponding to the current window sample number. The equivalent inductance term is obtained by multiplying the line equivalent inductance parameter by the change in current difference and then dividing by the sampling time interval. The physical consistency residual term is obtained by adding the terminal voltage difference term, the equivalent resistance term, and the equivalent inductance term. The residual amplitude is obtained by taking the absolute value of the physical consistency residual term. The normalized residual is obtained by using the sum of the voltage difference amplitudes at line terminal A and line terminal B as a stability term and normalizing the residual amplitude. The normalized residuals are squared, then incremented by one and subjected to a natural logarithm operation to obtain the physical consistency anomaly measure corresponding to the current window sample number.

[0012] As a preferred embodiment of the present invention, when the initiating edge terminal calculates the threat consensus score based on the response information, the receiving edge terminal number is... The weighted aggregate weights satisfy the formula: ; Threat consensus score satisfies the formula: ; Indicates the initiating edge terminal number; Indicates the receiving edge terminal number; Represents a set of response information; This indicates the response score output by the receiving edge terminal; This represents the reputation coefficient of the receiving edge terminal; This represents the terminal distance metric calculated based on location identifiers or topology identifiers; This represents the parameter vector of the local anomaly detection model initiated on the edge terminal. This represents the parameter vector of the local anomaly detection model at the receiving edge terminal; , , Indicates the preset attenuation coefficient; The L2 norm of a vector. The square of the L2 norm is used to characterize the difference in local model parameters at both ends; This represents the absolute value operation; This represents the statistical value of physical consistency anomaly measurement within the time window carried by the initiating edge terminal in the collaborative confirmation request; This represents the physical consistency anomaly metric statistics of the receiving edge terminal within the time window carried in the collaborative confirmation request; the physical consistency anomaly metric statistics are the mean or maximum value of the physical consistency anomaly metric within the time window.

[0013] As a preferred embodiment of the present invention, after the threat event is established, the edge terminal initiates a handling action and records the handling result; The actions taken include alarm reporting, local data collection strategy adjustment, and issuing isolation strategies to relevant data collection points. The handling results include the type of handling action, execution time, local threat score, threat consensus score, and handling effect marker; The initiating edge terminal or server updates the reputation coefficient of the corresponding receiving edge terminal based on the processing effect flag and the response score of each receiving edge terminal. The update rule is as follows: when the response score of the receiving edge terminal is consistent with the handling effect label, the reputation coefficient is increased; when they are inconsistent, the reputation coefficient is decreased.

[0014] As a preferred embodiment of the present invention, the server satisfies the following formula when performing federated aggregation and guiding fusion based on the digital twin model: ; In the formula: This represents the global detection model parameter vector before the server-side update. The table represents the local parameter update vector uploaded by the edge terminal; Indicates that the server is based on and Constructed, estimated vector corresponding to the parameters of the local model after training at the edge terminal; This represents the parameter vector derived from the digital twin model; This represents the set of edge terminals participating in this integration; This represents the similarity scale parameter. Indicate its square; The L2 norm of a vector. The square of the L2 norm is used to characterize and Differences; This represents the similarity score calculated based on the differences. Represents the natural exponential function; Indicates a similarity-based score The calculated normalized fusion weights; This represents the twin fusion coefficient, used to control the weight of the digital twin model in the fusion process; This represents the parameter vector after initial fusion; Indicates the index of the edge terminal, and ; The index variable represents the summation operation, and ; As initial parameters, training is performed based on the twin dataset to obtain the updated global detection model, which is then distributed.

[0015] On the other hand, the present invention also provides a power acquisition data collaboration system for digital twin federated anomaly detection, which is applied to the power acquisition data collaboration method for digital twin federated anomaly detection as described above, including multiple edge terminals and a server communicating with each edge terminal; Each of the aforementioned edge terminals includes: The detection module is used to collect power acquisition data; run a local anomaly detection model to calculate data-driven anomaly metrics, run a reference model to output reference results, calculate physical consistency anomaly metrics based on the deviation between the power acquisition data and the reference results, and fuse the two anomaly metrics to generate a local threat score. The consensus module is used to send a collaborative confirmation request to other edge terminals as the initiating edge terminal when the local threat score exceeds a first threshold, receive response information, calculate a threat consensus score based on the response information, and determine that a threat event has been established when the threat consensus score exceeds a second threshold and the number of response information reaches a threshold. The update handling module is used to execute handling actions and record handling results after a threat event is established; when the update cycle arrives, it generates local parameter update quantities based on locally stored power acquisition data and handling results and uploads them; and it updates the local anomaly detection model based on the received updated global detection model. The server includes: The federated fusion module is used to receive local parameter updates uploaded by each edge terminal; perform federated aggregation on the local parameter updates and perform correction training on the twin dataset generated by the digital twin model to obtain an updated global detection model; and calculate residual statistics based on the twin dataset. The communication module is used to send the updated global detection model and the residual statistics to each edge terminal.

[0016] The beneficial effects of this invention are as follows: The power data collaborative method for digital twin federated anomaly detection provided by this invention, by performing windowed detection on the collected data at the edge, fuses the data-driven anomaly metric obtained from the local anomaly detection model with the physical consistency anomaly metric obtained from the reference model. This improves the robustness and accuracy of anomaly identification when a single metric is susceptible to noise, missing data, or local operating conditions. When the local threat score exceeds a threshold, a collaborative confirmation mechanism carrying time window information is introduced. Multiple edge terminals return response information, and the initiating end calculates the threat consensus score. The threat event is determined to be established only when both the consensus score and the number of participants meet the conditions. This reduces the risk of false alarms caused by single-point judgment and improves the consistency of event conclusions. Once a threat event is established, the handling results are recorded, creating a closed-loop feedback between detection and handling. When the global model update cycle arrives, each edge terminal generates parameter update quantities based on local data and handling results and uploads them. The server performs federated aggregation and combines it with the twin dataset generated by the digital twin model for calibration training to obtain the updated global detection model. At the same time, it calculates and distributes residual statistics for twin model objects, so that the model parameters and normalization basis are updated synchronously, thereby improving the consistency of adaptation across collection points and the long-term operational stability. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the overall structure of the system of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention are within the scope of protection of the present invention.

[0019] like Figure 1 As shown, this is an embodiment of the present invention, which provides a collaborative method for power acquisition data in digital twin federated anomaly detection, including the following steps: In this embodiment, the system includes a server and multiple edge terminals. The multiple edge terminals are deployed at different power acquisition points or connected to them nearby to complete data acquisition, preprocessing, and local storage; the server is used to maintain the digital twin model and provide the edge terminals with object mapping information corresponding to the acquisition points.

[0020] S1: Multiple edge terminals collect power data at corresponding power collection points; Specifically, the edge terminal acquires power data from the corresponding acquisition point according to a preset sampling period. The power data includes at least measured quantities and / or status quantities that can characterize the operating status of the acquisition point. The edge terminal organizes the acquired data into a continuous data sequence according to the acquisition time sequence and writes it to local storage for subsequent retrieval according to time windows.

[0021] The power data acquisition process includes: the edge terminal acquiring power data at the corresponding power acquisition point and obtaining topology identification information and time synchronization information corresponding to the power acquisition point; wherein, the topology identification information is used to characterize the location or connection relationship of the acquisition point in the power grid structure, and the time synchronization information is used to determine the correspondence between the sampling time and the unified time reference. While acquiring data, the edge terminal associates the topology identification information with each data record or each data block, and writes a corresponding timestamp or sequence number identifier for each data record or each data block.

[0022] The edge terminal performs time alignment processing on the power acquisition data based on time synchronization information to obtain preprocessed data. In one feasible approach, the edge terminal uses a unified sampling period as the alignment benchmark and resamples the acquisition data to this benchmark time axis: when the deviation between the acquisition time of a sampling point and the benchmark time does not exceed a preset tolerance, the nearest alignment is adopted; when the deviation exceeds the preset tolerance or a missing data point occurs, a missing data point is recorded, and interpolation or padding is performed on a small number of missing data points as needed, while retaining the missing / padding data points. Through the above processing, the preprocessed data is obtained, which meets the time consistency requirements for subsequent cross-acquisition point alignment analysis.

[0023] The edge terminal generates a data acquisition evidence summary based on the preprocessed data. This summary is stored in association with the power acquisition data and is used to verify the integrity of response information during edge collaboration and to verify the integrity of data corresponding to local parameter updates during federated learning. In one feasible implementation, the edge terminal generates the data acquisition evidence summary in units of preprocessed data blocks, which can be divided into fixed-time windows. The data acquisition evidence summary is generated based on at least the following fields according to deterministic rules: acquisition point identifier, topology identifier information, time window number or start and end timestamps, and the content of the preprocessed data within that time window. The edge terminal concatenates or serializes the above fields to calculate the summary value and uses the acquisition point identifier + time window number (or start and end timestamps) as the index key to associate and store the data acquisition evidence summary with the corresponding preprocessed data block. Subsequently, when integrity verification is required, the corresponding data block can be located using the index key, and the summary value can be recalculated and compared with the stored summary to complete the verification of the integrity of the data on which the relevant information is based.

[0024] The server establishes a mapping relationship between power acquisition point identifiers and digital twin model object identifiers, and distributes this mapping relationship to each edge terminal. This mapping relationship is used to reference model output results and to generate the digital twin dataset. The mapping relationship is updated when a topology change event or equipment change event occurs. Specifically, the server maintains a set of acquisition point identifiers and a set of digital twin model object identifiers, and establishes a mapping relationship table between them. The server distributes this mapping relationship table to each edge terminal, enabling the edge terminal to locate the corresponding digital twin model object based on the acquisition point identifier. After detecting a topology change event or equipment change event, the server updates the mapping relationship table and re-distributes it to ensure that the correspondence between acquisition points and digital twin objects remains consistent.

[0025] After completing the data acquisition, time alignment, evidence summary generation, and mapping relationship distribution in step S1, one edge terminal is selected from multiple edge terminals as the initiating edge terminal. The initiating edge terminal performs local detection on the preprocessed power acquisition data of its corresponding acquisition point to form a local threat score for subsequent collaborative confirmation.

[0026] S2: One of the multiple edge terminals acts as the initiating edge terminal. The initiating edge terminal calculates the data-driven anomaly metric based on the power acquisition data through a local anomaly detection model. The initiating edge terminal outputs a reference result based on the power acquisition data through a reference model. The initiating edge terminal calculates the physical consistency anomaly metric based on the deviation between the power acquisition data and the reference result. The initiating edge terminal merges the data-driven anomaly metric and the physical consistency anomaly metric to obtain a local threat score. 1) Window Samples and Data-Driven Anomaly Measurement Initiate the preset detection time window length for the edge terminal Sliding step size and sampling interval The detection time window is converted into the corresponding number of sampling points based on the sampling interval; then, continuous data segments are extracted from the preprocessed data obtained in step S1 according to the start and end timestamps of the window to construct window samples. The window samples must at least contain the voltage-related quantities and their difference components required for subsequent physical consistency calculations, and may also include measured quantities such as current and power as auxiliary features.

[0027] The edge terminal initiates the construction of window samples from power acquisition data based on a preset detection time window, and obtains data-driven anomaly measurement based on the input of the window samples into the local anomaly detection model; The local anomaly detection model preferably employs a lightweight temporal model deployable at the edge to ensure real-time performance and resource susceptibility. To ensure full disclosure, this embodiment provides a directly implementable model structure and training method: The model consists of an input normalization module, an encoder module, a decoder module, and an error calculation and scoring output module connected in series. The input normalization module performs standardization / segmented normalization on the window samples according to the feature dimension. The encoder module sequentially connects a one-dimensional convolutional layer, a GRU layer, and a fully connected layer to extract temporal features and output a low-dimensional representation. The decoder module sequentially connects a fully connected layer, a GRU layer, and an output layer to reconstruct the input window samples. The error calculation module uses the reconstruction error statistic to represent the degree of anomaly and maps the reconstruction error to a data-driven anomaly metric based on the threshold or quantile threshold of historical normal samples. The training steps include: training the data from historical preprocessed data... , Generate a training window sample set; perform forward reconstruction to obtain the reconstruction output; use the reconstruction error as the main loss term and add a regularization term for backpropagation to update the parameters; after training, calculate the error threshold / quantile threshold for normal samples and solidify the model for online inference. Key parameters should include at least the following: , , Convolutional channel number and kernel size, GRU hidden dimension, batch size, learning rate, number of training epochs, regularization coefficient, and threshold / quantile settings.

[0028] 2) Measurement of anomalies in the consistency between reference results and physical properties The initiating edge terminal determines the twin model object corresponding to the window sample based on the mapping relationship. The reference model outputs reference results based on the window sample. The initiating edge terminal calculates the physical consistency anomaly measure based on the deviation between the window sample and the reference result. The initiating edge terminal determines the corresponding twin model object according to the mapping relationship between the collection point identifier and the twin model object identifier issued by S1, and calls the reference model to output the reference result. The reference model outputs at least the line terminal A current differential prediction, which is used to construct the consistency deviation together with the voltage differential component in the window sample.

[0029] The calculation of the physical consistency anomaly metric includes: the initiating edge terminal acquiring the voltage difference component of line terminal A, the voltage difference component of line terminal B, and the predicted current difference of line terminal A output by the reference model for window samples within the detection time window; the initiating edge terminal constructing a terminal voltage difference term based on the voltage difference component of line terminal B and the voltage difference component of line terminal A, constructing an equivalent resistance term based on the equivalent resistance parameter of the line and the predicted current difference of line terminal A, and constructing an equivalent inductance term based on the equivalent inductance parameter of the line, the change in the predicted current difference of line terminal A corresponding to the adjacent window sample number, and the sampling time interval; the initiating edge terminal combining the terminal voltage difference term, the equivalent resistance term, and the equivalent inductance term into a physical consistency residual term, and taking the absolute value of the physical consistency residual term to obtain the residual amplitude; the initiating edge terminal using the sum of the amplitude of the voltage difference component of line terminal A and the amplitude of the voltage difference component of line terminal B, plus a stability term, as a normalization factor, and performing normalization on the residual amplitude to obtain the normalized residual; Under the above definition, the normalized residual is denoted as... To reduce the number of formulas while still ensuring feasibility, this embodiment retains only the final transformed form of the physical consistency anomaly metric, as follows: ; The edge terminal performs a square operation on the normalized residual, adds one, and then performs a natural logarithmic operation to obtain the physical consistency anomaly measure. The equivalent resistance and equivalent inductance parameters of the line can be obtained from line ledgers, equipment parameter configurations, or server-side distribution. A stability term is used to avoid numerical instability caused by an excessively small normalized denominator. The window-level physical consistency anomaly measure can be the mean or maximum value of the anomaly measures of the sample points within the window as the statistic.

[0030] 3) Confidence, fusion, and moderating of evidence consistency The initiating edge terminal calculates the physical consistency confidence score based on the physical consistency anomaly metric and preset local normalization parameters; the initiating edge terminal adaptively adjusts the fusion weight of the data-driven anomaly metric and the physical consistency anomaly metric based on the physical consistency confidence score to generate a local threat score; the initiating edge terminal performs consistency verification on the window samples based on the collected evidence summary, and the consistency verification result is used to adjust the physical consistency confidence score.

[0031] The local normalization parameters include the residual mean and residual variance calculated based on historical data, or a preset residual quantile threshold. The calculation of physical consistency confidence includes standardization based on the residual mean and residual variance, or piecewise normalization based on the residual quantile threshold. In a preferred embodiment, the physical consistency confidence is a value between 0 and 1, used to characterize the credibility of the physical consistency judgment within the current window. The higher the confidence, the greater the weight of the physical consistency anomaly measurement in the fusion; conversely, the lower the confidence, the greater the weight of the data-driven anomaly measurement. After unifying the two types of anomaly measurements to the same scoring scale, they are fused according to the aforementioned adaptive weights to obtain the local threat score. Further, the initiating edge terminal locates the associated collection evidence summary stored in S1 using: collection point identifier + window number (or window start and end timestamps). The summary is recalculated and compared for the current window sample: if the consistency check passes, the physical consistency confidence is maintained; if the consistency check fails, the physical consistency confidence is lowered, and the fusion weights and local threat score are updated accordingly, thereby suppressing the impact of physical consistency judgment on the fusion result when data integrity is insufficient.

[0032] After completing step S2 and obtaining the local threat score of the initiating edge terminal, the system enters the collaborative verification phase. In this embodiment, collaborative verification is used to quickly review suspected threats among multiple edge terminals to reduce false positives / false negatives at single points, and to form an executable threat consensus conclusion when the number of participants is met.

[0033] S3: When the local threat score exceeds the first threshold, the initiating edge terminal sends a collaborative confirmation request to the receiving edge terminal. The collaborative confirmation request carries time window information. The receiving edge terminal returns response information based on the collaborative confirmation request. The initiating edge terminal calculates the threat consensus score based on the response information. When the threat consensus score exceeds the second threshold and the number of response information reaches the participation number threshold, the threat event is determined to be established. (1) Triggering of the collaborative confirmation request and message content When the local threat score generated by the initiating edge terminal within the current detection time window exceeds the first threshold, the collaborative confirmation process is triggered. The initiating edge terminal sends a collaborative confirmation request to one or more receiving edge terminals within a preset collaborative range. The collaborative range can be determined based on topological adjacency, geographical proximity, grouping within the same feeder / station area, or a collaborative list issued by the server.

[0034] The collaborative confirmation request must include at least the following information to ensure that the receiving end can reproduce the local review calculations for the corresponding time period: Data collection point identifiers and / or twin model object identifiers; Time window information (e.g., window start and end timestamps, window number, or equivalent time index); Optional event type prompts (e.g., voltage anomalies, line consistency deviations, etc.) and priority flags; The summary index of the collected evidence used for integrity verification is, for example, the collection point identifier + window number or summary value (used by the receiving end to verify the data range involved in the request).

[0035] To prevent replay of old requests, the collaborative confirmation request may include a random number or a sequence number, and the initiating edge terminal may attach signature / authentication information (the specific encryption authentication method can be selected by the engineering implementation, and this embodiment is not limited).

[0036] (2) Receiving response information from the edge terminal After receiving a collaborative confirmation request, the receiving edge terminal locates the corresponding window sample from its local preprocessed data based on the time window information carried in the request, and performs local verification calculation. The verification calculation outputs at least a response score, which characterizes the receiving end's judgment strength on "whether there is a threat / anomaly in this window"; the response score can take a normalized scale of 0~1 or 0~100, preferably consistent with the local threat score of the initiating end or monotonically mapped to a consistent scale.

[0037] The response information may include at least: Receive edge terminal identifier (number is) ); Response rating ; Physical consistency anomaly metric statistics corresponding to this window (For example, the mean or maximum value of physical consistency anomaly measures within the window); (3) Calculation of weighted aggregation weight and threat consensus score When the initiating edge terminal calculates the threat consensus score based on the response information, the receiving edge terminal number is... The weighted aggregate weights satisfy the formula: ; In the formula: Indicates the initiating edge terminal number; Indicates the receiving edge terminal number; This represents a set of response information, preferably a set of response information that has passed validity checks. ; This indicates the response score output by the receiving edge terminal; This represents the reputation coefficient of the receiving edge terminal; This represents the terminal distance metric calculated based on location identifiers or topology identifiers; This represents the parameter vector of the local anomaly detection model initiated on the edge terminal. This represents the parameter vector of the local anomaly detection model at the receiving edge terminal; , , Indicates the preset attenuation coefficient; The L2 norm of a vector. The square of the L2 norm is used to characterize the difference in local model parameters at both ends; This represents the absolute value operation; This represents the statistical value of physical consistency anomaly measurement within the time window carried by the initiating edge terminal in the collaborative confirmation request; This represents the physical consistency anomaly metric statistics of the receiving edge terminal within the time window carried in the collaborative confirmation request; the physical consistency anomaly metric statistics are the mean or maximum value of the physical consistency anomaly metric within the time window.

[0038] Obtain the weights of each receiver. Then, the edge terminals are used to form a threat consensus score based on a weighted average, satisfying the following: ; To ensure feasibility, the initiating edge terminal can perform numerical stabilization processing on the weights before calculation, for example, by... For cases where the weights are too small, a lower limit stability term can be set, or the smallest weights can be truncated; these are engineering implementation details and do not change the calculation logic of weighted aggregation.

[0039] (4) Threat event establishment determination and timeout handling In this embodiment, the initiating edge terminal sets a second threshold and a participation number threshold (e.g., the participation number threshold is the minimum number of valid responses). A threat event is determined to be valid when the following conditions are met: The threat consensus score exceeds the second threshold; and the number of response messages reaches the participation threshold, i.e. Not less than the preset minimum number of participants.

[0040] If the number of participants does not reach the threshold within the preset response waiting time, the initiating edge terminal may take one of the following actions: extend the waiting period, expand the scope of collaboration and resend the request, or mark the event as a "pending review / low confidence event" according to a conservative strategy to avoid misjudgment due to insufficient response. The above handling strategies can be determined by the engineering configuration and do not affect the consensus score calculation and establishment determination logic in this step.

[0041] Through the above S3 steps, the initiating edge terminal can form a threat consensus score based on the response scores of multiple receivers and the multi-factor attenuation weights after the local threat score is triggered, and make a determination that the threat event is established when the threshold and the number of participants are met, thereby providing a reliable basis for subsequent handling actions and records.

[0042] After the threat event is determined to be established in step S3, the system enters the handling and recording phase to respond quickly and form traceable closed-loop data.

[0043] S4: After a threat event is established, initiate a response action on the edge terminal and record the response result; Once a threat event is established, the initiating edge terminal selects and executes a handling action based on a preset set of handling strategies (which can be issued by the server or configured locally). The handling strategies can be configured with priority and combination methods according to event type and risk level.

[0044] The actions taken include alarm reporting, local data collection strategy adjustment, and issuing isolation strategies to relevant data collection points. Alarm reporting: Report the event number, collection point identifier, time window information, local threat score and threat consensus score to the server or alarm platform; Local data collection strategy adjustment: Temporarily increase the sampling frequency, add key measurement items, or raise the reporting priority for the affected data collection points, and set rollback conditions; Isolation strategy: Implement logical isolation or restrict outgoing transmission for relevant collection points (such as collecting but not transmitting, switching isolation channels, etc.), and set conditions for lifting the isolation.

[0045] The handling results include the type of handling action, execution time, local threat score, threat consensus score, and handling effect marker; The initiating edge terminal generates a handling record while performing the handling action and stores it locally / optionally reports it to the server. The handling effect marker is used to characterize the event review conclusion or handling effect, preferably including at least two categories: valid threat / false alarm, which can be determined by subsequent score decline, manual review or work order feedback.

[0046] The initiating edge terminal or server updates the reputation coefficient of the corresponding receiving edge terminal based on the handling effect tag and the response score of each receiving edge terminal. The update rule is: when the response score of the receiving edge terminal is consistent with the handling effect tag, the reputation coefficient is increased; when they are inconsistent, the reputation coefficient is decreased.

[0047] In one possible implementation, the receiver response score is mapped to a judgment result of supporting / not supporting the existence of a threat, and the handling effect is mapped to the corresponding conclusion; if they match, the reputation coefficient is increased, and if they do not match, it is decreased. The reputation coefficient can be limited to a preset range, and a step coefficient can be set or the increase or decrease can be adjusted according to the response intensity. The updated result is used for the weight calculation of subsequent S3 weighted aggregation.

[0048] After the processing and processing results are recorded in step S4, when the global detection model update cycle preset by the server or system is reached, the system enters the federated update and digital twin correction training phase to achieve continuous optimization of the global model and synchronous update to each edge terminal.

[0049] S5: When the global detection model update cycle arrives, multiple edge terminals generate local parameter update quantities based on locally stored power acquisition data and processing results and upload them to the server. The server performs federated aggregation on the local parameter update quantities and performs correction training based on the twin dataset generated by the digital twin model to obtain the updated global detection model. The server calculates residual statistics for the twin model objects based on the twin dataset. The server distributes the updated global detection model and residual statistics to multiple edge terminals. Multiple edge terminals update their local anomaly detection models based on the updated global detection model.

[0050] To ensure full transparency, the following is an implementable process for: local update generation, server aggregation and twin-guided integration, twin data correction training, residual statistics calculation and distribution, and edge updates.

[0051] The edge terminal generates local parameter update data and uploads it. When the update cycle arrives, each edge terminal reads the preprocessed power acquisition data collected during this cycle and the disposal result record (including disposal effect marker) formed in step S4 from its local storage. The edge terminal uses the current local anomaly detection model parameters as initial parameters, performs several rounds of training / fine-tuning locally to obtain the updated local model parameters, and generates the local parameter update amount.

[0052] In one possible implementation, the local parameter update amount is the difference between the updated parameter and the parameter before the update, which is then packaged and uploaded to the server along with the local terminal identifier, model version number, training sample range index (e.g., window number range), and collected evidence summary index, so that the server can perform integrity verification and aggregation.

[0053] Server-side federated aggregation and digital twin bootstrapping integration After receiving local parameter updates uploaded by multiple edge terminals, the server first performs basic verification and filtering, including: model version consistency verification, uploaded field integrity verification, evidence summary correspondence verification, and filtering of excessive update amounts. The set of edge terminals that pass the filtering is denoted as the participating set for this round. .

[0054] The server performs federated aggregation on local updates to the participating sets and introduces parameter vectors derived from the digital twin model to guide the fusion process. The fusion process satisfies: ; In the formula: This represents the global detection model parameter vector before the server-side update. The table represents the local parameter update vector uploaded by the edge terminal; Indicates that the server is based on and Constructed, estimated vector corresponding to the parameters of the local model after training at the edge terminal; This represents the parameter vector derived from the digital twin model; This represents the set of edge terminals participating in this integration; This represents the similarity scale parameter. Indicate its square; The L2 norm of a vector. The square of the L2 norm is used to characterize and Differences; This represents the similarity score calculated based on the differences. Represents the natural exponential function; Indicates a similarity-based score The calculated normalized fusion weights; This represents the twin fusion coefficient, used to control the weight of the digital twin model in the fusion process; This represents the parameter vector after initial fusion; Indicates the index of the edge terminal, and ; The index variable represents the summation operation, and ; As initial parameters, training is performed based on the twin dataset to obtain the updated global detection model, which is then distributed.

[0055] To enhance feasibility and numerical stability, the server can... Set a lower limit, for Setting the value range and truncating extreme similarities; the above are engineering implementation details and do not change the fusion calculation logic.

[0056] The twin dataset was used to correct the training and obtain the updated global detection model. The server generates a twin dataset based on the digital twin model. The twin dataset can contain measurement data such as voltage and current corresponding to the actual collection points and their derivatives, and can cover rare operating conditions, edge scenarios, or operating conditions where historical data is insufficient.

[0057] In one possible implementation, the server uses As initial parameters for the global detection model, calibration training is performed on the Siamese dataset: for example, performing several rounds of gradient updates or fine-tuning training to obtain updated global detection model parameters. Key parameters for calibration training include at least: number of training rounds, learning rate, batch size, and early stopping condition; the training objective should be consistent with or compatible with the training objective of the local anomaly detection model to ensure that the updated model can be directly deployed to the edge for replacement or incremental updates.

[0058] Calculation and distribution of residual statistics The server calculates residual statistics for the twin model objects based on the twin dataset. The residual statistics are used to characterize the normal range of deviation between the reference output and the sample, providing parameter support for subsequent normalization, threshold setting, or confidence calculation at the margins.

[0059] In one possible implementation, the residual statistics include at least the residual mean and residual variance, or a set of residual quantile thresholds; the statistical object can be a physical consistency anomaly measure or its underlying residual term. The server associates and stores the residual statistics with the corresponding twin model object identifier so that they can be distributed to the corresponding edge terminals according to the data collection point mapping relationship.

[0060] The server distributes the updated global detection model and residual statistics to multiple edge terminals. The distributed content preferably includes the model version number, applicable scope, effective time of residual statistics, and rollback information to support secure switching and consistency management at the edge terminals.

[0061] Edge terminal updates local anomaly detection model After receiving the updated global detection model and residual statistics from the server, each edge terminal first performs version consistency and integrity checks, and then loads the updated global detection model parameters as local anomaly detection model parameters, thus completing the local model update. The residual statistics can be synchronously written to the local normalized parameter area for use in subsequent steps S2 for calculating physical consistency confidence and updating relevant thresholds / quantiles.

[0062] In one possible implementation, the edge terminal supports hot switching between two models: after the new model passes a short online self-check, it switches to the main model; if the self-check fails, it rolls back to the previous version to reduce the risk of updates.

[0063] Through the above S5 steps, the system achieves a closed loop within the update cycle: edge-end generation of update volume, server fusion and aggregation, twin data correction and training, residual statistics calculation, model and parameter distribution, and edge-end update. This enables the global detection model to continuously iterate while meeting the requirements of data not leaving the domain and collaborative security, and improves the detection stability and generalization ability in complex working conditions and rare scenarios.

[0064] like Figure 2 As shown, this is another embodiment of the present invention. This embodiment provides a power acquisition data collaboration system for digital twin federated anomaly detection, which is applied to the power acquisition data collaboration method for digital twin federated anomaly detection as described above. The system is characterized by including multiple edge terminals and a server that communicates with each edge terminal. Each of the aforementioned edge terminals includes: The detection module is used to collect power acquisition data; run a local anomaly detection model to calculate data-driven anomaly metrics, run a reference model to output reference results, calculate physical consistency anomaly metrics based on the deviation between the power acquisition data and the reference results, and fuse the two anomaly metrics to generate a local threat score. The consensus module is used to send a collaborative confirmation request to other edge terminals as the initiating edge terminal when the local threat score exceeds a first threshold, receive response information, calculate a threat consensus score based on the response information, and determine that a threat event has been established when the threat consensus score exceeds a second threshold and the number of response information reaches a threshold. The update handling module is used to execute handling actions and record handling results after a threat event is established; when the update cycle arrives, it generates local parameter update quantities based on locally stored power acquisition data and handling results and uploads them; and it updates the local anomaly detection model based on the received updated global detection model. The server includes: The federated fusion module is used to receive local parameter updates uploaded by each edge terminal; perform federated aggregation on the local parameter updates and perform correction training on the twin dataset generated by the digital twin model to obtain an updated global detection model; and calculate residual statistics based on the twin dataset. The communication module is used to send the updated global detection model and the residual statistics to each edge terminal.

[0065] During system operation, edge terminals generate local threat scores through the detection module and trigger the consensus module to complete collaborative confirmation. When a threat event is established, the update and handling module executes alarm reporting / collection strategy adjustment / isolation strategy and forms a handling effect mark. When the update cycle arrives, each edge terminal uploads the local parameter update amount. The server completes aggregation and twin correction training and calculates residual statistics through the federated fusion module. The communication module distributes the updated global detection model and residual statistics to each edge terminal to achieve synchronous updates of the model and normalized parameters and long-term stable operation.

[0066] In summary, this invention addresses the need for secure and stable operation of power data acquisition, forming a comprehensive technical solution that can be deployed collaboratively on edge terminals and servers. It features modular implementation and a scalable system architecture, facilitating integration with existing power data acquisition terminals, communication networks, and master stations. This solution is applicable to multi-level power data acquisition and monitoring applications at the distribution area, feeder, and substation levels. It supports large-scale access and continuous operation management of multiple acquisition points, improving the engineering level of power data governance and anomaly risk handling, and possesses significant application and industrialization potential.

[0067] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0068] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process. Furthermore, the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functionality involved.

[0069] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A collaborative method for power acquisition data in digital twin federated anomaly detection, characterized in that, Includes the following steps: S1: Multiple edge terminals collect power data at corresponding power collection points; S2: One of the multiple edge terminals acts as the initiating edge terminal. The initiating edge terminal calculates the data-driven anomaly metric based on the power acquisition data through a local anomaly detection model. The initiating edge terminal outputs a reference result based on the power acquisition data through a reference model. The initiating edge terminal calculates the physical consistency anomaly metric based on the deviation between the power acquisition data and the reference result. The initiating edge terminal merges the data-driven anomaly metric and the physical consistency anomaly metric to obtain a local threat score. S3: When the local threat score exceeds the first threshold, the initiating edge terminal sends a collaborative confirmation request to the receiving edge terminal. The collaborative confirmation request carries time window information. The receiving edge terminal returns response information based on the collaborative confirmation request. The initiating edge terminal calculates the threat consensus score based on the response information. When the threat consensus score exceeds the second threshold and the number of response information reaches the participation number threshold, the threat event is determined to be established. S4: After a threat event is established, initiate a response action on the edge terminal and record the response result; S5: When the global detection model update cycle arrives, multiple edge terminals generate local parameter update quantities based on locally stored power acquisition data and processing results and upload them to the server. The server performs federated aggregation on the local parameter update quantities and performs correction training based on the twin dataset generated by the digital twin model to obtain the updated global detection model. The server calculates residual statistics for the twin model objects based on the twin dataset. The server distributes the updated global detection model and residual statistics to multiple edge terminals. Multiple edge terminals update their local anomaly detection models based on the updated global detection model.

2. The method for collaborative power acquisition data detection using digital twin federated anomaly detection according to claim 1, characterized in that, The power acquisition data acquisition process includes: edge terminals acquiring power acquisition data at corresponding power acquisition points and obtaining topology identification information and time synchronization information corresponding to the power acquisition points; edge terminals performing time alignment processing on the power acquisition data based on the time synchronization information to obtain preprocessed data; edge terminals generating acquisition evidence summaries based on the preprocessed data, the acquisition evidence summaries being stored in association with the power acquisition data, the acquisition evidence summaries being used to verify the integrity of response information during edge collaboration and to verify the integrity of data corresponding to local parameter update amounts during federated learning; the server establishing a mapping relationship between the power acquisition point identifier and the twin model object identifier of the digital twin model, and distributing the mapping relationship to each edge terminal, the mapping relationship being used to reference the model output reference results and to generate twin datasets by the server, the mapping relationship being updated when a topology change event or device change event occurs.

3. The method for collaborative power acquisition data detection in a digital twin federated network according to claim 2, characterized in that, The local threat score generation process includes: the initiating edge terminal constructing a window sample from power data collection based on a preset detection time window, and obtaining a data-driven anomaly metric by inputting the window sample into a local anomaly detection model; the initiating edge terminal determining the twin model object corresponding to the window sample based on the mapping relationship, the reference model outputting a reference result based on the window sample, and the initiating edge terminal calculating a physical consistency anomaly metric based on the deviation between the window sample and the reference result; the initiating edge terminal calculating a physical consistency confidence score based on the physical consistency anomaly metric and preset local normalization parameters; the initiating edge terminal adaptively adjusting the fusion weight of the data-driven anomaly metric and the physical consistency anomaly metric based on the physical consistency confidence score to generate a local threat score; and the initiating edge terminal performing a consistency check on the window sample based on the collected evidence summary, with the consistency check result used to adjust the physical consistency confidence score.

4. The method for collaborative power acquisition data detection in a digital twin federated network according to claim 3, characterized in that, The local normalization parameters include the residual mean and residual variance calculated based on historical data, or a preset residual quantile threshold. The calculation of physical consistency confidence includes standardization based on residual mean and residual variance, or piecewise normalization based on residual quantile thresholds.

5. The method for collaborative power acquisition data detection in a digital twin federated network according to claim 3, characterized in that, The calculation of the physical consistency anomaly metric includes: the initiating edge terminal acquiring the voltage difference component of line terminal A, the voltage difference component of line terminal B, and the predicted current difference of line terminal A output by the reference model for window samples within the detection time window; the initiating edge terminal constructing a terminal voltage difference term based on the voltage difference component of line terminal B and the voltage difference component of line terminal A, constructing an equivalent resistance term based on the equivalent resistance parameter of the line and the predicted current difference of line terminal A, and constructing an equivalent inductance term based on the equivalent inductance parameter of the line, the change in the predicted current difference of line terminal A corresponding to the adjacent window sample number, and the sampling time interval; the initiating edge terminal synthesizing the terminal voltage difference term, the equivalent resistance term, and the equivalent inductance term into a physical consistency residual term, and taking the absolute value of the physical consistency residual term to obtain the residual amplitude; the initiating edge terminal using the sum of the amplitude of the voltage difference component of line terminal A and the amplitude of the voltage difference component of line terminal B, superimposed with a stability term as a normalization factor, and performing normalization on the residual amplitude to obtain the normalized residual; the initiating edge terminal performing a square operation on the normalized residual, adding one, and performing a natural logarithm operation to obtain the physical consistency anomaly metric.

6. The method for collaborative power acquisition data detection in a digital twin federated network according to claim 5, characterized in that, The physical consistency anomaly metric is obtained according to the following calculation rules: The voltage difference term is obtained by subtracting the voltage difference component from the voltage difference component at line terminal B; the equivalent resistance term is obtained by multiplying the line equivalent resistance parameter by the predicted current difference at line terminal A for the current window sample number; the current difference change is obtained by subtracting the predicted current difference at line terminal A for the previous window sample number from the predicted current difference at line terminal A for the current window sample number; the equivalent inductance term is obtained by multiplying the current difference change by the line equivalent inductance parameter and then dividing by the sampling time interval; the physical consistency residual term is obtained by adding the voltage difference term, equivalent resistance term, and equivalent inductance term; the residual amplitude is obtained by taking the absolute value of the physical consistency residual term; the normalized residual is obtained by using the sum of the voltage difference amplitudes at line terminal A and line terminal B, plus a stability term, as a normalization factor. The normalized residuals are squared, then incremented by one and subjected to a natural logarithm operation to obtain the physical consistency anomaly measure corresponding to the current window sample number.

7. The method for collaborative power acquisition data detection in a digital twin federated network according to claim 1, characterized in that, When the initiating edge terminal calculates the threat consensus score based on the response information, the receiving edge terminal number is... The weighted aggregate weights satisfy the formula: ； Threat Consensus Score Satisfying the formula: ； In the formula: Indicates the initiating edge terminal number; Indicates the receiving edge terminal number; Represents a set of response information; This indicates the response score output by the receiving edge terminal; This represents the reputation coefficient of the receiving edge terminal; This represents the terminal distance metric calculated based on location identifiers or topology identifiers; This represents the parameter vector of the local anomaly detection model initiated on the edge terminal. This represents the parameter vector of the local anomaly detection model at the receiving edge terminal; , , Indicates the preset attenuation coefficient; The L2 norm of a vector. The square of the L2 norm is used to characterize the difference in local model parameters at both ends; This represents the absolute value operation; This represents the statistical value of physical consistency anomaly measurement within the time window carried by the initiating edge terminal in the collaborative confirmation request; This represents the statistical value of the physical consistency anomaly metric of the receiving edge terminal within the time window carried in the collaborative confirmation request; The physical consistency anomaly metric is the mean or maximum value of the physical consistency anomaly metric within the time window.

8. The method for collaborative power acquisition data detection in a digital twin federated network according to claim 1, characterized in that, Upon the occurrence of a threat event, the initiating edge terminal executes a response action and records the response result. The response actions include alarm reporting, local data collection strategy adjustment, and dissemination of isolation strategies to relevant data collection points. The response result includes the action type, execution time, local threat score, threat consensus score, and response effectiveness flag. Based on the response effectiveness flag and the response scores of each receiving edge terminal, the initiating edge terminal or server updates the reputation coefficient of the corresponding receiving edge terminal. The update rule is as follows: when the response score of the receiving edge terminal is consistent with the handling effect label, the reputation coefficient is increased; when they are inconsistent, the reputation coefficient is decreased.

9. The method for collaborative power acquisition data detection in a digital twin federated anomaly detection system according to claim 1, characterized in that, The server satisfies the following formula when performing federated aggregation and guiding fusion based on the digital twin model: ； In the formula: This represents the global detection model parameter vector before the server-side update. The table represents the local parameter update vector uploaded by the edge terminal; Indicates that the server is based on and Constructed, estimated vector corresponding to the parameters of the local model after training at the edge terminal; This represents the parameter vector derived from the digital twin model; This represents the set of edge terminals participating in this integration; This represents the similarity scale parameter. Indicate its square; The L2 norm of a vector. The square of the L2 norm is used to characterize and Differences; This represents the similarity score calculated based on the differences. Represents the natural exponential function; Indicates a similarity-based score The calculated normalized fusion weights; This represents the twin fusion coefficient, used to control the weight of the digital twin model in the fusion process; This represents the parameter vector after initial fusion; Indicates the index of the edge terminal, and ; The index variable represents the summation operation, and ; As initial parameters, training is performed based on the twin dataset to obtain the updated global detection model, which is then distributed.

10. A digital twin federated anomaly detection power acquisition data collaboration system, applied to the digital twin federated anomaly detection power acquisition data collaboration method as described in any one of claims 1-9, characterized in that, It includes multiple edge terminals and servers that communicate with each edge terminal; Each edge terminal includes: a detection module, used to collect power acquisition data; run a local anomaly detection model to calculate data-driven anomaly metrics, run a reference model to output reference results, calculate physical consistency anomaly metrics based on the deviation between the power acquisition data and the reference results, and fuse the two anomaly metrics to generate a local threat score; a consensus module, used to, as the initiating edge terminal, send a collaborative confirmation request to other edge terminals when the local threat score exceeds a first threshold, receive response information, calculate a threat consensus score based on the response information, and determine that a threat event has been established when the threat consensus score exceeds a second threshold and the number of response information reaches a threshold; and an update and handling module, used to execute handling actions and record handling results after a threat event is established; generate and upload local parameter update quantities based on locally stored power acquisition data and handling results when the update cycle arrives; and update the local anomaly detection model based on the received updated global detection model. The server includes: a federated fusion module, used to receive local parameter updates uploaded by each edge terminal; perform federated aggregation on the local parameter updates and perform correction training on the twin dataset generated based on the digital twin model to obtain an updated global detection model; and calculate residual statistics based on the twin dataset; and a communication module, used to send the updated global detection model and the residual statistics to each edge terminal.

Images