A method for monitoring and recording abnormal power consumption of an electric energy meter

Abstract

The present application relates to the technical field of electricity monitoring, and discloses a kind of electricity meter abnormal electricity monitoring and recording method, receives electricity meter polling data and the physical parameter data containing branch electric energy parameter and the flow rate parameter of water meter and gas meter, and the low-frequency wake-up state quantity is maintained in asynchronous equipment shadow cache area;Polling data and state quantity are interpolated and aligned to calculate cross-business covariance matrix, obtain real-time deviation and deviation gradient;When meeting abnormal condition, trigger topology verification instruction to obtain total output electric quantity, combine branch electric energy parameter to compare branch physical line loss, generate out-of-band abnormality confirmation signal;Self-adapting shorten target polling period to obtain high-frequency electric energy sampling data;Based on communication scheduling delay and actual receiving time stamp, extract asynchronous time bias error to make dynamic encryption salt value, and high-frequency electric energy sampling data is hashed and encrypted to encapsulate generation cross-domain solid confirmation feature code.The present application reduces the misjudgment rate, and improves the data tamper-proof performance.

Description

Technical Field

[0001] This invention relates to the field of electricity monitoring technology, specifically a method for monitoring and recording abnormal electricity consumption of an electricity meter. Background Technology

[0002] Existing methods for monitoring abnormal electricity consumption typically rely on analyzing single power or electricity consumption data collected by electricity meters. However, with increasingly complex electricity consumption patterns, relying solely on single electricity consumption data often proves insufficient for accurately identifying anomalies. Introducing data from water and gas meters for multi-dimensional joint analysis can improve monitoring accuracy; however, water and gas meters are usually battery-powered and operate in a low-frequency wake-up state, resulting in asynchronous data collection between them and the high-frequency data from electricity meters. Simply splicing or interpolating these heterogeneous data directly distorts physical characteristics, leading to biases in subsequent anomaly detection.

[0003] When faced with a large number of meter nodes connecting to the network, traditional monitoring systems often use a fixed-period polling mechanism to allocate communication channels. This communication scheduling method does not dynamically adjust based on the actual operational risks and hardware status of each node, resulting in unreasonable allocation of communication resources. High-risk nodes or nodes with low battery power are unable to complete data reporting in a timely manner.

[0004] Furthermore, during the process of monitoring nodes uploading collected data to the main station, existing security measures mostly rely on conventional encryption algorithms at the software level. These methods lack anti-tampering mechanisms bound to the underlying physical communication path. Once the device terminal is compromised, it is easily compromised and its message data can be forged, resulting in data received by the system lacking authenticity and making it difficult to serve as a reliable basis for tracing abnormal electricity usage. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for monitoring and recording abnormal electricity consumption in electricity meters. This method solves the problems of existing electricity consumption monitoring methods, which typically rely on single electricity data and struggle to integrate asynchronous sampling data from heterogeneous terminals such as water meters and gas meters for multi-dimensional cross-analysis. Furthermore, during abnormal monitoring, the method lacks a dynamic communication resource scheduling mechanism based on risk status when dealing with large-scale heterogeneous meters, and the monitoring data lacks tamper-proof and evidence-based measures that are bound to physical environmental characteristics during transmission and storage.

[0006] To address the above problems, the present invention provides the following technical solution: This invention provides a method for monitoring and recording abnormal electricity consumption in an electricity meter, applied to an edge concentrator, comprising the following steps: The system receives polling data from the electricity meter and physical parameter data including branch electricity parameters, as well as flow rate parameters from the water meter and gas meter. It maintains the low-frequency wake-up state of the water meter and gas meter in the asynchronous device shadow buffer using the flow rate parameters. It performs time-axis interpolation alignment on the polling data and the low-frequency wake-up state, calculates the cross-service covariance matrix of the aligned data, and calculates the real-time deviation and deviation gradient based on the cross-service covariance matrix. When both the real-time deviation and the deviation gradient meet preset anomaly conditions, it triggers a topology verification command and obtains the total output power of the intelligent monitoring device. It then performs a branch physical line loss comparison in conjunction with the branch electricity parameters to generate an out-of-band anomaly confirmation signal. In response to the out-of-band anomaly confirmation signal, it adaptively shortens the target polling cycle for the electricity meter and obtains high-frequency electricity sampling data. Based on the communication scheduling delay and the actual receiving timestamp, it extracts the asynchronous time offset error and uses the asynchronous time offset error as a dynamic encryption salt value to hash and encrypt the high-frequency electricity sampling data, generating a cross-domain solid-state feature code.

[0007] Preferably, maintaining the low-frequency wake-up state of the water meter and the gas meter in the asynchronous device shadow buffer using the flow rate parameter includes: receiving the flow rate parameter and the corresponding physical timestamp reported by the water meter and the gas meter in the communication wake-up state; constructing the asynchronous device shadow buffer in the memory address space, and constructing corresponding virtual mapping nodes for the water meter and the gas meter in the asynchronous device shadow buffer; performing a memory overwrite operation on the virtual mapping node using the received flow rate parameter and the corresponding physical timestamp, and maintaining the low-frequency wake-up state locally without actively waking up the water meter and the gas meter.

[0008] Preferably, the step of interpolating and aligning the polling data with the low-frequency wake-up state quantity along the time axis includes: using the active polling time sequence of the energy meter as a reference, discretizing the continuous physical time into service determination moments with fixed step sizes, and establishing a synchronization reference time axis; using zero-order hold logic, extracting the flow velocity parameters of the water meter and the gas meter from the low-frequency wake-up state quantity within the reliable time frame and interpolating and mapping them to the synchronization flow velocity parameters of the current service determination moment; the method further includes: receiving environmental parameters reported by environmental sensors, scaling and correcting the synchronization flow velocity parameters by combining them with a pre-stored fluid temperature compensation coefficient, and concatenating the corrected synchronization flow velocity parameters with the instantaneous active power in the polling data of the energy meter to construct a multi-dimensional synchronization state column vector.

[0009] Preferably, the calculation of the cross-service covariance matrix of the aligned data, and the calculation of the real-time deviation and deviation gradient based on the cross-service covariance matrix, includes: sequentially storing multiple continuously generated multidimensional synchronization state column vectors into a sliding time window to construct an observation data matrix; calculating and summing the sample deviation matrix of the observation data matrix; dividing the summation result by the sample degrees of freedom to generate the cross-service covariance matrix; calculating the real-time deviation that measures the current physical state from the multi-energy collaborative baseline distribution based on the latest multidimensional synchronization state column vector, the mean vector within the sliding time window, and the inverse matrix of the cross-service covariance matrix; calculating the difference between the current real-time deviation and the historical deviation corresponding to the backtracking time step, and obtaining the ratio of the difference to the actual time length traversed to obtain the deviation gradient characterizing the state degradation rate.

[0010] Preferably, when both the real-time deviation and the deviation gradient meet preset abnormal conditions, triggering a topology verification command and obtaining the total output power of the intelligent monitoring device, and comparing the branch physical line loss with the branch power parameters to generate an out-of-band anomaly confirmation signal includes: triggering a topology verification command when it is determined that the real-time deviation is greater than a static deviation threshold preset based on the historical normal state baseline and the deviation gradient is greater than a deviation gradient threshold preset based on the system fault tolerance standard; responding to the topology verification command, extracting the corresponding local power supply topology relationship diagram and obtaining the total output power collected by the intelligent monitoring device at the main incoming line of the distribution transformer; calculating the topology conservation residual based on Kirchhoff's laws according to the total output power and the branch active power of adjacent users at the same level included in the branch power parameters; and generating and outputting the out-of-band anomaly confirmation signal when the topology conservation residual is greater than the topology tolerance margin preset based on the inherent line loss.

[0011] Preferably, the step of adaptively shortening the target polling cycle of the energy meter in response to the out-of-band anomaly confirmation signal includes: weighting and summing the ratio of the real-time deviation to the static deviation threshold and the ratio of the deviation gradient to the deviation gradient threshold to generate a comprehensive risk index; calculating the target polling cycle based on the comprehensive risk index using a negative exponential decay model; and matching the target polling cycle downwards to the nearest discrete level supported by the hardware, thereby updating and shortening the target polling cycle of the energy meter.

[0012] Preferably, in the process of shortening the target polling cycle and acquiring high-frequency power sampling data, a token-based arbitration scheduling step is also included: the power meter, water meter, and gas meter to be interacted with are designated as nodes to be accessed, and a communication queue is constructed; for each node to be accessed, a dynamic priority score is calculated by weighted summation based on the comprehensive risk index, the ratio of the waiting time of the node to be accessed in the communication queue to the target polling cycle, and the ratio of consumed power calculated based on the full battery load; the nodes to be accessed are arranged in descending order according to the dynamic priority score, and a dynamic arbitration queue is constructed; according to the order of the dynamic arbitration queue, a medium access control token is sequentially sent to the corresponding node to be accessed to acquire the high-frequency power sampling data in an orderly manner.

[0013] Preferably, the step of extracting the asynchronous time offset error based on the communication scheduling delay and the actual reception timestamp, and using the asynchronous time offset error as a dynamic encryption salt, includes: recording the actual reception timestamp of the high-frequency power sampling data using a local real-time clock; calculating the time difference between the actual reception timestamp and the service determination time, and subtracting the waiting time of the node to be accessed in the communication queue and the pre-tested and calibrated baseline communication transmission delay from the time difference to obtain the asynchronous time offset error; when the asynchronous time offset error is not greater than the physical offset tolerance pre-set according to the clock drift characteristics, the asynchronous time offset error is arrayed and encapsulated to generate the dynamic encryption salt.

[0014] Preferably, the step of using the asynchronous time offset error as a dynamic encryption salt to hash and encrypt the high-frequency power sampling data to generate a cross-domain verification feature code includes: converting the high-frequency power sampling data into byte stream data, and sequentially concatenating and splicing the terminal device identifier, the service determination time, the byte stream data, and the asynchronous time offset error as the dynamic encryption salt to generate a joint bit string; extracting a preset local domain control private key, performing cyclic shifting and copying padding on the local domain control private key to align the total bit width of the local domain control private key with the joint bit string, and performing a bitwise XOR operation with the joint bit string to generate an obfuscation result; inputting the obfuscation result into a preset one-way hash function for mapping calculation, and outputting the cross-domain verification feature code.

[0015] Preferably, after generating the cross-domain evidence-secured feature code, the method further includes a data hierarchical storage and anti-tampering backup step: the cross-domain evidence-secured feature code and the byte stream data are structurally encapsulated into an evidence-secured data packet; the cross-domain evidence-secured feature code of the current evidence-secured data packet is extracted, and the cross-domain evidence-secured feature code is concatenated and hashed with the chain index feature value of the previous adjacent data block in the local non-volatile memory to generate the chain index feature value of the current block; when the local storage capacity occupancy rate reaches the storage level threshold preset according to the total capacity of the local non-volatile memory, or when the time span since the last wide area network interaction reaches the backup calibration cycle preset according to the data retention specification, the evidence-secured data packet set in the current block segment and the latest chain index feature value are encapsulated into a system-level backup file, and encrypted and pushed to the remote evidence storage platform for backup.

[0016] This invention provides a method for monitoring and recording abnormal electricity consumption in an electricity meter. It has the following beneficial effects: 1. This invention utilizes zero-order hold logic to map the low-frequency flow velocity parameters of water and gas meters to the business judgment time of electricity meters, and calculates the cross-business covariance matrix and real-time deviation of the multi-dimensional synchronous state column vector. Simultaneously, it compares branch physical line losses by combining branch electricity parameters with topology conservation residuals. This unifies the time dimension of asynchronous heterogeneous data, utilizes the joint distribution characteristics of multiple parameters to identify abnormal behaviors that are difficult to detect with a single parameter, and combines physical topology for cross-validation, reducing the false positive rate of abnormal electricity usage states.

[0017] 2. This invention generates a comprehensive risk index by weighting the ratio of real-time deviation to a static deviation threshold and the ratio of deviation gradient to a deviation gradient threshold to determine the target polling cycle. It then calculates a dynamic priority score by combining the device's waiting time and remaining battery power, thereby completing the arbitration allocation of channel tokens. The communication frequency is adaptively adjusted based on the terminal node's abnormal risk level and its own hardware conditions, prioritizing data access for high-risk nodes and low-battery nodes, thus optimizing the scheduling efficiency of the metering network.

[0018] 3. This invention calculates the difference between the actual received timestamp of the message and the service determination time, and extracts the asynchronous time offset error after deducting the waiting time and the pre-tested benchmark communication transmission delay. This error is then used as a dynamic encryption salt value and combined with high-frequency power sampling data for hash encryption encapsulation to generate a cross-domain secure signature code. By binding the physical transmission characteristics of the channel with the service data during data transmission, the anti-tampering capability of the data during transmission is enhanced, providing a reliable data traceability basis for power consumption anomaly analysis. Attached Figure Description

[0019] Figure 1 This is a system architecture diagram of an embodiment of the present invention; Figure 2 This is a flowchart of the method for monitoring and recording abnormal electricity consumption by an electricity meter according to an embodiment of the present invention; Figure 3 This is a trend chart showing the cross-service real-time deviation and communication scheduling cycle variation in an embodiment of the present invention. Figure 4 This is a bar chart comparing the performance of embodiments of the present invention. Detailed Implementation

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] See attached document Figure 1 This invention provides an abnormal electricity consumption monitoring and recording system for electricity meters, which is built based on information system design services and includes an edge concentrator, electricity meter, water meter, gas meter, environmental sensor, intelligent monitoring device and evidence storage platform.

[0022] The edge concentrator is embedded with programs that provide information system integration services and IoT application services. Electricity meters, water meters, and gas meters, as smart terminals, connect to the edge concentrator and establish communication connections. Environmental sensors connect to the edge concentrator and provide sensing technology services. Intelligent monitoring devices are located at the main incoming line of the distribution transformer and establish communication connections with the edge concentrator. The evidence storage platform connects to the edge concentrator and provides backup services.

[0023] See attached document Figure 2 This invention provides a method for monitoring and recording abnormal electricity consumption in an electricity meter, comprising the following steps: S100, the edge concentrator receives polling data and physical parameter data reported by electricity meters, water meters, gas meters and environmental sensors through the information sensing module, establishes an asynchronous device shadow buffer for water meters and gas meters in the storage space, and uses the asynchronous device shadow buffer to maintain the low-frequency wake-up state of water meters and gas meters. S200, the edge concentrator calls the information processing module to perform time axis interpolation alignment on the polling data of the energy meter and the low-frequency wake-up status quantity, calculates the cross-service covariance matrix of the aligned data, extracts the deviation gradient from the cross-service covariance matrix, triggers the topology verification instruction according to the deviation gradient to obtain the total output power collected by the intelligent monitoring device, and compares the branch physical line loss with the physical parameter data of the energy meter according to the total output power, generating an out-of-band anomaly confirmation signal. This out-of-band anomaly confirmation signal is transmitted or marked with high priority independently of the conventional meter reading data link. S300: The edge concentrator calculates the target polling period of the energy meter based on the out-of-band anomaly confirmation signal and the deviation gradient, performs channel token arbitration allocation in the downlink communication network, and sends communication tokens and target polling periods to the energy meter. S400: The edge concentrator receives high-frequency energy sampling data reported by the energy meter according to the target polling cycle. Based on the communication scheduling delay and the actual receiving timestamp, it extracts the asynchronous time offset error and uses this asynchronous time offset error as a dynamic encryption salt value. It performs hash operation with the high-frequency energy sampling data, device identifier and service time to generate a cross-domain evidence-based feature code. The high-frequency energy sampling data and the cross-domain evidence-based feature code are written into a one-time write data storage medium, and the cross-domain evidence-based feature code is sent to the evidence storage platform to perform backup service.

[0024] S101, the edge concentrator performs active polling on the actively powered energy meters, and maintains a basic polling cycle internally. Preferably, the basic polling period is... Pre-configured based on the transformer area size and power communication protocol, with values ​​set between minutes. When the local timer reaches the basic polling cycle... At this time, the edge concentrator sends a data request command to the electricity meter through the downlink high-speed power line carrier channel. After receiving the command, the electricity meter returns the current physical timestamp of the electricity. The cumulative energy consumption and instantaneous electrical parameters are used to form an energy consumption sequence. , as polling data.

[0025] S102, to obtain the service status in non-electrical quantity dimensions, the edge concentrator receives asynchronous reporting data from water meters and gas meters powered by internal batteries. When there is no service interaction, the water and gas meters maintain a low-power listening state, relying on internal low-power pulse counters to accumulate physical quantities. When the pulse equivalent per unit time exceeds a preset wake-up threshold or the internal hardware timer overflows, the communication wake-up mechanism is triggered. The water and gas meters in the wake-up state send reporting data packets to the edge concentrator via a wireless radio frequency channel. The reporting data packets carry the flow rate parameters of the water meters. Corresponding water physical timestamp and the flow rate parameter of the gas meter Corresponding physical timestamp of gas For the specific signaling interaction process of maintaining the low-power mode of narrowband IoT and the terminal wake-up mechanism, those skilled in the art can refer to existing communication protocol specifications. The underlying radio frequency handshake principle is a well-known technology in this field and will not be elaborated here.

[0026] S103, the edge concentrator collects physical parameter data from environmental sensors via a local communication interface. The environmental sensors collect data at preset time intervals. Upload on-site temperature and humidity data and record them as environmental parameters. Environmental parameters Used to provide a reference for baseline smoothing in subsequent calculation logic. The environmental physical timestamp represents the data reported by the environmental sensors.

[0027] S104, the edge concentrator constructs an asynchronous device shadow buffer in the memory address space, writes the received heterogeneous data into the asynchronous device shadow buffer, and establishes a heterogeneous terminal state space dictionary. The edge concentrator will sequence the power. and its electrical energy physical timestamp Flow velocity parameter of water meter and its water physical timestamp Flow rate parameters of gas meters and its gas physical timestamp Environmental parameters and its environmental physical timestamp These are memory-bound and stored as data tuples, respectively. Heterogeneous terminal state space dictionary. This results in a unified data set that includes the states of multidimensional physical quantities and their respective independent asynchronous time dimensions.

[0028] S105, the edge concentrator continuously monitors each communication port. When it receives a data packet reported by any terminal, it parses the data payload and the attached timestamp, and uses the newly acquired value to overwrite the historical value of the corresponding entry in the shadow buffer of the asynchronous device, thus completing the process of creating a state space dictionary for the heterogeneous terminals. This allows the edge concentrator to continuously maintain the latest business status records of each controlled terminal in its local memory without actively waking up the water and gas meters.

[0029] In this embodiment, the edge concentrator utilizes an asynchronous device shadow buffer to implement a decoupling mechanism for the communication timing of multi-source heterogeneous devices, specifically including the following steps: S106, the edge concentrator constructs a state decoupling layer based on an asynchronous device shadow buffer. Since the electricity meter is continuously powered by AC mains and supports real-time bidirectional communication, while the water and gas meters rely on internal batteries and operate in a deep sleep state, frequent synchronization wake-up mechanisms would increase the probability of collisions in the underlying communication links and accelerate battery consumption. Therefore, the state decoupling layer is used to logically isolate the wireless communication links of the water and gas meters from the high-frequency service query logic within the edge concentrator.

[0030] S107, the edge concentrator constructs a first virtual mapping node for the water meter and a second virtual mapping node for the gas meter in the asynchronous device shadow buffer. The first and second virtual mapping nodes are used to persistently store the flow rate parameters of the water meter. Corresponding water physical timestamp and the flow rate parameter of the gas meter Corresponding physical timestamp of gas In terms of specific data organization, the edge concentrator, based on the pointer mapping mechanism of the underlying operating system, directly aggregates the memory addresses of the first and second virtual mapping nodes into the heterogeneous terminal state space dictionary. This enables unified addressing and management of data from heterogeneous devices.

[0031] S108, preferably, the edge concentrator executes a read-write separation data maintenance strategy based on the asynchronous device shadow buffer. On the one hand, the water meter and gas meter trigger communication wake-up and push data according to their own hardware conditions. After receiving the data, the edge concentrator only performs memory overwrite operations on the first virtual mapping node and the second virtual mapping node. On the other hand, when performing business operations, the information processing module inside the edge concentrator directly accesses the aforementioned first and second virtual mapping nodes to read the cached values, thereby avoiding sending additional physical detection messages to the water meter and gas meter.

[0032] S109, at any business decision moment The edge concentrator directly draws from the heterogeneous terminal state space dictionary. Extract the latest flow rate parameters from the water meter. Flow rate parameter of gas meter Extract the associated water physical timestamp. physical timestamp of gas To prevent expired historical data from being used in calculations due to communication interruptions, the edge concentrator introduces a data validity tolerance period. Perform timeliness verification and data validity tolerance time. The value range is configured to be 1.5 to 2 times the longest forced heartbeat cycle of water meters and gas meters.

[0033] During the specific verification execution process, the business decision time is calculated. Water physical timestamp The first duration difference between them, and the time of business judgment. physical timestamp of gas The second time difference between the first and second time differences. If both the first and second time difference are less than or equal to the data validity tolerance time... If the condition is met, the current cached data is determined to be within a reliable validity period. The edge concentrator stores the flow rate parameter in memory. With flow velocity parameter Aggregate the data to construct an asynchronous observation set containing heterogeneous physical quantities. Asynchronous observation set Used to characterize water meters and gas meters at the time of business determination. The last known and precise physical activity status provides continuous status input for joint analysis across business dimensions without altering the original dormant characteristics of the equipment.

[0034] In this embodiment, the edge concentrator calls its internal information processing module to perform time-dimensional standardization processing on the physical parameters collected by multi-source heterogeneous devices, in order to solve the problem of joint analysis difficulties caused by inconsistent reporting frequencies of different terminals. Specifically, this includes the following steps: S201, the edge concentrator establishes a unified synchronization reference time axis. To reduce the overall system resampling error, the edge concentrator uses the active polling time series of the energy meters as a reference, discretizing continuous physical time into a series of business decision moments with equal step sizes. ,in Represents a discrete time index number. Adjacent service determination time. and The time step between them is equal to the aforementioned basic polling period. .

[0035] S202, the edge concentrator performs time axis interpolation alignment. This is due to the water utilities' physical timestamps. physical timestamp of gas Objectively, it usually lags behind the current business decision-making time. Edge concentrators require numerical analysis methods to determine flow velocity parameters. With flow velocity parameter Resampling is performed. Considering that the fluid state of water and gas meters typically remains stable during dormancy, the edge concentrator uses zero-order hold logic for interpolation, targeting the business decision moments within the aforementioned series of equal-step business decision moments. The edge concentrator will include the aforementioned flow rate parameters within the trusted timeframe. With flow velocity parameter Directly mapped to the business decision moment Synchronous water flow velocity parameters Synchronous gas flow rate parameter .

[0036] S203, environmental parameters reported by the edge concentrator in conjunction with environmental sensors Temperature baseline smoothing correction is applied to the aforementioned synchronous flow velocity parameters. Since changes in ambient temperature can cause fluid volume expansion or sensor temperature drift, the edge concentrator's information processing module retrieves data from the heterogeneous terminal state space dictionary. Extracting nearest neighbor environmental parameters The temperature value in the data is used as the current ambient temperature. In the specific correction calculation process, the edge concentrator calculates the temperature difference between the current ambient temperature and the preset reference temperature, and multiplies this temperature difference by the internally stored fluid temperature compensation coefficient to obtain the corresponding temperature compensation bias. The edge concentrator uses this temperature compensation bias to adjust the synchronous water flow velocity parameter. Synchronous gas flow rate parameter A linear scaling correction is performed to generate the corrected water characteristic parameters. With gas characteristic parameters The values ​​of the fluid temperature compensation coefficients mentioned above are determined by the factory calibration documents of each instrument manufacturer and are loaded into memory during the initialization of the edge concentrator 10.

[0037] S204, The edge concentrator extracts the energy meter data at the business determination time. Synchronously reported power sequence The instantaneous active power parameter in the figure is denoted as instantaneous active power. After extracting the parameters of each physical dimension, the edge concentrator stores the instantaneous active power in memory. and the aforementioned synchronous water flow velocity parameters Synchronous gas flow rate parameter Alternatively, the water characteristic parameters after the aforementioned smoothing correction can also be used. With gas characteristic parameters These parameters are arranged and concatenated sequentially as independent data dimensions to construct a multidimensional synchronization state column vector composed of the three parameters mentioned above. .

[0038] S205, the edge concentrator establishes and maintains a sliding time window in memory to store continuously acquired multidimensional synchronization state column vectors. When the latest multidimensional synchronization state column vector is acquired... At that time, the edge concentrator pushes it to the end of the sliding time window and simultaneously removes the oldest vector data on the time axis, thus forming a fixed-dimensional observation data matrix. The sliding time window The capacity length is configured to range from 12 to 24 sampling points. This capacity range is set to ensure the accuracy of the observation data matrix. The internally accumulated data sample size is sufficient to capture the statistical distribution characteristics of physical quantities, while avoiding memory overload of the embedded system. Through the above operations, the edge concentrator transforms discrete, asynchronous, multi-source heterogeneous data into an observation data matrix aligned in the time dimension. .

[0039] In this embodiment, the edge concentrator, through its internal information processing module, is based on the observation data matrix. Performing cross-business covariance analysis includes the following steps: S206, Obtain the updated observation data matrix within the sliding time window. In the specific computational logic, the sample data needs to be centered, that is, the expected value of all multidimensional synchronization state column vectors within the sliding time window needs to be calculated, thereby obtaining the mean vector. Based on mean vector Further construct a cross-business covariance matrix that reflects the intensity of multi-parameter correlation fluctuations. Calculate the observation data matrix Each multidimensional synchronization state column vector and mean vector The difference vector is obtained by multiplying it with its own transpose to get the deviation matrix of a single sample. The deviation matrices of all samples within the sliding time window are summed, and the sum is divided by the sample degrees of freedom (i.e., the length of the sliding time window minus 1) to obtain the unbiased estimate of the cross-business covariance matrix. This matrix quantitatively characterizes the correlation and variation distribution characteristics of multidimensional physical states, including electrical parameters, water characteristic parameters, and gas characteristic parameters, within the current time period.

[0040] S207, Obtaining the Cross-Business Covariance Matrix Then, the latest business judgment moment. The multidimensional synchronization state column vector Perform state-space projection analysis and calculate real-time deviation. Real-time deviation The Mahalanobis distance is used to measure the deviation of the current state of physics from the normal multi-energy cooperative baseline distribution. Its real-time calculation formula is: In the formula, Indicates the moment of business judgment The calculated real-time deviation, where This represents the aforementioned discrete time index sequence number; Represents the latest multidimensional synchronization state column vector; Represents the mean vector; Indicates the transpose operation; Representing the cross-business covariance matrix The inverse matrix. To prevent cross-service covariance matrix issues caused by the constant values ​​of the multidimensional synchronization state column vectors under extreme operating conditions such as device hibernation or zero traffic at night. Singularity occurs, making inversion impossible. Before performing matrix inversion, consider the cross-business covariance matrix. A tiny positive perturbation parameter is superimposed on the main diagonal. A diagonal matrix is ​​constructed and matrix regularization is performed to eliminate the computational dead zone of the algorithm under zero flow rate conditions.

[0041] S208, to reduce the risk of misjudgment caused by sudden noise in single-point communication or occasional transient load fluctuations, a deviation gradient mathematical model is further constructed in the information processing module. The deviation gradient characterizes the degradation rate of heterogeneous energy consumption states deviating from the normal physical coupling law. Preferably, the current service judgment time is extracted. Real-time deviation The deviation between the two values ​​is calculated, along with the historical deviation corresponding to a preset time step for backtracking. This deviation difference is then divided by the actual time span (i.e., the product of the backtracking time step and the basic polling period) to obtain the deviation gradient representing the rate of state degradation. The backtracking time step is configured to be 3 to 5 consecutive sampling periods.

[0042] S209, the edge concentrator uses the calculated real-time deviation. With deviation gradient Perform out-of-band measurement anomaly confirmation judgment. During the judgment process, a preset static deviation threshold is accessed from memory. Deviation gradient threshold The two thresholds mentioned above are determined during the system initialization phase based on historical normal operation data of the transformer area, according to the Three Sigma rule. Offline calibration is performed to generate this rule, which can serve as the system's fault tolerance standard. In practical operation, the real-time deviation will be... Deviation from static threshold Perform numerical comparison and simultaneously update the deviation gradient. Deviation gradient threshold Perform numerical comparison.

[0043] S210, when the real-time deviation Greater than the static deviation threshold And the deviation gradient greater than the deviation gradient threshold When the signal is not present, the system generates and outputs an out-of-band anomaly confirmation signal; otherwise, it determines that the current system is in a normal fluctuation state and maintains normal monitoring logic.

[0044] In this embodiment, after generating the aforementioned out-of-band anomaly confirmation signal, the information processing module inside the edge concentrator introduces a secondary physical verification mechanism based on spatial topology to avoid reporting false alarms to the cloud master station due to real equipment failures (such as pipeline rupture and leakage, or line grounding short circuits) rather than human tampering. This mechanism is used to perform cross-validation on statistical deviations based on local power supply topology, and specifically includes the following steps: S211, in response to the triggering of the out-of-band anomaly confirmation signal, the edge concentrator places the confirmation signal in a suspended reporting state in memory and extracts the local power supply topology graph of the multi-source heterogeneous terminals currently suspected of having anomalies. Preferably, the edge concentrator pre-stores a node adjacency matrix, which completely records the spatial physical connection paths between the upstream master control node and adjacent nodes of the electricity meter, water meter, and gas meter. It should be noted that the underlying data structure design that uses the node adjacency matrix to represent and traverse the physical node connection paths can be fully implemented by those skilled in the art using conventional graph structure storage algorithms (such as memory-based two-dimensional arrays or adjacency lists), as these are conventional techniques in the field and will not be elaborated further here.

[0045] S212, to maintain the low-power sleep characteristics of water meters and gas meters and avoid triggering additional physical wake-ups, the edge concentrator directly accesses the heterogeneous terminal state space dictionary based on the addressing path of the local power supply topology graph. Extract the upstream master table node and the sibling sub-table node corresponding to multi-source heterogeneous terminals at the same business judgment time. The cached state data is used to extract the aligned main flow velocity parameters at the upstream main pipeline and the aligned flow velocity parameters of other parallel branches in the same pipeline segment for flow verification scenarios of water meters or gas meters. For power verification scenarios of electricity meters, the edge concentrator obtains the total output power (i.e., total active power) collected by the intelligent monitoring device at the transformer main input terminal through topology verification instructions, and simultaneously extracts the branch active power of adjacent users at the same level in the local topology as the branch power parameters.

[0046] S213, after acquiring relevant node data, the edge concentrator constructs a topology residual evaluation model based on Kirchhoff's current law or the law of conservation of fluid mass. During calculation, the information processing module subtracts the previously acquired regional aggregated physical parameters from the sum of the branch physical parameters of all downstream sub-table nodes under the power supply topology branch. To eliminate the sign difference in energy flow direction measurement between multi-source heterogeneous devices, the absolute value of the above difference result is taken, thereby obtaining the topology conservation residual that only characterizes the magnitude of spatial numerical deviation. .

[0047] S214, calculate the topologically conserved residuals. Then, it is compared with the preset topology tolerance margin. Perform threshold comparison. Topological tolerance margin. The value takes into account the natural losses along the pipeline, the leakage current of the line (i.e. the inherent line loss of the line), and the basic measurement error allowed by the manufacturer for each level of meter. Its actual engineering value range is configured as 2% to 5% of the full scale value of the upstream main meter node.

[0048] S215, when topologically conserved residuals Greater than topological tolerance margin When this occurs, it indicates that there is a measurement deviation in the local system that does not conform to the laws of physical conservation. The edge concentrator then determines that the meter that triggered the anomaly has either had firmware tampering or hardware measurement failure, and immediately releases the suspended state of the out-of-band anomaly confirmation signal and reports the out-of-band anomaly confirmation signal to the cloud master station.

[0049] Conversely, if the comparison result is less than or equal to the above, it indicates that the macroscopic data of the upstream and downstream meters still satisfy the physical equilibrium law within the allowable error range. This suggests that the deviation in the statistical state calculated in the previous step stems from a sudden change in physical energy consumption that actually occurs below the node (such as a burst water pipe causing a surge in water flow, while a power outage results in no corresponding change in electrical energy), rather than an error in the metering module itself. In this case, the edge concentrator cancels the original out-of-band anomaly confirmation signal in memory and instead generates a physical hazard warning signal for the specific node to be connected.

[0050] In this embodiment, the edge concentrator executes an adaptive frequency mapping mechanism based on continuous variables, specifically including the following steps: S301, the edge concentrator completes the service determination at the moment... After analysis, the corresponding real-time deviation can be directly retrieved through the information processing module. With deviation gradient Simultaneously, a preset static deviation threshold is extracted. Deviation gradient threshold As a comparison benchmark.

[0051] S302, to eliminate the difference in magnitude between spatial deviation and temporal gradient, a dimensionless comprehensive risk index is constructed. Real-time deviation Divide by static deviation threshold Obtain the spatial deviation ratio and the deviation gradient. Divide by the deviation gradient threshold By obtaining the time degradation ratio, and introducing spatial and temporal weighting coefficients that sum to 1, the two ratios are weighted and summed to obtain a comprehensive risk index in the form of a single scalar. Preferably, the spatial weighting coefficient is configured to be 0.6, and the time weighting coefficient is configured to be 0.4.

[0052] S303, based on the calculated comprehensive risk index The target polling period for sending data to heterogeneous terminals is derived using a nonlinear mapping function. Preferably, the target query period The specific calculation formula is as follows: In the formula, Indicates the target polling period generated by the mapping; This indicates the preset upper limit of the hibernation period, with a typical engineering value range of 12 to 24 hours, corresponding to a longer hibernation interval when the system is in a normal safe state; The preset limit detection period is usually limited by the radio frequency duty cycle of the underlying communication module and the instrument wake-up recovery time, and its value range is set to 15 to 30 minutes; This represents the preset sensitivity adjustment coefficient, used to control the slope of the exponential decay curve. Its actual engineering value is set within the range of 0.5 to 1.5. This represents the comprehensive risk index. The above is based on a continuous mapping model with negative exponential decay, which can output the target polling period. The lower limit constraint is the limit detection period. This is to prevent overflow errors from occurring in the underlying hardware timer.

[0053] S304, calculate the continuous target polling period. Afterwards, the edge concentrator needs to perform discretization matching. Considering that the hardware timers of some collaborative monitoring terminals (such as water meters and gas meters) typically only support fixed-step wake-up increments (e.g., 15 minutes, 30 minutes, or 60 minutes), the system will continuously poll the target period. The system matches the nearest available discrete speed range supported by the hardware, thereby synchronously establishing the final scheduling frequency for both the electricity meter and the coordinating terminal. If If the discrete timer's value falls below the minimum discrete level supported by the hardware, the system triggers protection logic to force it to clamp to that minimum level. The generated discrete scheduling cycle is input into the underlying token arbitration queue to update the communication call frequency for each node to be connected. The discrete timer configuration and register writing for this type of embedded timer can be implemented using conventional microcontroller clock configuration techniques, which are well-known in the field and will not be elaborated upon here.

[0054] In this embodiment, after completing the aforementioned dynamic adjustment of the discrete scheduling cycle for each terminal, if multiple heterogeneous terminals suspected of being abnormal within a local area network simultaneously reduce their sleep intervals and report data at high frequency, there is a risk of overloading the concurrent processing resources within the edge concentrator and causing microprocessor task congestion. Therefore, the edge concentrator, through its internal information processing module, performs centralized service token arbitration scheduling at the application layer, transforming multiple concurrent asynchronous data requests into an ordered time-division multiplexing processing mechanism. Specifically, this includes the following steps: Before executing signaling scheduling, the edge concentrator (S305) extracts the comprehensive risk index corresponding to each node to be accessed in the communication queue through the information processing module. This is related to discrete scheduling cycles. Simultaneously, it parses low-level messages to obtain the current remaining battery power of battery-powered water and gas meters. For electricity meters directly supplied by the mains, the system sets their power status to a full-capacity constant in memory. Additionally, an internal timer records the waiting time of each node in the communication queue. .

[0055] S306, To balance the urgency of anomalies with physical constraints, the information processing module calculates a dynamic priority score for all nodes to be connected. Preferably, the specific formula for calculating the score is as follows: ; In the formula, This indicates the dynamic priority score of each node to be connected; This represents the overall risk index; This indicates the waiting time since the last successful data interaction between the nodes to be connected. This represents the target scheduling period allocated to this node; the ratio of the two. Used to measure the urgency of a node approaching its scheduling cycle; Indicates the current remaining battery power; This indicates the battery's rated full-load capacity; for electricity meters, the ratio... Set the value to 1, so that the result of this term is 0; These represent the preset risk weight, timeout weight, and battery power weight, respectively. To maintain the numerical convergence of the scoring system across different scenarios, the sum of these three weight coefficients is strictly limited to 1; the above... This calculation result represents the ratio of consumed power based on the battery's full-load capacity. In actual engineering configurations, risk weighting is typically used. Configured to 0.5 to 0.7, the remaining weight quota is evenly distributed. and (For example, take values ​​from 0.15 to 0.25 respectively), so as to ensure the priority response of anomaly detection while taking into account the timeliness of the overall network and the energy consumption balance of the devices.

[0056] S307, After completing the score calculation, the information processing module scores according to dynamic priority. The values ​​are sorted in descending order to construct a dynamic arbitration queue. The edge concentrator then issues media access control tokens to the corresponding nodes to be accessed in sequence according to this queue. The node that obtains the token exclusively occupies the channel within its allocated time slice and performs out-of-band data upload operations.

[0057] S308, after data interaction is completed, the node waiting to access actively releases the token. The edge concentrator then stores the node's waiting time in memory. The token is cleared to zero, thus lowering its ranking in the next round of arbitration and preventing low-priority nodes from falling into communication starvation. If the target node to which the token was issued does not reply with an acknowledgment handshake frame within a preset response time threshold, the system triggers a timeout reclamation mechanism, forcibly reclaiming the current time slot and transferring scheduling rights to the next-priority node. It should be noted that the underlying time slot allocation algorithm based on token passing and the corresponding conflict avoidance and retransmission mechanism can be implemented by those skilled in the art by referring to existing LAN media access control standards and specifications, which are well-known technologies in the field and will not be elaborated further here.

[0058] In this embodiment, due to the inherent differences in the underlying communication methods and sleep mechanisms of the multi-source heterogeneous terminals under the edge concentrator, and the varying queuing times experienced in the aforementioned token arbitration mechanism, the actual arrival time of out-of-band data reported by each node waiting to access the network typically exhibits asynchronous time misalignment. Therefore, the edge concentrator introduces an asynchronous time offset error extraction mechanism through its information processing module. This mechanism extracts the underlying clock offset by stripping away legitimate scheduling and transmission delays, serving as a dynamic factor for subsequent tamper-proof hash calculations. Specifically, this includes the following steps: S401, after the edge concentrator receives out-of-band data uploaded by each terminal, the information processing module uses its internal high-precision real-time clock to record the... The actual timestamp of the data packets received by the nodes to be connected to the edge side Simultaneously, the current business decision time corresponding to this batch of data is retrieved from memory. And the accumulated waiting time of the node in the token arbitration scheduling. .

[0059] S402, to separate legitimate network scheduling and channel transmission delay, the information processing module calculates the actual received timestamp. At the time of current business judgment The time difference is then obtained. Preferably, the waiting time assigned to the node is further subtracted from this time difference. and preset baseline communication transmission delay The reference communication transmission delay can be obtained through pre-test calibration, and the absolute value of the result can be used to obtain the asynchronous time offset error. .in, This characterizes the standard inherent time consumption of the underlying message in a specific physical medium (such as low-power wireless or power line). The absolute value of the above time difference is taken to obtain the asynchronous time offset error, which is used to characterize the absolute deviation in the time dimension.

[0060] S403, obtain the asynchronous time offset error of each terminal. Then, the information processing module extracts the preset physical bias tolerance. Perform boundary comparison verification. This physical bias tolerance... The value is determined by a combination of the channel transmission jitter margin of the communication network and the maximum allowable drift of the terminal crystal oscillator within two time synchronization cycles. This drift reflects the clock drift characteristics of the terminal. In practical engineering applications, its typical value range is configured to be 200 to 500 milliseconds.

[0061] S404, if the asynchronous time offset error is obtained through comparison Less than or equal to physical bias tolerance The information processing module encapsulates the error value in an array in memory, preparing it as a dynamic encryption salt for subsequent tamper-proof hash calculations. Conversely, if the comparison result exceeds this threshold, the current message is deemed to have a risk of link replay or time logic tampering, and the information processing module directly discards the frame data and triggers a communication link security warning. The basic clock alignment of each node in the distributed system can be accomplished using conventional network time protocols, which are well-known technologies in the field and will not be elaborated upon here.

[0062] In this embodiment, the edge concentrator acquires the data packets from each terminal and their corresponding asynchronous time offset errors. Then, the cross-domain proof-of-confirmation feature code generation mechanism is executed through the information processing module, specifically including the following steps: S405, the information processing module parses the time-verified terminal data packets and extracts the business fields. Addressing the differences in encoding format and data length between the original packets from electricity meters, water meters, and gas meters, the information processing module, based on a pre-defined cross-domain data dictionary, uniformly converts the payloads of each node into standard-length hexadecimal byte streams. At the same time, the device identifier of the corresponding terminal is retrieved from memory. And the business judgment time that triggers this round of processing. .

[0063] S406, to adapt multi-source parameters to the underlying bitstream operations, the information processing module will identify the device. Business Judgment Time Byte stream data And the asynchronous time bias error as a dynamic encrypted salt value The data is uniformly converted into a binary data stream. Preferably, the information processing module concatenates the bit sequences of the above four parameters according to a preset hierarchical arrangement rule to generate a joint bit string. Among them, equipment identification A unique physical media access control address or factory serial number that identifies the terminal device.

[0064] S407, for the generated joint bit string The information processing module extracts the local domain control private key pre-embedded in the security microcontroller unit of the edge concentrator. To perform cryptographic obfuscation. Due to the combined bit string The byte length varies with the business message; the information processing module handles fixed-width domain controller private keys. Perform cyclic translation and copying padding to adjust the total bit width and the combined bit string. Maintain alignment, then combine the aligned private key with the union bit string. Perform a bitwise XOR operation and input the obfuscation result into a preset one-way hash function for mapping calculation, thereby outputting a fixed-width cross-domain secure signature code. Preferably, the one-way hash function can employ the SHA-256 or the Chinese national cryptographic algorithm SM3, which supports collision resistance.

[0065] S408, Information processing module obtains cross-domain certificate verification feature code Then, it is combined with the original byte stream data. The data packet is structured and encapsulated into a secure data packet with digital credentials. This data packet is pushed into the persistent storage queue of the edge concentrator, awaiting subsequent hierarchical local storage and master station synchronization operations. The above hashing operation and data packet construction process are collectively referred to as hash-encrypted encapsulation. The specific iterative structure of the underlying hash function, round function operation, and byte padding rules can be implemented by those skilled in the art based on existing cryptographic security standards and specifications; these are well-known technologies in the field and will not be detailed here.

[0066] In this embodiment, after the edge concentrator acquires the encapsulated evidence data packet, it executes a hierarchical data storage and anti-tampering backup mechanism through the information processing module, specifically including the following steps: S409, the information processing module parses the evidence data packet and extracts the cross-domain evidence feature code. With byte stream data The information processing module assigns local storage levels to data packets based on a preset service frequency dictionary: high-frequency load data generated by electricity meters is marked as warm data and written to the high-frequency refresh queue; low-frequency data generated by water meters and gas meters is marked as cold data and written to the low-frequency archive queue. The underlying storage controller performs differentiated addressing and flash memory wear leveling based on this level marking.

[0067] S410, after the edge concentrator writes the evidence-secured data packet with hierarchical tags into its local non-volatile memory, the information processing module extracts the cross-domain evidence-secured feature code of the data packet. And retrieve the linked index feature value of the previous adjacent data block in local memory. Preferably, the information processing module converts the above two into binary streams and concatenates them, then inputs them into a preset one-way hash function to map and output the current hash. Linked index feature value of local storage blocks If the current data block is an initial data block without a previous adjacent block, the information processing module extracts the preset initial feature constant as a pre-index parameter to participate in the splicing calculation.

[0068] S411, the information processing module monitors the local non-volatile memory's capacity utilization and the time span since the last WAN interaction. When the storage capacity utilization reaches a preset storage water level threshold (typically configured as 75% to 80% of the total capacity), or when the time span reaches a preset backup calibration cycle, the information processing module will combine the current block segment's secure data packet set and the latest generated chained index feature value. Packaged as a system-level backup archive.

[0069] In S412, the edge concentrator encrypts and pushes the system-level backup file to the remote evidence storage platform via the WAN uplink communication link. The remote evidence storage platform receives and decrypts the file, extracting the chained index feature value. The data is continuously compared with the historically stored hash ledger. If the comparison matches, the remote evidence storage platform writes the batch of evidence-secured data packets into the persistent database and issues a storage space release instruction to the edge concentrator; if the comparison fails, the remote evidence storage platform immediately blocks the current communication session and records a data anomaly audit log. The concurrent read / write control mechanism involving the persistent database and the wide area network encryption / decryption transmission protocol can be implemented by those skilled in the art based on existing specifications, and are well-known technologies in the field, so they will not be elaborated here.

[0070] Specific application examples: In a specific application scenario, this system is deployed in a distribution network containing several branch nodes. Taking one of the target monitoring nodes as an example, it is equipped with an electricity meter connected to a continuous AC power supply, a water meter and a gas meter powered by internal batteries and in sleep mode by default, as well as environmental sensors. During system initialization, the basic polling cycle is set to 60 minutes.

[0071] During the set monitoring period (e.g., T1 to T2), neither the water meter nor the gas meter generated pulse equivalent exceeding the limit, thus not triggering wireless communication wake-up. The edge concentrator directly accesses historical data from its first and second virtual mapping nodes through the asynchronous device shadow buffer, maintaining the flow rate status at a low baseline value. Simultaneously, environmental sensor 50 continuously reports environmental parameters at 15-minute intervals, recording a continuous upward gradient in the local ambient temperature at that node.

[0072] When the local timer reaches its 60-minute basic polling cycle, the edge concentrator obtains the instantaneous active power returned by the electricity meter. After time axis interpolation and alignment by the information processing module, it is calculated that the ambient temperature of the target monitoring node exhibits a high-energy-consuming characteristic of rising, but the instantaneous active power of the electricity meter is only 50W, and there is no physically coupled load increase.

[0073] See attached document Figure 3 The system calculates the real-time deviation across services (corresponding to) based on the observed data matrix at this time. Figure 3 The left vertical axis is a solid circular curve representing the real-time deviation trend. This occurs at the 1st to 9th business decision discrete time steps (corresponding to...). Figure 3 The deviation remains stable on the horizontal axis; however, at the 10th business decision discrete time step, the real-time deviation value across businesses suddenly increases (approximately 4.5), exceeding the preset static deviation threshold (set to 3.0) shown by the dashed line in the figure. At this point, the edge concentrator generates and suspends an out-of-band anomaly confirmation signal in memory.

[0074] The edge concentrator performs a topology tolerance comparison. The system reads the total output active power collected by the intelligent monitoring device at the main incoming line of the distribution transformer and subtracts it from the sum of the active power of each branch energy meter within the distribution area. The obtained topology conservation residual reaches 5% of the total output, exceeding the preset 3% topology tolerance margin. This result eliminates local statistical misjudgments (such as legitimate energy consumption surges or sensor temperature drift) from the perspective of physical line loss. The edge concentrator then releases the suspended state of the abnormal signal, confirming that there is a real anomaly at the node.

[0075] Continue to refer to the appendix Figure 3For nodes with confirmed anomalies, the edge concentrator executes an adaptive frequency mapping mechanism. As shown by the hollow square curve of the right vertical axis and the downlink communication scheduling cycle in the figure, after confirming the anomaly at the 10th time step, the system's discrete target polling cycle immediately undergoes a step change, dynamically mapping down from the conventional 60-minute interval to a 30-minute interval, and prioritizing the allocation of communication tokens to this node in the downlink network. When receiving high-frequency power sampling data at a frequency of 30 minutes, the information processing module extracts the asynchronous time offset error (e.g., 125 milliseconds) after stripping the standard communication delay. Finally, this 125 milliseconds is used as a dynamic encryption salt value, combined with the device's physical MAC address and high-frequency power sampling data, input into a one-way hash function to generate a cross-domain evidence-based feature code, which is then encapsulated into an evidence-based data packet and sent to the evidence storage platform for persistent backup storage.

[0076] Experimental verification and effect comparison: To verify the engineering effectiveness of the proposed method for monitoring and recording abnormal electricity consumption in an energy meter, a 30-day comparative test was conducted in a real low-voltage distribution area under the jurisdiction of a municipal power supply bureau.

[0077] Test environment: Select a mixed area containing 200 multi-source heterogeneous terminals (electricity, water, gas meters and environmental sensors).

[0078] Test Sample: During the test period, engineers randomly injected 20 simulated abnormal power consumption events (including bypass wiring, series resistors in metering circuits, etc.) at different nodes, while recording the legal load changes that occurred naturally in the transformer area and the occasional drift data of the sensors.

[0079] Comparison objects: Traditional method group: alarms are triggered only based on the over-limit of source current / power threshold of the power meter, using a fixed polling cycle of 60 minutes.

[0080] This invention group enables multidimensional feature covariance analysis, spatial topology residual verification, and adaptive dynamic polling mechanism based on asynchronous device shadows.

[0081] Total Detection Rate (TPR) 75.0% (5 cases were missed) 95.0% (1 instance was missed) False alarm rate (FPR) 16.5% 1.5% Anomaly confirmation response delay Average 60 minutes Average 15 minutes Additional wake-up rate of hibernation meters 0% (No linkage) 0% (read based on local shadow cache) The experimental data are summarized below: See attached document Figure 4 The performance comparison bar chart shows two test groups: traditional single-source fixed-frequency monitoring and the multi-dimensional collaborative monitoring of this invention. The horizontal axis represents the two groups, while the vertical axis corresponds to the percentage indicators for each item. Based on the test results shown in the chart, we can conclude that: Regarding the total rate of anomaly detection (TPR), the multi-dimensional collaborative monitoring group of this invention achieves 95.0%, which is an improvement compared to the 75.0% of the traditional single-source fixed-frequency monitoring group. This result verifies that the system incorporates multi-source heterogeneous parameters such as water, air, and ambient temperature and calculates the cross-service covariance matrix.

[0082] Regarding the false alarm rate (FPR), the multi-dimensional collaborative monitoring group of this invention reduced it to 1.5%, lower than the 16.5% of the traditional group. This difference reflects the engineering effectiveness of the topology conservation residual verification mechanism, which eliminates statistical biases (such as legitimate load mutations) that do not occur in the actual physical line loss, thereby reducing the false alarm rate.

[0083] In addition, except for Figure 4 In addition to the accuracy metrics shown, the experimental data from the distribution area also demonstrates that the dynamic target polling mechanism of this invention reduces the anomaly confirmation response delay from a fixed 60 minutes to less than 15 minutes; and throughout the entire monitoring period, based on the asynchronous device shadow cache reading mechanism, no additional radio frequency wake-up power consumption is triggered for water meters and gas meters in the distribution area that rely on battery sleep power.

Claims

1. A method for monitoring and recording abnormal electricity consumption in an electricity meter, characterized in that, When applied to an edge concentrator, the following steps are included: Receive polling data from the electricity meter and physical parameter data including branch electricity parameters, and flow rate parameters from the water meter and gas meter; The low-frequency wake-up state of the water meter and the gas meter is maintained in the asynchronous device shadow buffer using the flow rate parameter; The polling data and the low-frequency wake-up status quantity are time-axis interpolated and aligned. The cross-service covariance matrix of the aligned data is calculated. The real-time deviation and deviation gradient are calculated based on the cross-service covariance matrix. When both the real-time deviation and the deviation gradient meet the preset abnormal conditions, a topology verification command is triggered and the total output power of the intelligent monitoring device is obtained. The branch physical line loss is compared with the branch power parameters to generate an out-of-band anomaly confirmation signal. In response to the out-of-band anomaly confirmation signal, the target polling period of the energy meter is adaptively shortened, and high-frequency energy sampling data is acquired; Based on the communication scheduling delay and the actual received timestamp, the asynchronous time offset error is extracted and used as a dynamic encryption salt value to perform hash encryption encapsulation on the high-frequency power sampling data, generating a cross-domain solid-state feature code.

2. The method for monitoring and recording abnormal electricity consumption of an electricity meter according to claim 1, characterized in that, The method of maintaining the low-frequency wake-up state of the water meter and the gas meter in the asynchronous device shadow buffer using the flow rate parameter includes: Receive the flow rate parameters and corresponding physical timestamps reported by the water meter and the gas meter in the communication wake-up state; A shadow cache area for the asynchronous device is constructed in the memory address space, and corresponding virtual mapping nodes are constructed for the water meter and the gas meter in the shadow cache area. The received flow rate parameter and the corresponding physical timestamp are used to perform a memory overwrite operation on the virtual mapping node, and the low-frequency wake-up state is maintained locally without actively waking up the water meter and the gas meter.

3. The method for monitoring and recording abnormal electricity consumption of an electricity meter according to claim 1, characterized in that, The step of aligning the polling data with the low-frequency wake-up state data via time axis interpolation includes: Using the active polling time series of the energy meter as a reference, the continuous physical time is discretized into business judgment moments with fixed step sizes to establish a synchronous reference time axis. Using zero-order hold logic, the flow rate parameters of the water meter and the gas meter in the low-frequency wake-up state quantity within the reliable time limit are extracted and interpolated to be mapped to the synchronous flow rate parameters at the current business determination time. The method further includes: The system receives environmental parameters reported by environmental sensors, scales and corrects the synchronous flow velocity parameters by combining them with a pre-stored fluid temperature compensation coefficient, and then concatenates the corrected synchronous flow velocity parameters with the instantaneous active power in the polling data of the energy meter to construct a multi-dimensional synchronous state column vector.

4. The method for monitoring and recording abnormal electricity consumption of an electricity meter according to claim 3, characterized in that, The calculation of the cross-service covariance matrix of the aligned data, and the calculation of the real-time deviation and deviation gradient based on the cross-service covariance matrix, include: The multiple continuously generated multidimensional synchronous state column vectors are sequentially stored into a sliding time window to construct an observation data matrix. The sample deviation matrix of the observation data matrix is ​​calculated and summed. The summation result is divided by the sample degrees of freedom to generate the cross-service covariance matrix. Based on the latest multidimensional synchronization state column vector, the mean vector within the sliding time window, and the inverse matrix of the cross-service covariance matrix, the real-time deviation of the current physical state from the multi-energy collaborative baseline distribution is calculated. Calculate the difference between the current real-time deviation and the historical deviation corresponding to the backtracking time step, and obtain the ratio of the difference to the actual time length traversed to obtain the deviation gradient that characterizes the rate of state degradation.

5. The method for monitoring and recording abnormal electricity consumption of an electricity meter according to claim 4, characterized in that, When both the real-time deviation and the deviation gradient meet preset anomaly conditions, a topology verification command is triggered and the total output power of the intelligent monitoring device is obtained. The branch physical line loss is compared with the branch power parameters to generate an out-of-band anomaly confirmation signal, including: When it is determined that the real-time deviation is greater than the static deviation threshold set in advance based on the historical normal state baseline and the deviation gradient is greater than the deviation gradient threshold set in advance based on the system fault tolerance standard, a topology verification command is triggered. In response to the topology verification command, the corresponding local power supply topology diagram is extracted, and the total output power collected by the intelligent monitoring device at the main incoming line of the distribution transformer is obtained; Based on the total output power and the branch active power of adjacent users at the same level included in the branch power parameters, the topology conservation residual is calculated based on Kirchhoff's laws. When the topology conservation residual is greater than the topology tolerance margin set in advance based on the inherent line loss of the line, the out-of-band anomaly confirmation signal is generated and output.

6. The method for monitoring and recording abnormal electricity consumption of an electricity meter according to claim 5, characterized in that, The adaptive shortening of the target polling cycle for the energy meter in response to the out-of-band anomaly confirmation signal includes: The ratio of the real-time deviation to the static deviation threshold and the ratio of the deviation gradient to the deviation gradient threshold are weighted and summed to generate a comprehensive risk index. Based on the negative exponential decay model, the target polling period is calculated according to the comprehensive risk index, and the target polling period is matched downward to the nearest discrete level supported by the hardware, thereby updating and shortening the target polling period of the electricity meter.

7. The method for monitoring and recording abnormal electricity consumption of an electricity meter according to claim 6, characterized in that, The process of shortening the target polling period and acquiring high-frequency power sampling data also includes a token arbitration-based scheduling step: The electricity meter, water meter, and gas meter to be exchanged are designated as nodes to be connected, and a communication queue is constructed. For each node to be accessed, a dynamic priority score is calculated by weighting and summing the comprehensive risk index, the ratio of the waiting time of the node to be accessed in the communication queue to the target polling period, and the ratio of the consumed power calculated based on the full battery load. Based on the dynamic priority score, the nodes to be connected are arranged in descending order to construct a dynamic arbitration queue; According to the dynamic arbitration queue order, medium access control tokens are sequentially sent to the corresponding nodes to be accessed, and the high-frequency power sampling data is obtained in an orderly manner.

8. The method for monitoring and recording abnormal electricity consumption of an electricity meter according to claim 7, characterized in that, The step of extracting asynchronous time offset error based on communication scheduling delay and receiving timestamp, and using the asynchronous time offset error as a dynamic encryption salt value, includes: The actual timestamp of receiving the high-frequency power sampling data is recorded using a local real-time clock. Calculate the time difference between the actual received timestamp and the service determination time, and subtract the waiting time of the node to be accessed in the communication queue and the pre-tested benchmark communication transmission delay from the time difference to obtain the asynchronous time offset error; When the asynchronous time offset error is not greater than the physical offset tolerance set in advance according to the clock drift characteristics, the asynchronous time offset error is arrayed and encapsulated to generate the dynamic encrypted salt value.

9. The method for monitoring and recording abnormal electricity consumption of an electricity meter according to claim 8, characterized in that, The step of using the asynchronous time offset error as a dynamic encryption salt to hash and encrypt the high-frequency power sampling data to generate a cross-domain secure feature code includes: The high-frequency power sampling data is converted into byte stream data, and the terminal device identifier, the service determination time, the byte stream data, and the asynchronous time offset error as the dynamic encryption salt value are sequentially concatenated and spliced ​​to generate a joint bit string; Extract the preset local domain control private key, perform cyclic shifting and copying padding on the local domain control private key to align the total bit width of the local domain control private key with the combined bit string, and perform a bitwise XOR operation with the combined bit string to generate an obfuscated result; The obfuscation result is input into a preset one-way hash function for mapping calculation, and the cross-domain proof feature code is generated as the output.

10. The method for monitoring and recording abnormal electricity consumption of an electricity meter according to claim 9, characterized in that, After generating the cross-domain evidence-based feature code, the process also includes data hierarchical storage and tamper-proof backup steps: The cross-domain evidence-secured feature code and the byte stream data are structured and encapsulated into an evidence-secured data packet; Extract the cross-domain security feature code of the current security data packet, and concatenate and hash the cross-domain security feature code with the chain index feature value of the previous adjacent data block in the local non-volatile memory to generate the chain index feature value of the current block. When the local storage capacity utilization rate reaches the storage level threshold set in advance based on the total capacity of the local non-volatile memory, or when the time span since the last wide area network interaction reaches the backup calibration cycle set in advance based on the data retention specifications, the set of evidence data packets in the current block segment and the latest chain index feature value are encapsulated into a system-level backup file and encrypted and pushed to the remote evidence storage platform for backup.

Images