A fault monitoring system for an electric meter box based on intelligent sensing elements

Abstract

The application discloses a kind of electric meter box fault monitoring systems based on intelligent sensing element, comprising: data acquisition pre-processing module, acquisition multivariate sensor data, generate node feature set;MixHop network construction module, generate comprehensive node embedding set;Dynamic anomaly evaluation module, generate node anomaly probability matrix using COPOD algorithm;Local anomaly cluster identification module, probability weighted clustering anomaly node, generate anomaly cluster set and index table;Abnormal evolution analysis module, construct intra-cluster anomaly time series, generate cluster-level anomaly evolution sequence;Historical information coding module, integrate node anomaly and cluster-level anomaly evolution sequence, generate historical embedding matrix;Abnormal aggregation analysis module, integrate historical embedding matrix and cluster index table, generate file and dynamic graph.The application combines improved MixHop network and COPOD algorithm, realizes the dynamic monitoring and abnormal evolution analysis of electric meter box node fault.

Description

Technical Field

[0001] This invention relates to the field of intelligent power equipment sensing and anomaly detection technology, and in particular to a fault monitoring system for meter boxes based on intelligent sensing elements. Background Technology

[0002] Existing meter box monitoring systems largely rely on manual inspections or single sensors to collect node status data, including voltage, current, and switch status, and judge anomalies based on fixed thresholds or rules. Some systems have introduced remote monitoring or basic multi-node acquisition platforms, but data processing mainly relies on statistical methods or simple logic, lacking modeling of topological relationships and time-series characteristics between nodes. This results in anomaly identification being mostly local judgment, failing to reflect the overall correlation and dynamic evolution of node status. When dealing with large-scale nodes or complex topologies, clustered anomaly patterns are difficult to capture accurately. When node status fluctuates rapidly or sudden anomalies occur, the system response is lagging, leading to significant missed detections and false positives. Furthermore, there is a lack of predictive capabilities for potential faults, and no systematic analysis of historical anomaly trends or inter-node correlation information is provided. Existing solutions also have shortcomings in anomaly information integration and visualization, often only providing single-node or local node status data, failing to systematically display cluster-level anomaly evolution and time-series characteristics, making it difficult for maintenance personnel to intuitively judge anomaly development trends.

[0003] Traditional anomaly detection methods typically rely on single indicators or static thresholds, making it difficult to handle the multi-dimensional coupled characteristics present in meter box operation, such as node load fluctuations, instantaneous current anomalies, and local environmental interference. In time series evolution analysis, most existing systems lack systematic coding of historical node states and cluster-level anomaly patterns, making it impossible to distinguish between short-term sudden anomalies and long-term drift trends. Some solutions attempt to introduce deep learning models for node feature extraction or anomaly scoring, but these are mostly direct applications of general models, lacking optimized design for meter box node topology characteristics, local extremum information, and time evolution characteristics. This prevents comprehensive analysis of node neighborhood information, multi-level embeddings, and anomaly evolution sequences, resulting in delayed anomaly response, inaccurate trend analysis, and incomplete presentation of anomaly cluster information. This limits the system's robustness and decision support capabilities under complex power grid operating conditions.

[0004] Therefore, how to provide a fault monitoring system for electric meter boxes based on intelligent sensing elements is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a fault monitoring system for electricity meter boxes based on intelligent sensing elements. This invention comprehensively utilizes multi-sensor data acquisition, graph-structured deep learning networks, and adaptive anomaly detection algorithms. By improving the MixHop network, it achieves embedding of multi-order neighbor features and local extremum mapping for each node in the meter box. It also combines a time-evolutionary serialization method to extract dynamic features of nodes, improves the COPOD algorithm, and uses dynamic time window distribution adaptation and multi-view embedding combined with Copula anomaly scoring to accurately calculate the probability of node anomalies. It constructs anomaly clusters and analyzes the evolution trend of cluster-level anomalies. Simultaneously, it performs multi-source fusion encoding of node and cluster-level anomaly information to form historical embeddings. Through anomaly aggregation analysis, it generates structured anomaly information archives and dynamic graphical reports. This system possesses advantages such as high anomaly detection accuracy, sensitivity to both short-term sudden and long-term drifting anomalies, rapid dynamic response, complete historical trend analysis, and strong system adaptability.

[0006] A fault monitoring system for an electric meter box based on a smart sensing element, according to an embodiment of the present invention, includes:

[0007] The data acquisition and preprocessing module collects multi-sensor data from each node of the meter box, preprocesses the collected data, and generates a standardized set of node features.

[0008] The MixHop network construction module inputs the normalized node feature set into the improved MixHop network, performs alternating order neighbor embedding iteration, generates a multi-order node embedding vector set, calculates the feature extrema of the node in the local neighborhood based on the multi-order node embedding vector, forms a local abnormal feature vector set, and performs time evolution serialization on the local abnormal feature vector set to generate a comprehensive node embedding set.

[0009] The dynamic anomaly assessment module inputs the comprehensive node embedding set into the COPOD algorithm, and uses the dynamic time window distribution adaptive and multi-view embedding joint Copula anomaly scoring method to generate a node anomaly probability matrix.

[0010] The local anomaly cluster identification module performs probability-weighted clustering of anomaly nodes based on the node anomaly probability matrix, and adaptively adjusts the cluster radius according to the anomaly distribution of nodes within the cluster to form an anomaly cluster set and generate an anomaly cluster index table.

[0011] The anomaly evolution analysis module constructs a time series of node anomalies within a cluster based on the set of anomaly clusters and the set of embedded nodes, performs dynamic evolution analysis on the anomaly clusters, calculates the anomaly propagation sequence by combining the adjacency relationship between clusters, and generates a cluster-level anomaly evolution sequence.

[0012] The historical information encoding module performs multi-source fusion encoding on the node anomaly probability matrix and the cluster-level anomaly evolution sequence, and generates a multi-dimensional historical embedding matrix through adaptive feature compression.

[0013] The anomaly aggregation analysis module integrates the multidimensional historical embedding matrix and the anomaly cluster index table to generate a structured anomaly information archive, performs aggregation analysis on anomaly clusters, and generates dynamic graphical reports.

[0014] Optionally, generating the normalized node feature set includes:

[0015] Collect multi-sensor data from each node of the meter box, including power consumption, voltage, current and temperature, and record the node number and timestamp;

[0016] The multi-sensor data is preprocessed, including outlier removal, missing value imputation, and noise filtering, to obtain the preprocessed original node data set.

[0017] The preprocessed original node data set is normalized, including linear normalization and standardization of numerical data and encoding of discrete state data, to obtain an initial normalized node feature set.

[0018] The standardized node feature set is sorted according to node number and collection time order to form a node time series index table;

[0019] The data in the node time series index table is subjected to feature dimension compression, and a low-dimensional node feature set is generated by using the singular value decomposition method.

[0020] Organize the low-dimensional node feature set to form the final normalized node feature set.

[0021] Optionally, generating the comprehensive node embedding set includes:

[0022] An improved MixHop network is constructed, which includes an alternating neighbor embedding layer, a local extremum mapping layer, and a temporal evolution serialization layer. The weights, biases, and adjacency matrices of the improved MixHop network layers are initialized.

[0023] The alternating order neighbor embedding layer receives a normalized set of node features, aggregates features for each node within different order neighbor ranges, calculates node embedding vectors using alternating order weighted convolution, encodes local-global difference features in each order node embedding vector, and fuses multi-order embeddings through nonlinear mapping to generate a set of multi-order node embedding vectors.

[0024] The local extremum mapping layer receives a set of multi-order node embedding vectors, calculates the feature extremum of each node in the local neighborhood, generates a local extremum mapping vector and adaptively adjusts it according to the statistical distribution of the local neighbor embedding vectors, and fuses the local extremum mapping vector with the multi-order node embedding vector to form a set of local anomaly feature vectors.

[0025] The temporal evolution serialization layer receives a set of local anomaly feature vectors, performs serialization processing on the node embeddings and local anomaly features of continuous time steps, applies attenuation weights to the node embeddings of historical time steps during the serialization process, and adaptively compresses low information density node embeddings and enhances high information density node embeddings according to the node embedding information density, generating a comprehensive node embedding set.

[0026] The improved MixHop network was trained by using the prediction error between the integrated node embedding set and the historical anomaly label, as well as the combination of the multi-order neighbor embedding consistency error, as the joint optimization objective. The weights of the alternating order neighbor embedding layer, the local extremum mapping layer, and the temporal evolution serialization layer were continuously updated. When the change in the joint loss value in five consecutive training rounds was less than 0.001, the improved MixHop network was considered to have completed convergence training.

[0027] Optionally, the generation of the node anomaly probability matrix includes:

[0028] Based on the comprehensive node embedding set, the node embedding vectors are arranged according to node number and time step to form a node feature matrix;

[0029] A dynamic sliding time window is constructed. For the continuous time step data of each node in the node feature matrix, the empirical cumulative distribution function is calculated in each window to generate the node feature anomaly probability. The window length is adaptively adjusted according to the changes of node features in the time window.

[0030] Multi-view embedding calculation is performed on the node feature matrix within each time window, the node embedding is mapped to multiple view spaces, the node anomaly score is jointly calculated based on the features of each view, and the anomaly probability of each time step within the time window is accumulated and smoothed to form a multi-view joint anomaly score matrix.

[0031] The node feature anomaly probability is fused with the multi-view joint anomaly scoring matrix. During the fusion process, the adaptive adjustment of the anomaly score over time to short-term bursts and long-term drifts is considered. The Copula method is used to generate the node anomaly probability matrix.

[0032] The node anomaly probability matrix is ​​normalized and arranged according to node number and time step order to form the final node anomaly probability matrix.

[0033] Optionally, generating the abnormal cluster index table includes:

[0034] Based on the node anomaly probability matrix, the anomaly probability of each node at each time step is arranged by node number and time order. An anomaly node set is selected according to the anomaly probability threshold, and the neighbor node number and time step information of each anomaly node are recorded.

[0035] The set of anomalous nodes is clustered in the node adjacency topology, and the similarity between nodes is calculated using probability-weighted Euclidean distance to form a preliminary set of anomalous clusters. Each anomalous cluster contains a list of nodes, the cluster center node, and the anomalous probability statistics of the nodes within the cluster.

[0036] An intra-cluster distribution analysis is performed on the preliminary set of anomalous clusters. The cluster radius is adaptively adjusted based on the probability distribution characteristics of nodes within the cluster. An adjustment factor is calculated using the intra-cluster anomalous intensity and node density to generate the final set of anomalous clusters. The radius, number of nodes, cluster center feature vector, mean and variance of intra-cluster anomalous probability are recorded for each cluster.

[0037] The final set of abnormal clusters is organized, and an abnormal cluster index table is generated. The index table records the cluster number, cluster center node number, cluster radius, list of node numbers within the cluster, cluster time span, and statistical information on the probability of abnormality within the cluster for each abnormal cluster.

[0038] Optionally, generating the cluster-level anomalous evolution sequence includes:

[0039] Receive the set of abnormal clusters and the set of embedded nodes. Organize the abnormal probabilities of nodes in each abnormal cluster at consecutive time steps to form a time series of abnormal probabilities of nodes in the cluster, and record the node number and time step index information.

[0040] Based on the time series of node anomaly probabilities within the cluster, the node anomaly change rate and anomaly trend vector are calculated, including the probability difference, average change rate and standard deviation of each node at consecutive time steps, to generate a set of node anomaly evolution vectors.

[0041] Based on the topological adjacency relationship between anomalous clusters, an anomalous propagation sequence between clusters is constructed, and the node anomalous evolution vector is mapped to the cluster-level anomalous evolution sequence. During the mapping process, the anomalous correlation coefficient between clusters is calculated.

[0042] The cluster-level anomaly evolution sequence is integrated in the time dimension to calculate the dynamic changes of the anomaly distribution within the cluster over time, including the anomaly probability of the cluster center, the anomaly variance of the nodes within the cluster, and the anomaly distribution trend, and to generate a cluster-level anomaly evolution pattern vector.

[0043] Organize the cluster-level anomaly evolution pattern vectors, node numbers, and cluster number information to generate a cluster-level anomaly evolution sequence, including the time step sequence of each cluster, the anomaly distribution characteristics of nodes within the cluster, and the anomaly propagation information between clusters.

[0044] Optionally, generating the multidimensional history embedding matrix includes:

[0045] Receive the node anomaly probability matrix and cluster-level anomaly evolution sequence, and organize the anomaly probability and cluster-level evolution characteristics of each node at each time step according to the node number and cluster number to form a multi-source anomaly information set.

[0046] Multidimensional encoding processing is performed on the multi-source anomaly information set. The node anomaly probability, cluster-level anomaly evolution pattern vector and node topology information are combined to form a tensor structure. Each dimension in the tensor is standardized to generate a preliminary historical embedding matrix.

[0047] Adaptive feature compression is performed on the initial historical embedding matrix, singular value decomposition is performed, the main feature dimension is selected, and a low-dimensional historical embedding matrix is ​​generated.

[0048] The low-dimensional historical embedding matrix is ​​processed by multi-view encoding, including encoding anomalous evolution patterns by time dimension and cluster dimension respectively. The encoding results are then spliced ​​and normalized to generate a multi-dimensional historical embedding matrix.

[0049] Optionally, generating a dynamic graphical report includes:

[0050] Receive the multidimensional historical embedding matrix and the abnormal cluster index table, and organize the abnormal evolution features corresponding to each node and cluster in the multidimensional historical embedding matrix according to the node number and cluster number to form an aggregated information set;

[0051] The aggregated information set is structured and integrated to combine node anomaly evolution characteristics, cluster-level anomaly evolution patterns, and intra-cluster statistical information into a hierarchical data structure, generating a preliminary anomaly aggregation matrix.

[0052] Perform inter-cluster aggregation analysis on the preliminary anomaly aggregation matrix to calculate the anomaly similarity, anomaly density, and anomaly propagation relationship between clusters, forming a cluster-level anomaly aggregation feature matrix;

[0053] Multidimensional feature encoding and normalization are performed on the cluster-level anomaly aggregation feature matrix, including encoding the anomaly pattern by time dimension and cluster dimension respectively, and concatenating the encoding results to generate a multidimensional anomaly aggregation embedding matrix.

[0054] Organize multidimensional anomaly aggregation embedding matrix and anomaly cluster index table, generate structured anomaly information archives, and display dynamic graphical reports showing the changing trends of anomaly clusters and nodes over time.

[0055] The beneficial effects of this invention are:

[0056] This invention establishes an intelligent fault monitoring system for meter box node status by deeply integrating an improved MixHop network with the COPOD anomaly detection algorithm. Compared with traditional methods relying on manual inspection or single threshold judgment, this invention achieves high-dimensional embedding representation and local extremum mapping of multi-order neighbor features of nodes, extracts dynamic features of nodes by combining a time evolution serialization method, and accurately calculates the probability of node anomalies through dynamic time window distribution adaptation and multi-view joint anomaly scoring. This significantly improves the anomaly detection accuracy and sensitivity to short-term sudden and long-term drift anomalies, providing a reliable data foundation for meter box fault identification.

[0057] This invention employs cluster-level anomaly analysis and historical information encoding techniques. It forms anomaly clusters through probabilistic weighted clustering, analyzes the anomaly evolution patterns of nodes within each cluster, and calculates anomaly propagation sequences by combining inter-cluster adjacency relationships. Furthermore, it performs multi-source fusion encoding of node and cluster-level anomaly information to generate a multi-dimensional historical embedding matrix, enabling continuous tracking and dynamic characterization of anomaly evolution trends. Compared to existing technologies, this invention can capture anomaly correlations between nodes and cluster-level evolution patterns, effectively compensating for the shortcomings of traditional systems in analyzing large-scale nodes, complex topologies, and continuous-time evolution, thereby improving the system's fault early warning capabilities and dynamic response speed.

[0058] This invention constructs an anomaly aggregation analysis and dynamic graphical reporting module, integrating a multi-dimensional historical embedding matrix with an anomaly cluster index table to generate a structured anomaly information archive and visualize the anomaly evolution characteristics of nodes and clusters. This design enables maintenance personnel to intuitively understand anomaly distribution, cluster-level evolution, and time-series trends, improving the operability and decision-making efficiency of the monitoring system, while reducing the frequency of manual intervention and the risk of misjudgment. It achieves a comprehensive improvement in the real-time performance, accuracy, and system adaptability of meter box fault monitoring. Attached Figure Description

[0059] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0060] Figure 1 The flowchart is a fault monitoring system for an electric meter box based on intelligent sensing elements proposed in this invention.

[0061] Figure 2 This is a schematic diagram of an improved MixHop network construction module for a fault monitoring system for electric meter boxes based on intelligent sensing elements proposed in this invention.

[0062] Figure 3 This is a schematic diagram of the dynamic anomaly assessment module of an electric meter box fault monitoring system based on intelligent sensing elements proposed in this invention. Detailed Implementation

[0063] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0064] refer to Figure 1 , Figure 2 and Figure 3 A fault monitoring system for electricity meter boxes based on intelligent sensing elements, comprising:

[0065] The data acquisition and preprocessing module collects multi-sensor data from each node of the meter box, preprocesses the collected data, and generates a standardized set of node features.

[0066] The MixHop network construction module inputs the normalized node feature set into the improved MixHop network, performs alternating order neighbor embedding iteration, generates a multi-order node embedding vector set, calculates the feature extrema of the node in the local neighborhood based on the multi-order node embedding vector, forms a local abnormal feature vector set, and performs time evolution serialization on the local abnormal feature vector set to generate a comprehensive node embedding set.

[0067] The dynamic anomaly assessment module inputs the comprehensive node embedding set into the COPOD algorithm, and uses the dynamic time window distribution adaptive and multi-view embedding joint Copula anomaly scoring method to generate a node anomaly probability matrix.

[0068] The local anomaly cluster identification module performs probability-weighted clustering of anomaly nodes based on the node anomaly probability matrix, and adaptively adjusts the cluster radius according to the anomaly distribution of nodes within the cluster to form an anomaly cluster set and generate an anomaly cluster index table.

[0069] The anomaly evolution analysis module constructs a time series of node anomalies within a cluster based on the set of anomaly clusters and the set of embedded nodes, performs dynamic evolution analysis on the anomaly clusters, calculates the anomaly propagation sequence by combining the adjacency relationship between clusters, and generates a cluster-level anomaly evolution sequence.

[0070] The historical information encoding module performs multi-source fusion encoding on the node anomaly probability matrix and the cluster-level anomaly evolution sequence, and generates a multi-dimensional historical embedding matrix through adaptive feature compression.

[0071] The anomaly aggregation analysis module integrates the multidimensional historical embedding matrix and the anomaly cluster index table to generate a structured anomaly information archive, performs aggregation analysis on anomaly clusters, and generates dynamic graphical reports.

[0072] In this embodiment, generating a normalized node feature set includes:

[0073] Collect multi-sensor data from each node of the meter box, including power consumption, voltage, current and temperature, and record the node number and timestamp;

[0074] The multi-sensor data is preprocessed, including outlier removal, missing value imputation, and noise filtering, to obtain the preprocessed original node data set;

[0075] The preprocessed original node data set is normalized, including linear normalization and standardization of numerical data and encoding of discrete state data, to obtain an initial normalized node feature set.

[0076] The standardized node feature set is sorted according to node number and collection time order to form a node time series index table;

[0077] The data in the node time series index table undergoes feature dimension compression, and a low-dimensional node feature set is generated using singular value decomposition, where:

[0078] The singular value decomposition method is used to generate a low-dimensional node feature set, specifically:

[0079] The node time series index table is organized into a node feature matrix, with each row corresponding to the node number and each column corresponding to the normalized feature value of the time step.

[0080] Perform singular value decomposition on the node feature matrix, that is, decompose the matrix into a left singular vector matrix, a singular value diagonal matrix, and a right singular vector matrix. In the left singular vector matrix, the rows correspond to the node numbers and the columns correspond to the singular vector numbers. The square of the i-th diagonal element of the singular value diagonal matrix is ​​the proportion of the sum of the squares of all diagonal elements, which represents the variance contribution rate of the corresponding feature vector. The columns of the right singular vector matrix correspond to the time steps and the rows correspond to the singular vector numbers.

[0081] The top 5 to 10 eigenvectors are selected based on the cumulative variance contribution rate of the singular values. The cumulative variance contribution rate of the selected eigenvectors is not less than 95%. The 5 to 10-dimensional low-dimensional node eigenvectors of each node are generated through the selected eigenvectors.

[0082] Arrange the low-dimensional feature vectors of all nodes in order of node number and time step to form a low-dimensional node feature set, and record the variance contribution rate corresponding to each singular vector;

[0083] Organize the low-dimensional node feature set to form the final normalized node feature set.

[0084] In this embodiment, generating the integrated node embedding set includes:

[0085] An improved MixHop network is constructed, comprising an alternating neighbor embedding layer, a local extremum mapping layer, and a temporal evolution serialization layer. The weights, biases, and adjacency matrices of the improved MixHop network layers are initialized, wherein:

[0086] The improved MixHop network is constructed as follows:

[0087] The traditional MixHop network includes a multi-level neighbor embedding layer and an output mapping layer. The standard convolution operation is replaced with alternating-level weighted convolution, and local-global difference features are encoded in each level of embedding. The multi-level embeddings are fused through nonlinear mapping to form an alternating-level neighbor embedding layer. A local extremum mapping layer is added on the basis of the output mapping layer to calculate the local neighborhood feature extrema of the multi-level node embedding vector set. Combined with the local neighborhood node anomaly probability distribution adjustment, the local extremum mapping vector is fused with the multi-level node embedding to form a local anomaly feature vector set. A time evolution serialization layer is added on the basis of the serialization process to serialize the local anomaly feature vector set by continuous time steps. During the serialization process, attenuation weights are applied to the node embeddings of historical time steps. Low-information embeddings are compressed and high-information embeddings are enhanced according to the node embedding information density to form a comprehensive node embedding set. The three layers are connected in sequence and sequentially connected with the original MixHop network modules to form an improved MixHop network.

[0088] Initialize the weights, biases, and adjacency matrices of the improved MixHop network layer as follows:

[0089] The weight matrices of the alternating neighbor embedding layer, the local extremum mapping layer, and the temporal evolution serialization layer are generated using normally distributed random numbers with a mean of 0 and a standard deviation of 0.02, and the bias vector is initialized to 0.

[0090] The adjacency matrix calculates the similarity between nodes based on the low-dimensional node feature set, specifically as follows:

[0091] Suppose that the low-dimensional node feature set has N nodes, each node has d-dimensional features. For any two nodes i and j, calculate the cosine similarity of the feature vectors, which is the dot product divided by the product of the L2 norms of the feature vectors of node i and node j. When the cosine similarity is greater than 0.5, establish corresponding connections in the adjacency relation matrix to form a sparse adjacency matrix, where the rows correspond to the source nodes and the columns correspond to the target nodes. Normalize the non-zero elements in each row.

[0092] The alternating neighbor embedding layers are set to order 1 to 3, each convolutional kernel size is 5×5, the output dimension is 64, the convolutional stride is 1, and zero padding is used for boundary padding.

[0093] The local extremum mapping layer has a local neighborhood of 5 neighboring nodes for each node, and an output dimension of 32.

[0094] The temporal evolution serialization layer receives 10 consecutive time step node embeddings with an embedding dimension of 64. It performs regularization and normalization on the embedding vector of each time step node in the sequence so that the mean of the input distribution is 0 and the variance is 1.

[0095] The alternating-order neighbor embedding layer receives a normalized set of node features, aggregates features for each node across different order neighbor ranges, and calculates node embedding vectors using alternating-order weighted convolution. Local-global difference features are encoded in each order node embedding vector. Multi-order embeddings are fused through nonlinear mapping to generate a multi-order node embedding vector set, where:

[0096] Alternating order neighbor embedding layer includes:

[0097] Neighbor index register array: stores the neighbor number and corresponding time step index of each node within different neighbor order ranges;

[0098] Feature aggregation queue: Caches node feature vectors in neighbor order, supporting parallel reading and accumulation operations;

[0099] Order weight lookup table: provides weight mapping for neighbors of different orders, and is dynamically updated;

[0100] Local-Global Difference Coding Unit: Calculates the difference between local and global features for each embedding vector and generates a difference coding vector;

[0101] Nonlinear Mapping Calculator: Performs nonlinear mappings on multi-order embeddings and differentially encoded vectors;

[0102] Embedded output register: Receives the fused set of multi-level node embedding vectors;

[0103] In the alternating order neighbor embedding layer, the node neighbor number and time step index in the neighbor index register array are sent to the feature aggregation queue for feature accumulation. The aggregated node feature vector and the neighbor order weight provided by the order weight lookup table are input to the local-global difference coding unit to generate a difference coding vector. The difference coding vector and the original order node embedding vector are fed into the nonlinear mapping calculator for nonlinear mapping. The set of multi-order node embedding vectors after mapping is stored in the embedding output register.

[0104] The node embedding vector is calculated using alternating-order weighted convolution, specifically as follows:

[0105] The feature vector of each node in the normalized node feature set is weighted and summed with the feature vectors of its neighbors. Each order of neighbor set corresponds to a weight matrix. Even-order neighbors use an even-order weight matrix, and odd-order neighbors use an odd-order weight matrix.

[0106] The embedding vector of a node at a certain order is equal to the weighted sum of the feature vectors of all its neighbors at the corresponding order and the corresponding weight matrix. The node's own feature vector is added to the embedding vector at the corresponding order through the self-loop weight matrix to form the embedding vector at the corresponding order of the node.

[0107] The embedding vectors of each node are stored in order of node number, with each row corresponding to a node and each column corresponding to a feature dimension;

[0108] Local-global differential features are encoded in the embedding vector of each node, specifically as follows:

[0109] Calculate the Euclidean distance between each node and the other nodes based on the node embedding vector, and form a local neighbor set by the four to six nodes with the smallest distance and the node itself. The number of neighbors changes dynamically with the node degree.

[0110] Collect the order embedding vectors of the node and its neighbors, and calculate the element-wise mean of the order embedding vectors of the local neighbor set to generate the local average feature vector of the node.

[0111] The global average feature vector is generated by taking the element-wise mean of the embedding vectors of all nodes of the same order.

[0112] The local average feature vector of each node is subtracted element-wise from the global average feature vector to obtain the local-global difference feature vector;

[0113] Multi-order embeddings are fused through nonlinear mapping, specifically as follows:

[0114] By fusing multi-order embeddings through nonlinear mapping, the embedding vectors of each order and the corresponding local-global difference feature vectors of each node are processed. Each vector has a dimension of d. A modified linear rectified mapping is performed on each element, setting elements less than zero to zero and keeping the original value of elements greater than zero, to obtain the initial mapping vector.

[0115] Each element of the initial mapping vector is transformed by the hyperbolic tangent function to obtain a quadratic mapping vector with values ​​limited to the interval [-1, 1], thus preserving the characteristic variation trend.

[0116] Perform a logical Sigmoid mapping on each element of the quadratic mapping vector to generate the final mapping vector, with values ​​limited to between 0 and 1.

[0117] For the same node, all final mapping vectors of all orders are summed element by element in order of order to form the node fusion embedding vector;

[0118] Arrange the fused embedding vectors of all nodes according to the node number, with each row corresponding to the node number and each column corresponding to the feature dimension, to generate the final multi-order node embedding vector set.

[0119] The local extremum mapping layer receives a set of multi-order node embedding vectors, calculates the eigenvalues ​​of each node in its local neighborhood, generates a local extremum mapping vector, and adaptively adjusts it according to the statistical distribution of the local neighbor embedding vectors. The local extremum mapping vector is then fused with the multi-order node embedding vectors to form a set of local anomaly feature vectors, where:

[0120] The local extremum mapping layer includes:

[0121] Eigenvalue register array: stores the multi-order embedding vectors of each node and its local neighborhood;

[0122] Neighborhood Node Index Table: Records the neighbor node numbers and corresponding time step information of each node in the local neighborhood;

[0123] Local extremum calculation unit: calculates the maximum value of the node and its neighborhood embedding vector element by element, and generates the local extremum mapping vector of the node at each order;

[0124] Statistical scaling register: Stores the statistical distribution of local neighbor embedding vectors, including local extrema and standard deviation;

[0125] The fusion accumulation queue: The local extremum mapping vector and the node multi-order embedding vector are accumulated element by element to form a set of local anomaly feature vectors of the number of nodes × the feature dimension;

[0126] In the local extremum mapping layer, the data in the feature value register array and the neighborhood node index table are input into the local extremum calculation unit to generate local extremum mapping vectors of each node at each order. The local extremum mapping vectors are adaptively adjusted in the statistical scaling register according to the statistical distribution of the local neighbor embedding vectors. The fusion accumulation queue accumulates the adjusted local extremum mapping vectors with the multi-order embedding vectors of the corresponding nodes element by element to form a set of local anomaly feature vectors of the number of nodes × feature dimension.

[0127] Calculate the eigenvalues ​​of each node in its local neighborhood and generate a local extremum mapping vector, specifically:

[0128] Iterate through each node in the multi-order node embedding vector set. For each order embedding vector, access the local neighbor set of the node according to the node number. Read the corresponding order embedding vector from the local neighbor set. Compare the node's own order embedding vector with the neighbor order embedding vectors element by element according to the feature dimension. Select the maximum value of each dimension to generate the local extremum mapping vector of the node at the corresponding order.

[0129] Each dimension of the local extremum mapping vector corresponds to the feature dimension of the input order embedding vector. The local extremum vectors of all nodes are arranged in order of node number to form a local extremum mapping matrix of node number × feature dimension. The extremum of each order embedding vector is calculated independently, and a complete set of local extremum mapping vectors is generated step by step.

[0130] The local extremum mapping vector is adaptively adjusted based on the statistical distribution of the local neighbor embedding vectors, specifically as follows:

[0131] Iterate through the local extremum mapping vectors of each node at each order, and read the statistical distribution information of the local neighbor embedding vectors corresponding to the node from the statistical scaling register, including the local extrema and standard deviation of each feature dimension;

[0132] The difference between each feature element in the local extremum mapping vector and the local extremum of the same feature dimension is calculated to obtain the extremum deviation.

[0133] The standard deviation coefficient is obtained by dividing the extreme value deviation of each feature dimension by the standard deviation of the corresponding feature dimension. When the standard deviation is zero, the standard deviation coefficient is recorded as 0.

[0134] The corresponding feature elements in the local extremum mapping vector are scaled according to the standardized deviation coefficient. When the standardized deviation coefficient is greater than 1, the corresponding feature element is multiplied by 1 and the result of the standardized deviation coefficient is added. When the standardized deviation coefficient is not greater than 1, the corresponding feature element is multiplied by the standardized deviation coefficient to generate the adjusted feature elements.

[0135] The feature elements after each feature dimension is adjusted are rearranged according to the original feature dimension order to generate an adaptively adjusted local extremum mapping vector.

[0136] The process of repeatedly generating adaptively adjusted local extremum mapping vectors for all nodes and all order embedding vectors is arranged in order of node number and order to form a complete set of adjusted local extremum mapping vectors;

[0137] The local extremum mapping vector is fused with the multi-order node embedding vector, specifically as follows:

[0138] For each order of embedding vector of each node, read the local extremum mapping vector of the corresponding order from the fusion accumulation queue, and add the local extremum mapping vector to the node order embedding vector element by element according to the feature dimension to generate the preliminary fusion vector.

[0139] Normalization is performed on each feature element of the initial fusion vector, mapping the maximum and minimum values ​​in the vector to a fixed interval [0,1]. The normalized vector forms a node-order fusion embedding vector.

[0140] Arrange the fusion embedding vectors of all orders of the same node in order of order, and accumulate them element by element to generate the node fusion embedding vector. Arrange all nodes in order of node number to form a set of local anomaly feature vectors of node number × feature dimension.

[0141] The temporal evolution serialization layer receives a set of local anomaly feature vectors, serializes the node embeddings and local anomaly features of consecutive time steps, applies attenuation weights to the node embeddings of historical time steps during serialization, and adaptively compresses low-information-density node embeddings and enhances high-information-density node embeddings based on the node embedding information density, generating a comprehensive node embedding set, wherein:

[0142] The time-evolutionary serialization layer includes:

[0143] Node embedding register array: stores the local anomaly feature vector of each node at consecutive time steps, with each row corresponding to the node number and each column corresponding to the feature dimension;

[0144] Time step index table: records the time step order information of each node in the sequence;

[0145] Attenuation weight register: stores the attenuation coefficients embedded in historical time step nodes;

[0146] Information density statistics register: stores the feature information density of the node embedding vector at each time step, including mean, variance and feature distribution index;

[0147] Serialization accumulation queue: Receives node embedding vectors in time step order, applies decay weights and information density coefficients to feature elements at each time step, and accumulates them element by element to form a serialized embedding vector;

[0148] In the temporal evolution serialization layer, the local anomaly feature vectors stored in the node embedding register array and the order information in the time step index table are input into the serialization accumulation queue. The decay weight register applies a decay coefficient to the node embedding vectors of historical time steps. The information density statistics register provides adjustment parameters for low information density and high information density node embeddings. The serialization accumulation queue accumulates the vectors processed at each time step element by element and arranges them in the order of node number to finally form a comprehensive node embedding set.

[0149] The node embeddings and local anomaly features at consecutive time steps are serialized, specifically as follows:

[0150] The set of local anomaly feature vectors is arranged into a two-dimensional matrix according to node number and time step order. Each row corresponds to a node, and each column corresponds to the feature dimension of the time step. The number of rows in the two-dimensional matrix is ​​equal to the number of nodes, and the number of columns is equal to the number of time steps multiplied by the feature dimension. The feature vectors of each node are gradually expanded in time order to form a node sequence vector. Each sequence position corresponds to the complete feature vector of a single time step. The sequence length is equal to the number of time steps, and the feature dimension remains consistent with the original vector.

[0151] The sequence vectors of all nodes are concatenated sequentially to generate a serialization matrix of node number × time step length × feature dimension, with each node sequence arranged in order of node number.

[0152] During serialization, the corresponding order of the node's embedding vectors at each order and the local anomaly feature vectors is maintained;

[0153] Apply a decay weight to the historical time step node embedding, specifically:

[0154] Traverse the sequence vector of each node in the serialization matrix. For the eigenvector of the i-th time step of each node, calculate the decay coefficient. The decay coefficient adopts the exponential decay method, that is, multiply the negative value of the natural exponent e by the product of the decay constant and the time step difference. The decay constant is an adjustable parameter, and the time step difference is the current time step index minus the starting time step index of the sequence of that node.

[0155] Multiply the value of each feature dimension of the feature vector at the i-th time step by the corresponding decay coefficient to obtain the decay-weighted feature vector. Perform the same operation on the feature vectors of all time steps in the node sequence vector in turn to form the decay-weighted sequence vector of the node.

[0156] After completing the decay weighting operation for all time steps, the decay weighting sequence vector of each node is rearranged according to the time step order, and all nodes are arranged according to the node number order to generate a decay weighting matrix of node number × time step length × feature dimension.

[0157] Adaptively compress the embedding of low-information-density nodes and enhance the embedding of high-information-density nodes, specifically as follows:

[0158] Iterate through the sequence vectors of each node in the decay weighting matrix, and calculate the information density of the corresponding node's embedding vector, which is the variance of each feature dimension of the corresponding node across all time steps. Specifically:

[0159] The average value of each feature dimension over the entire time series is calculated, then the average value is subtracted from the value at each time step and squared. Finally, the sum of all squared values ​​is divided by the number of time steps.

[0160] Based on information density, feature dimensions with variance below 0.02 are marked as low information density, feature dimensions with variance above 0.05 are marked as high information density, and the remaining feature dimensions remain unchanged;

[0161] For low information density feature dimensions, the feature values ​​of all time steps are compressed by multiplying each element by 0.5; for high information density feature dimensions, the feature values ​​of all time steps are enhanced by multiplying each element by 1.5; and the remaining feature dimensions remain unchanged.

[0162] After compression and enhancement, the time step feature vectors of each node are arranged in chronological order, and all nodes are arranged by node number, generating a comprehensive node embedding set with dimensions of number of nodes × time step length × feature dimension.

[0163] The improved MixHop network was trained using a combination of the prediction error between the integrated node embedding set and historical anomaly labels, and the consistency error of multi-order neighbor embeddings as the joint optimization objective. The weights of the alternating order neighbor embedding layer, the local extremum mapping layer, and the temporal evolution serialization layer were continuously updated. The improved MixHop network was considered to have completed convergence training when the change in the joint loss value over five consecutive training rounds was less than 0.001.

[0164] The improved MixHop network is trained as follows:

[0165] Read the comprehensive node embedding set and corresponding historical anomaly label of each node at each time step in the training sample, input the comprehensive node embedding set into the improved MixHop network, and generate the predicted anomaly probability vector and multi-order embedding consistency vector of each node through alternating neighbor embedding layer, local extremum mapping layer and time evolution serialization layer.

[0166] The node anomaly prediction error is obtained by averaging the squared differences between the predicted anomaly probability vector and the historical anomaly label for each node. The multi-order embedding vector of each node and the neighbor embedding vector are averaged by averaging the squared differences between their elements to obtain the multi-order neighbor embedding consistency error. The node anomaly prediction error is multiplied by 0.6 and the multi-order neighbor embedding consistency error is multiplied by 0.4 and then summed to generate the joint loss value for each batch.

[0167] The gradient is calculated based on the weights and biases of the alternating neighbor embedding layer, local extremum mapping layer, and temporal evolution serialization layer according to the joint loss value. The gradient is multiplied by the learning rate of 0.001 and then subtracted from the current parameter value to update the network parameters. The number of nodes processed in each training batch is 128, the time step length of each node is 30, the feature dimension is 16, and the total number of training rounds is 500. When the change of the joint loss value is less than 0.001 in 5 consecutive training rounds, the improved MixHop network is considered to have completed convergence training.

[0168] In this embodiment, generating the node anomaly probability matrix includes:

[0169] Based on the comprehensive node embedding set, the node embedding vectors are arranged according to node number and time step to form a node feature matrix;

[0170] A dynamic sliding time window is constructed. For each node in the node feature matrix, the empirical cumulative distribution function is calculated within each window to generate the node feature anomaly probability. The window length is adaptively adjusted according to the changes in node features within the time window.

[0171] Constructing a dynamic sliding time window, specifically as follows:

[0172] The node feature matrix is ​​arranged in order of node number and time step, with each row corresponding to the node number and each column corresponding to the time step feature vector;

[0173] The initial sliding time window length is 5 to 10 time steps, and the window step size is fixed at 1 time step;

[0174] The window is moved sequentially on each node sequence, and the feature vectors of the continuous time steps contained in the window are extracted into a temporary window matrix. The size of each temporary window matrix is ​​the window length × feature dimension.

[0175] Maintain a window index table for each node, recording the window start time step index and end time step index;

[0176] When the window moves to the end of the sequence, if the remaining time steps are less than the current window length, the time step features from the previous window are copied to fill the window matrix;

[0177] After all nodes independently generate temporary window matrices, they are arranged according to node number to form a set of sliding window matrices consisting of node number × window length × feature dimension.

[0178] Calculate the empirical cumulative distribution function to generate the node feature anomaly probability, specifically:

[0179] Read the continuous time step feature vectors of each node in the sliding window matrix in sequence. For each feature dimension, calculate the corresponding empirical cumulative distribution function. Sort the feature values ​​of all time steps in the window in ascending order, record the sorting position to generate an index sequence, divide the index by the window length to obtain the cumulative distribution probability value, and arrange them in the order of time steps to form the anomaly probability vector of the corresponding feature dimension.

[0180] The empirical cumulative distribution function is calculated sequentially for each feature dimension within the window. The anomaly probability vector of each feature dimension is combined column by column to generate the anomaly probability matrix of the current node in the corresponding window, with each row corresponding to the time step and each column corresponding to the feature dimension.

[0181] The anomaly probability matrix calculated for each sliding window is accumulated in the order of time steps to form a node sequence anomaly probability matrix. The nodes are arranged in the order of node number and time step to finally generate a node feature anomaly probability matrix of number of nodes × window length × feature dimension.

[0182] Adaptively adjust the window length, specifically as follows:

[0183] Traverse the node sequence anomaly probability matrix of each node. Each node corresponds to a sequence vector, and each sequence position contains the anomaly probability of all feature dimensions of the corresponding time step.

[0184] Sliding windows are constructed sequentially on the node sequence. Each window contains anomaly probability data for consecutive time steps. The initial window length is 5 to 10 time steps, and the window step size is 1 time step.

[0185] For each feature dimension within the current window, sum the anomaly probability values ​​at each time step within the window, divide by the window length, and obtain the average anomaly probability of the corresponding feature dimension within the current window.

[0186] Calculate the anomaly probability range for each feature dimension within the current window, which is the maximum anomaly probability minus the minimum anomaly probability within the window;

[0187] The normalized anomaly variation index is obtained by dividing the range of anomaly probabilities for each feature dimension by the sum of the average anomaly probability and a fixed minimum value e raised to the power of -6.

[0188] The normalized abnormal change index of all feature dimensions within the window is averaged to form the window abnormal change value. When the window abnormal change value is lower than 0.01, the window length is increased by 1. When the window abnormal change value is higher than 0.05, the window length is decreased by 1. The adjustment of the window length is limited to a minimum of 5 time steps and a maximum of 10 time steps.

[0189] After adjusting the window length, regenerate the sliding window matrix of the current node and record the new window start and end time step indices;

[0190] The normalized abnormal change index and the window length adjustment operation are performed sequentially on all windows in the node sequence. After all nodes are completed, a set of sliding window matrices is formed, which is the number of nodes × the adjusted window length × the feature dimension.

[0191] Within each time window, multi-view embedding calculations are performed on the node feature matrix, mapping the node embeddings to multiple view spaces. Anomaly scores for each node are jointly calculated based on the features of each view, and the anomaly probabilities at each time step within the time window are accumulated and smoothed to form a multi-view joint anomaly score matrix, where:

[0192] The multi-view embedding calculation is performed on the node feature matrix, specifically as follows:

[0193] Iterate through the node feature matrix in each sliding window matrix. The feature vector of each node contains several dimensions, corresponding to the data of consecutive time steps.

[0194] Three independent view spaces are established for each node. Each view space corresponds to a set of mapping matrices. The number of rows in each mapping matrix is ​​equal to the node feature vector dimension, and the number of columns is equal to the view space embedding dimension.

[0195] Perform matrix operations on the node feature vectors with the corresponding mapping matrix in each view space to obtain the node's embedding vector in that view space. The length of the embedding vector is equal to the dimension of the view space.

[0196] Normalize the embedding vector for each view space by dividing each element of the vector by the square root of the sum of the squares of all elements in the vector.

[0197] After completing the embedding calculation of all nodes in the three views, three sets of node embedding matrices are obtained. The number of rows in each matrix is ​​the number of nodes, and the number of columns is the embedding dimension of the corresponding view space.

[0198] The node anomaly score is calculated jointly based on the features of each view, specifically as follows:

[0199] Iterate through each node in the sliding window matrix and read the embedding vector of each node in each view space one by one;

[0200] Calculate statistical anomaly indicators for the embedding vector of each view space, including the mean, variance, and range of each element of the vector. Sum the values ​​of each indicator element to generate the node anomaly score vector for that view.

[0201] For each node, the node anomaly score vectors of the three sets of views are summed element by element to obtain the joint anomaly score vector of the node in the current window;

[0202] Normalize the joint anomaly score vector by dividing each element by the sum of the maximum and minimum values ​​of the vector, thus mapping the joint anomaly scores of nodes at different view scales to a uniform numerical range.

[0203] Arrange the joint anomaly score vectors of all nodes in time step order to form a multi-view joint anomaly score matrix consisting of the number of nodes × window length × feature dimension;

[0204] Each sliding window is processed sequentially to obtain the final multi-view joint anomaly score set, which is calculated as the number of nodes × the adjusted window length × the feature dimension.

[0205] Accumulation and smoothing of anomaly probabilities within the time window, specifically:

[0206] Iterate through the multi-view joint anomaly score matrix of each node in each sliding window, and accumulate the joint anomaly score vector corresponding to each time step element by feature dimension to obtain the cumulative joint anomaly score vector of the node in the current window.

[0207] The cumulative joint anomaly score vector is smoothed by using a three-point moving average method. The joint anomaly score vector at the current time step is added element by element with the joint anomaly score vectors at the previous and next time steps according to the feature dimension, and then divided by three. The boundary time steps are supplemented with the value of the nearest available time step to generate a smoothed joint anomaly score vector.

[0208] The above accumulation and smoothing operations are performed sequentially on all nodes within the window to form a smoothed joint anomaly scoring matrix consisting of the number of nodes × the window length × the feature dimension.

[0209] Arrange the nodes in order of node number and time step into a smooth joint anomaly scoring matrix, and generate a multi-view joint anomaly scoring matrix of the final number of nodes × adjusted window length × feature dimension.

[0210] The node anomaly probability is fused with the multi-view joint anomaly scoring matrix. During the fusion process, the adaptive adjustment of anomaly scores over time to short-term bursts and long-term drifts is considered. The Copula method is used to generate the node anomaly probability matrix, where:

[0211] The adaptive adjustment of outlier scores over time to short-term bursts and long-term drift is as follows:

[0212] Traverse the node feature anomaly probability matrix and multi-view joint anomaly scoring matrix by traversing the number of nodes × adjusted window length × feature dimension, and process each node sequentially.

[0213] In each node sequence, a short-term burst adjustment factor is calculated for the anomaly score of the current time step. That is, the anomaly probabilities of the current time step and the two previous time steps are selected, and the ratio of the maximum anomaly probability to the anomaly probability of the current time step is used as the short-term burst adjustment factor.

[0214] The drift adjustment factor is calculated for the long-term drift trend. This involves taking a linear weighted average of the anomaly probabilities of the five time steps prior to the current time step, dividing the anomaly probability of the current time step by the weighted average, and obtaining the long-term drift adjustment factor. If the anomaly probability of the five time steps prior to the current time step is insufficient, the anomaly probability of the starting time step is copied to fill the gap.

[0215] The short-term burst adjustment factor and the long-term drift adjustment factor are multiplied element by element to obtain the adaptive time evolution adjustment coefficient. The node feature anomaly probability and the multi-view joint anomaly score at the current time step are multiplied by the adjustment coefficient to generate the adaptively adjusted time evolution anomaly score.

[0216] During the adaptive computation process, the time evolution anomaly score is clipped to the range of 0.001 to 0.999, and each time step in the node sequence is processed sequentially to form an adaptive time evolution anomaly score matrix of node number × adjusted window length × feature dimension.

[0217] The Copula method is used to generate the node anomaly probability matrix, specifically:

[0218] Traverse each node sequence in the adaptive temporal evolution anomaly score matrix and read the temporal evolution anomaly score of that node at each time step in turn;

[0219] For each time step of the node sequence, the adaptive time evolution anomaly score is mapped to the [0,1] interval through the marginal cumulative distribution function to form a standardized marginal distribution value;

[0220] The standardized marginal distribution values ​​are mapped to the standard normal space, and each value is converted into a standard normal variable through the inverse cumulative distribution function, forming a standard normal variable matrix of the node sequence, with each row corresponding to the time step and each column corresponding to the feature dimension;

[0221] Calculate the Pearson rank correlation coefficient matrix of the node sequence as follows:

[0222] Traverse each pair of feature dimensions in the standard normal variable matrix, sort the time step values ​​of each dimension in ascending order, record the rank values, perform mean-centered processing on the rank values, and subtract the average rank value of that dimension from each rank value;

[0223] Multiply the two columns of centered rank values ​​element by element and sum them, then divide by the product of the square roots of the sum of squares of each column to obtain the Pearson rank correlation coefficients of the corresponding feature dimension pairs. Combine the results of the pairwise calculations of all feature dimensions to generate the Pearson rank correlation coefficient matrix of the node sequence. The number of rows and columns of the matrix is ​​equal to the number of feature dimensions, and the diagonal elements are 1.

[0224] The Pearson rank correlation coefficient matrix is ​​used as the basis for the covariance matrix of the Gaussian Copula, and numerical corrections are performed.

[0225] By inputting the standard normal variables and covariance matrix into the Gaussian Copula cumulative distribution function, the joint cumulative distribution value at each time step is obtained;

[0226] The joint cumulative distribution value is mapped back to the probability space through the inverse function of the standard normal cumulative distribution to obtain the joint anomaly probability of the nodes at each time step;

[0227] Arrange the joint anomaly probabilities of nodes in time step order to form a Copula anomaly probability vector of the node sequence. Process all nodes in sequence to generate a node anomaly probability matrix of number of nodes × adjusted window length × feature dimension. Each row corresponds to the node number, each column corresponds to the feature dimension, and each layer corresponds to the time step.

[0228] The node anomaly probability matrix is ​​normalized and arranged according to node number and time step order to form the final node anomaly probability matrix.

[0229] In this embodiment, generating the abnormal cluster index table includes:

[0230] Based on the node anomaly probability matrix, the anomaly probability of each node at each time step is arranged by node number and time order. Anomaly node sets are then selected according to anomaly probability thresholds. The neighbor node numbers and time step information of each anomaly node are recorded, where:

[0231] The set of abnormal nodes is selected based on an anomaly probability threshold, specifically as follows:

[0232] Traverse the sequence vector of each node in the node anomaly probability matrix, where each sequence position corresponds to the feature dimension anomaly probability of a time step;

[0233] For each time step, the abnormal probability of the feature dimension of the node is compared element by element. If the abnormal probability of any feature dimension is greater than the preset threshold of 0.7, the corresponding node is marked as abnormal at that time step.

[0234] The nodes marked as abnormal and their corresponding time step information are recorded in the abnormal node list in order of node number. Each record contains the node number, time step index and the corresponding feature dimension abnormal probability vector.

[0235] Based on the neighborhood node index table, read the neighbor node number of each abnormal node at this time step, and store the neighbor node number together with the time step information of the abnormal node to form a complete set of abnormal node and neighbor information.

[0236] Process all nodes in the node anomaly probability matrix in sequence to generate an anomaly node set matrix arranged in order of node number and time step. Each row corresponds to the anomaly node number and its neighboring node numbers, and each column corresponds to the time step and feature dimension anomaly probability.

[0237] The set of anomalous nodes is clustered in the node adjacency topology, and the similarity between nodes is calculated using probability-weighted Euclidean distance to form a preliminary set of anomalous clusters. Each anomalous cluster includes a list of nodes, a cluster center node, and anomalous probability statistics for the nodes within the cluster.

[0238] Clustering of the abnormal node set within the node adjacency topology is performed as follows:

[0239] Sort the abnormal nodes in the set according to their abnormal probability, and select the first node in every 10 nodes as the cluster center node;

[0240] Each cluster center node forms a preliminary abnormal cluster, recording the cluster center node number, the list of nodes in the cluster, and the average, maximum, and minimum probabilities of abnormal nodes in the cluster;

[0241] Each initial abnormal cluster contains 1 to 5 nodes, the number of which is determined by the number of abnormal neighboring nodes of the cluster center node;

[0242] Number all preliminary anomaly clusters according to the node numbering order to generate a preliminary anomaly cluster set;

[0243] The similarity between nodes is calculated as follows:

[0244] Iterate through each anomaly cluster in the initial set of anomaly clusters and obtain a list of all nodes within the cluster;

[0245] Read the anomaly probability vector of each pair of nodes in the cluster at the corresponding time step in the set of anomalous nodes. The dimension of the anomaly probability vector is equal to the number of node feature dimensions. Calculate the square of the difference between the two node vectors in each feature dimension and multiply it by the corresponding weight coefficient. Take the square root of the sum of all weighted square values ​​to obtain the probability-weighted Euclidean distance between the nodes. The weight coefficient of each feature dimension is determined according to the variance of the anomaly probability of that feature dimension in the sliding window. Assuming that the total number of feature dimensions of nodes in the cluster is d, the weight of the i-th feature dimension is the variance of that dimension divided by the sum of the variances of all d dimensions.

[0246] The Euclidean distance is converted into a node similarity value using a linear mapping method: the node similarity is equal to the maximum Euclidean distance within the cluster minus the Euclidean distance of the current node pair, divided by the difference between the maximum and minimum Euclidean distances within the cluster, to obtain a normalized node similarity value, ranging from 0 to 1.

[0247] The calculated similarity of each pair of nodes is recorded in the intra-cluster node similarity matrix, with the row and column indices corresponding to the node numbers. The similarity is calculated for each pair of nodes in the cluster to generate the complete intra-cluster node similarity matrix.

[0248] An intra-cluster distribution analysis is performed on the initial set of anomalous clusters. The cluster radius is adaptively adjusted based on the anomalous probability distribution characteristics of nodes within the cluster. An adjustment factor is calculated using the intra-cluster anomaly intensity and node density to generate the final set of anomalous clusters. The radius, number of nodes, cluster center feature vector, and mean and variance of the intra-cluster anomaly probability are recorded for each cluster. Among these:

[0249] Adaptive adjustment of cluster radius, specifically:

[0250] Traverse each anomalous cluster in the initial set of anomalous clusters, and read the anomalous probability vector and corresponding feature vector of all nodes in the cluster;

[0251] For each node within the cluster, calculate the mean and variance of the anomaly probability vector to obtain the anomaly intensity within the cluster;

[0252] The node density is obtained by counting the number of nodes within a cluster and the average Euclidean distance of the node feature vectors in the feature space.

[0253] Based on the cluster anomaly intensity and node density, the cluster radius adjustment factor is calculated, and the ratio of the average anomaly intensity to the node density within the cluster is linearly mapped to obtain the adjusted cluster radius value.

[0254] The calculated cluster radius is applied to the current abnormal cluster to update the cluster radius. At the same time, the cluster center feature vector, the number of nodes in the cluster, and the mean and variance of the abnormal probability in the cluster are recorded.

[0255] All initial anomaly clusters are processed sequentially to form the final anomaly cluster set;

[0256] The final set of abnormal clusters is organized, and an abnormal cluster index table is generated. The index table records the cluster number, cluster center node number, cluster radius, list of node numbers within the cluster, cluster time span, and statistical information on the probability of abnormality within the cluster for each abnormal cluster.

[0257] In this embodiment, generating the cluster-level anomalous evolution sequence includes:

[0258] Receive the set of abnormal clusters and the set of embedded nodes. Organize the abnormal probabilities of nodes in each abnormal cluster at consecutive time steps to form a time series of abnormal probabilities of nodes in the cluster, and record the node number and time step index information.

[0259] Based on the time series of node anomaly probabilities within the cluster, the node anomaly change rate and anomaly trend vector are calculated, including the probability difference, average change rate, and standard deviation of each node at consecutive time steps, generating a set of node anomaly evolution vectors, where:

[0260] The calculation of the node anomaly rate of change and anomaly trend vector is as follows:

[0261] Iterate through each cluster in the final set of abnormal clusters, and access the time series of the abnormal probability of each node in the cluster in turn;

[0262] For the time series of anomaly probabilities of each node, starting from the second time step, calculate the probability difference between adjacent time steps, that is, the anomaly probability of the current time step minus the anomaly probability of the previous time step, to obtain the node anomaly change value at each time step.

[0263] For each node, an abnormal change value sequence is independently statistically analyzed, the average value is calculated as the node's average abnormal change rate, and the standard deviation is calculated as the abnormal change fluctuation index.

[0264] The abnormal change value, abnormal average rate of change and standard deviation of each node are combined to form the node abnormal trend vector, which is arranged according to the node numbering order in the cluster.

[0265] The abnormal trend vectors of all nodes within a cluster are integrated in order of cluster number to form a set of abnormal evolution vectors of nodes within the cluster, generating a set of abnormal evolution vectors of nodes with the number of abnormal clusters × the number of nodes within the cluster × the time step length.

[0266] Based on the topological adjacency relationships between anomalous clusters, an inter-cluster anomaly propagation sequence is constructed, mapping the node anomaly evolution vector to the cluster-level anomaly evolution sequence. During the mapping process, the inter-cluster anomaly correlation coefficient is calculated, where:

[0267] The inter-cluster anomaly propagation sequence is constructed as follows:

[0268] Iterate through each cluster in the final set of abnormal clusters, and determine the list of upstream and downstream adjacent clusters for each cluster based on the topological adjacency relationship between the abnormal clusters;

[0269] For each time step, the cluster-level anomaly evolution vector of the current cluster is mapped to the cluster-level anomaly evolution vector of the neighboring clusters to form the propagation state of the current cluster at that time step, and the flow order of anomalies between adjacent clusters with the topological path is recorded.

[0270] Accumulate the propagation state of each cluster in the order of time steps, arrange all clusters in sequence, and form an inter-cluster anomaly propagation sequence matrix of cluster number × time step length × feature dimension. Each row corresponds to the cluster number, each column corresponds to the time step, and each layer corresponds to the feature dimension.

[0271] During the construction of the inter-cluster anomaly propagation sequence, the neighbor cluster numbers and the number of nodes within each cluster are preserved;

[0272] Mapping node anomalous evolution vectors to cluster-level anomalous evolution sequences is specifically as follows:

[0273] Traverse each cluster in the final set of anomalous clusters, and sequentially access the anomalous evolution vectors of all nodes within the cluster; at each time step, calculate the average of the anomalous evolution vectors of all nodes within the cluster element by element to generate the cluster-level anomalous evolution vector of the corresponding cluster at the current time step, with each element corresponding to the cluster-level anomalous state of the feature dimension; arrange the cluster-level anomalous evolution vectors sequentially according to the time step order to form a cluster-level anomalous evolution sequence matrix of cluster number × time step length × feature dimension, with each row corresponding to the cluster number, each column corresponding to the time step, and each layer corresponding to the feature dimension;

[0274] The inter-cluster anomaly correlation coefficient is calculated as follows:

[0275] Traverse each pair of adjacent clusters in the inter-cluster anomaly propagation sequence and read the cluster-level anomaly evolution vector of each cluster at the same time step;

[0276] For each pair of clusters, calculate the covariance of each feature dimension by the corresponding time step feature vector, and divide the covariance by the product of the standard deviations of the anomalous evolution vectors of the corresponding feature dimensions of the two clusters to obtain the correlation coefficient of each feature dimension.

[0277] The anomalous correlation coefficient of the cluster at the current time step is obtained by averaging the correlation coefficients of all feature dimensions within the cluster element by element.

[0278] The abnormal correlation coefficients of each time step are accumulated in the order of time steps to form an inter-cluster abnormal correlation coefficient matrix. Each row corresponds to the cluster pair number and each column corresponds to the time step. All cluster pairs are processed in sequence to generate a complete inter-cluster abnormal correlation coefficient matrix.

[0279] The cluster-level anomaly evolution sequence is integrated along the time dimension to calculate the dynamic changes of the anomaly distribution within the cluster over time, including the anomaly probability of the cluster center, the anomaly variance of nodes within the cluster, and the anomaly distribution trend. A cluster-level anomaly evolution pattern vector is then generated, where:

[0280] The dynamic changes of intra-cluster anomaly distribution over time are calculated as follows:

[0281] Traverse each cluster in the inter-cluster anomaly propagation sequence matrix and read the cluster-level anomaly evolution vector of the current cluster at all time steps;

[0282] For each time step, the anomalous probability values ​​of all nodes in the cluster are averaged element by element to obtain the cluster center anomalous probability for that time step.

[0283] Calculate the variance of the probability of anomalies in nodes within the cluster at this time step to obtain the degree of dispersion of the anomaly distribution within the cluster;

[0284] The anomaly distribution trend vector for consecutive time steps is obtained by averaging the cluster center anomaly probability over time series data using a sliding window method.

[0285] The cluster center anomaly probability, the degree of dispersion of anomaly distribution within the cluster, and the anomaly distribution trend vector of each cluster are combined to form a cluster-level anomaly evolution pattern vector, which is then arranged according to the cluster number to generate a cluster-level anomaly evolution pattern matrix of number of clusters × time step length × feature dimension.

[0286] Organize the cluster-level anomaly evolution pattern vectors, node numbers, and cluster number information to generate a cluster-level anomaly evolution sequence, including the time step sequence of each cluster, the anomaly distribution characteristics of nodes within the cluster, and the anomaly propagation information between clusters.

[0287] In this embodiment, generating the multidimensional historical embedding matrix includes:

[0288] Receive the node anomaly probability matrix and cluster-level anomaly evolution sequence, and organize the anomaly probability and cluster-level evolution characteristics of each node at each time step according to the node number and cluster number to form a multi-source anomaly information set.

[0289] Multidimensional encoding processing is performed on the multi-source anomaly information set. The node anomaly probability, cluster-level anomaly evolution pattern vector and node topology information are combined to form a tensor structure. Each dimension in the tensor is standardized to generate a preliminary historical embedding matrix.

[0290] Adaptive feature compression is performed on the initial historical embedding matrix, singular value decomposition is performed, the main feature dimension is selected, and a low-dimensional historical embedding matrix is ​​generated.

[0291] The low-dimensional historical embedding matrix undergoes multi-view encoding, including encoding anomalous evolution patterns along both the time and cluster dimensions. The encoding results are then concatenated and normalized to generate a multi-dimensional historical embedding matrix, where:

[0292] Multi-view encoding of the low-dimensional history embedding matrix is ​​performed as follows:

[0293] The low-dimensional history embedding matrix is ​​divided into time and cluster dimensions, and each element is the low-dimensional embedding vector of the node at the corresponding time step and cluster.

[0294] Along the time dimension, for each time step, read the low-dimensional embedding vectors of all clusters row by row, and generate a time-view encoding result matrix through linear transformation, with rows corresponding to time steps and columns corresponding to the feature dimensions of the time-dimensional embedding vectors;

[0295] For each cluster along the cluster dimension, the low-dimensional embedding vectors of all time steps are read column by column, and a cluster-view encoding result matrix is ​​generated through linear transformation, with rows corresponding to cluster numbers and columns corresponding to the feature dimensions of the cluster-dimensional embedding vectors;

[0296] The temporal-view encoding result matrix and the cluster-view encoding result matrix are concatenated along the feature dimension to form a multidimensional historical embedding matrix, with rows corresponding to time steps or cluster numbers and columns corresponding to the concatenated feature dimensions.

[0297] The concatenated multidimensional history embedding matrix is ​​normalized by dividing each vector element by the square root of the sum of the squares of all elements in that vector, and finally generating a multidimensional history embedding matrix with the number of nodes × the number of time steps × the dimension of the multi-view embedding features.

[0298] In this embodiment, generating a dynamic graphical report includes:

[0299] Receive the multidimensional historical embedding matrix and the abnormal cluster index table, and organize the abnormal evolution features corresponding to each node and cluster in the multidimensional historical embedding matrix according to the node number and cluster number to form an aggregated information set;

[0300] The aggregated information set is structured and integrated to combine node anomaly evolution characteristics, cluster-level anomaly evolution patterns, and intra-cluster statistical information into a hierarchical data structure, generating a preliminary anomaly aggregation matrix.

[0301] Perform inter-cluster aggregation analysis on the preliminary anomaly aggregation matrix to calculate inter-cluster anomaly similarity, anomaly density, and anomaly propagation relationships, forming a cluster-level anomaly aggregation feature matrix, where:

[0302] The calculation of inter-cluster anomaly similarity, anomaly density, and anomaly propagation relationships is as follows:

[0303] Traverse each anomalous cluster in the initial anomalous aggregation matrix, and read the anomalous probability vector of all nodes in each cluster and the corresponding cluster-level anomalous evolution vector.

[0304] Calculate the anomaly similarity between clusters: For each pair of clusters between the current cluster and its neighboring clusters, the anomaly probability vector of the nodes within the cluster is averaged along the corresponding positions of the time steps to obtain the cluster average anomaly vector. The square root of the sum of the squares of the differences between the two cluster average anomaly vectors is calculated element by element to obtain the anomaly Euclidean distance between the clusters. All inter-cluster distances are normalized to generate an inter-cluster anomaly similarity matrix, where the rows and columns of the matrix correspond to the cluster numbers and the values ​​range from 0 to 1.

[0305] Calculate the intra-cluster anomaly density: Count the number of nodes in each cluster and the average Euclidean distance of the nodes in the cluster in the feature space. Divide the number of nodes by the average distance to obtain the intra-cluster anomaly density value.

[0306] Calculate the anomaly propagation relationship between clusters: For each cluster's neighboring clusters, read the cluster-level anomaly evolution vectors sequentially according to the inter-cluster topology, compare the changing trends of anomaly probability values ​​along the time step, record the sequence patterns of anomaly probability increase or decrease, and form an inter-cluster anomaly propagation matrix.

[0307] Multidimensional feature encoding and normalization are performed on the cluster-level anomaly aggregation feature matrix, including encoding the anomaly pattern by time dimension and cluster dimension respectively, and concatenating the encoding results to generate a multidimensional anomaly aggregation embedding matrix.

[0308] Organize multidimensional anomaly aggregation embedding matrix and anomaly cluster index table, generate structured anomaly information archives, and display dynamic graphical reports showing the changing trends of anomaly clusters and nodes over time.

[0309] Example 1: To verify the feasibility of this invention in practice, it was applied to a continuous meter box monitoring cycle. The system received multi-sensor data from 120 meter box nodes. Each node collected current, voltage, power, and temperature information at a 1-minute sampling interval, totaling 8640 records. The raw data contained approximately 2.8% missing values ​​and 2.1% outliers, with an average noise level of 0.11. Node loads fluctuated significantly, with some nodes experiencing instantaneous power changes between 0.8 and 3.2 kW. Approximately 15% of the nodes exhibited instantaneous anomalous jumps during the monitoring cycle. The system first normalized the raw data, compressing the values ​​to the 0–1 range, and encoded the discrete states to form a 64-dimensional initial node feature vector. After singular value decomposition (SVD) dimensionality reduction, the feature dimension was compressed to 32 dimensions, and a node time series index table was generated according to node number and time sequence.

[0310] In the improved MixHop network construction module, the system inputs a normalized set of node features into the alternating order neighbor embedding layer. Each node's features are aggregated within its 1st to 3rd order neighbors, generating a multi-order node embedding vector set with a dimension of 32×3. The local extremum mapping layer calculates the feature extrema of each node in its neighborhood and adaptively adjusts the mapping parameters based on the anomaly probability distribution of neighboring nodes, fusing the extremum mapping vector with the multi-order embedding vector to form a set of local anomaly feature vectors. In the temporal evolution serialization layer, the node embeddings and local anomaly features at consecutive time steps are serialized, a decay weight is applied to the historical time step embeddings, and low-information-density embeddings are adaptively compressed while high-information-density embeddings are enhanced based on the node embedding information density. The overall node embedding set size is 120×32×60. During network training, the change in the joint loss value over five consecutive rounds is less than 0.001, indicating convergence of the embedding representation.

[0311] The integrated node embedding set enters the dynamic anomaly assessment module, which adaptively adjusts within a sliding window length of 5–12 minutes, calculating the empirical cumulative distribution of node features to generate anomaly probabilities. Multi-view embedding, combined with the Copula method, accumulates and smooths the anomaly probabilities at each time step, forming a node anomaly probability matrix. In the probability-weighted clustering step, the system identifies 14 anomalous nodes, forming 5 anomalous clusters. The average anomaly probability within each cluster is 0.73, and the cluster radius is 0.5–1.2 topological units. The anomaly evolution analysis module calculates the time series of node anomaly probabilities within clusters and the anomaly propagation sequence between clusters, generating a cluster-level anomaly evolution sequence. The historical information encoding module integrates the node anomaly probability matrix and the cluster-level evolution sequence to generate a multi-dimensional historical embedding matrix. The anomaly aggregation analysis module integrates the historical embedding matrix with the anomaly cluster index table to generate a structured anomaly information archive and a dynamic graphical report. The average response time is 4.3 minutes, the early warning accuracy rate is 90%, the anomaly cluster identification accuracy rate reaches 96%, and the false alarm rate of manual inspection is significantly reduced by 15%, verifying the feasibility and effectiveness of the invention in rapid anomaly detection, cluster-level evolution analysis, and predictive maintenance.

[0312] Table 1. Performance Comparison of the Invention Method and Traditional Methods in Meter Box Fault Monitoring System

[0313] Performance indicators Traditional methods Method of the present invention Training sample size Test sample size Node anomaly detection rate (%) 78.6 92.3 4000 1000 Anomaly cluster identification accuracy (%) 64.1 88.7 4000 1000 Anomaly propagation sequence length (time steps) 15 27 4000 1000 System response time (minutes) 6.8 3.5 4000 1000 Early warning accuracy rate (%) 55.2 81.6 4000 1000 Node anomaly detection rate (%) 80.1 93.8 6000 1500 Anomaly cluster identification accuracy (%) 66.0 90.5 6000 1500 Anomaly propagation sequence length (time steps) 16 29 6000 1500 System response time (minutes) 7.1 3.3 6000 1500 Early warning accuracy rate (%) 56.4 82.5 6000 1500

[0314] As can be seen from the statistical results in Table 1, this invention has achieved significant optimization in meter box fault monitoring. In the node anomaly detection stage, with a training sample size of 4000 and a test sample size of 1000, the node anomaly detection rate of this invention reaches 92.3%, which is 13.7 percentage points higher than the 78.6% of the traditional method. In terms of anomaly cluster identification accuracy, the method of this invention reaches 88.7%, while the traditional method is 64.1%, an improvement of 24.6 percentage points. The anomaly propagation sequence length increases from 15 steps in the traditional method to 27 steps, indicating that this invention can capture the anomaly development trajectory more completely. The system response time is shortened from 6.8 minutes to 3.5 minutes, while the early warning accuracy increases from 55.2% to 81.6%, showing that the system has significant advantages in both real-time performance and early warning capability.

[0315] With the training sample size increased to 6000 and the test sample size to 1500, the node anomaly detection rate of the method of the present invention was further improved to 93.8%, compared with 80.1% for the traditional method; the anomaly cluster identification accuracy was 90.5%, compared with 66.0% for the traditional method; the anomaly propagation sequence length was extended to 29 steps, the system response time was shortened to 3.3 minutes, and the early warning accuracy was improved to 82.5%. This shows that the method of the present invention remains efficient and stable under expanded data scale, and verifies the scalability and generalization ability of the method.

[0316] Comparative data clearly demonstrates that this invention, through the improved combination of the MixHop network and the COPOD algorithm, achieves accurate detection and evolutionary analysis of anomalies in meter box nodes and clusters. This not only improves anomaly detection accuracy and cluster identification effectiveness but also enhances anomaly propagation tracking and system response efficiency. Furthermore, the method of this invention maintains stable performance across different data scales, significantly outperforming traditional thresholding or basic machine learning methods, and solving the problems of insufficient anomaly detection accuracy, cluster analysis completeness, and real-time early warning capabilities in traditional monitoring systems.

[0317] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A fault monitoring system for electricity meter boxes based on intelligent sensing elements, characterized in that, include: The data acquisition and preprocessing module collects multi-sensor data from each node of the meter box, preprocesses the collected data, and generates a standardized set of node features. The MixHop network construction module inputs the normalized node feature set into the improved MixHop network, performs alternating order neighbor embedding iteration, generates a multi-order node embedding vector set, calculates the feature extrema of the node in the local neighborhood based on the multi-order node embedding vector, forms a local abnormal feature vector set, and performs time evolution serialization on the local abnormal feature vector set to generate a comprehensive node embedding set. The dynamic anomaly assessment module inputs the comprehensive node embedding set into the COPOD algorithm, and uses the dynamic time window distribution adaptive and multi-view embedding joint Copula anomaly scoring method to generate a node anomaly probability matrix. The local anomaly cluster identification module performs probability-weighted clustering of anomaly nodes based on the node anomaly probability matrix, and adaptively adjusts the cluster radius according to the anomaly distribution of nodes within the cluster to form an anomaly cluster set and generate an anomaly cluster index table. The anomaly evolution analysis module constructs a time series of node anomalies within a cluster based on the set of anomaly clusters and the set of embedded nodes, performs dynamic evolution analysis on the anomaly clusters, calculates the anomaly propagation sequence by combining the adjacency relationship between clusters, and generates a cluster-level anomaly evolution sequence. The historical information encoding module performs multi-source fusion encoding on the node anomaly probability matrix and the cluster-level anomaly evolution sequence, and generates a multi-dimensional historical embedding matrix through adaptive feature compression. The anomaly aggregation analysis module integrates the multidimensional historical embedding matrix and the anomaly cluster index table to generate a structured anomaly information archive, performs aggregation analysis on anomaly clusters, and generates dynamic graphical reports.

2. The meter box fault monitoring system based on intelligent sensing elements according to claim 1, characterized in that, The process of generating a normalized node feature set includes: Collect multi-sensor data from each node of the meter box, including power consumption, voltage, current and temperature, and record the node number and timestamp; The multi-sensor data is preprocessed, including outlier removal, missing value imputation, and noise filtering, to obtain the preprocessed original node data set; The preprocessed original node data set is normalized, including linear normalization and standardization of numerical data and encoding of discrete state data, to obtain an initial normalized node feature set. The standardized node feature set is sorted according to node number and collection time order to form a node time series index table; The data in the node time series index table is subjected to feature dimension compression, and a low-dimensional node feature set is generated by using the singular value decomposition method. Organize the low-dimensional node feature set to form the final normalized node feature set.

3. The meter box fault monitoring system based on intelligent sensing elements according to claim 1, characterized in that, The generated integrated node embedding set includes: An improved MixHop network is constructed, which includes an alternating neighbor embedding layer, a local extremum mapping layer, and a temporal evolution serialization layer. The weights, biases, and adjacency matrices of the improved MixHop network layers are initialized. The alternating order neighbor embedding layer receives a normalized set of node features, aggregates features for each node within different order neighbor ranges, calculates node embedding vectors using alternating order weighted convolution, encodes local-global difference features in each order node embedding vector, and fuses multi-order embeddings through nonlinear mapping to generate a set of multi-order node embedding vectors. The local extremum mapping layer receives a set of multi-order node embedding vectors, calculates the feature extremum of each node in the local neighborhood, generates a local extremum mapping vector and adaptively adjusts it according to the statistical distribution of the local neighbor embedding vectors, and fuses the local extremum mapping vector with the multi-order node embedding vector to form a set of local anomaly feature vectors. The temporal evolution serialization layer receives a set of local anomaly feature vectors, performs serialization processing on the node embeddings and local anomaly features of consecutive time steps, applies attenuation weights to the node embeddings of historical time steps during the serialization process, and adaptively compresses low information density node embeddings and enhances high information density node embeddings according to the node embedding information density, generating a comprehensive node embedding set. The improved MixHop network was trained by using the prediction error between the integrated node embedding set and the historical anomaly label, as well as the combination of the multi-order neighbor embedding consistency error, as the joint optimization objective. The weights of the alternating order neighbor embedding layer, the local extremum mapping layer, and the temporal evolution serialization layer were continuously updated. When the change in the joint loss value in five consecutive training rounds was less than 0.001, the improved MixHop network was considered to have completed convergence training.

4. The meter box fault monitoring system based on intelligent sensing elements according to claim 1, characterized in that, The generated node anomaly probability matrix includes: Based on the comprehensive node embedding set, the node embedding vectors are arranged according to node number and time step to form a node feature matrix; A dynamic sliding time window is constructed. For the continuous time step data of each node in the node feature matrix, the empirical cumulative distribution function is calculated in each window to generate the node feature anomaly probability. The window length is adaptively adjusted according to the changes of node features in the time window. Multi-view embedding calculation is performed on the node feature matrix within each time window, the node embedding is mapped to multiple view spaces, the node anomaly score is jointly calculated based on the features of each view, and the anomaly probability of each time step within the time window is accumulated and smoothed to form a multi-view joint anomaly score matrix. The node feature anomaly probability is fused with the multi-view joint anomaly scoring matrix. During the fusion process, the adaptive adjustment of the anomaly score over time to short-term bursts and long-term drifts is considered. The Copula method is used to generate the node anomaly probability matrix. The node anomaly probability matrix is ​​normalized and arranged according to node number and time step order to form the final node anomaly probability matrix.

5. A fault monitoring system for an electric meter box based on intelligent sensing elements according to claim 1, characterized in that, The generation of the abnormal cluster index table includes: Based on the node anomaly probability matrix, the anomaly probability of each node at each time step is arranged by node number and time order. An anomaly node set is selected according to the anomaly probability threshold, and the neighbor node number and time step information of each anomaly node are recorded. The set of anomalous nodes is clustered in the node adjacency topology, and the similarity between nodes is calculated using probability-weighted Euclidean distance to form a preliminary set of anomalous clusters. Each anomalous cluster contains a list of nodes, the cluster center node, and the anomalous probability statistics of the nodes within the cluster. An intra-cluster distribution analysis is performed on the preliminary set of anomalous clusters. The cluster radius is adaptively adjusted based on the probability distribution characteristics of nodes within the cluster. An adjustment factor is calculated using the intra-cluster anomalous intensity and node density to generate the final set of anomalous clusters. The radius, number of nodes, cluster center feature vector, mean and variance of intra-cluster anomalous probability are recorded for each cluster. The final set of abnormal clusters is organized, and an abnormal cluster index table is generated. The index table records the cluster number, cluster center node number, cluster radius, list of node numbers within the cluster, cluster time span, and statistical information on the probability of abnormality within the cluster for each abnormal cluster.

6. The meter box fault monitoring system based on intelligent sensing elements according to claim 1, characterized in that, The generation of cluster-level anomalous evolution sequences includes: Receive the set of abnormal clusters and the set of embedded nodes. Organize the abnormal probabilities of nodes in each abnormal cluster at consecutive time steps to form a time series of abnormal probabilities of nodes in the cluster, and record the node number and time step index information. Based on the time series of node anomaly probabilities within the cluster, the node anomaly change rate and anomaly trend vector are calculated, including the probability difference, average change rate and standard deviation of each node at consecutive time steps, to generate a set of node anomaly evolution vectors. Based on the topological adjacency relationship between anomalous clusters, an anomalous propagation sequence between clusters is constructed, and the node anomalous evolution vector is mapped to the cluster-level anomalous evolution sequence. During the mapping process, the anomalous correlation coefficient between clusters is calculated. The cluster-level anomaly evolution sequence is integrated in the time dimension to calculate the dynamic changes of the anomaly distribution within the cluster over time, including the anomaly probability of the cluster center, the anomaly variance of the nodes within the cluster, and the anomaly distribution trend, and to generate a cluster-level anomaly evolution pattern vector. Organize the cluster-level anomaly evolution pattern vectors, node numbers, and cluster number information to generate a cluster-level anomaly evolution sequence, including the time step sequence of each cluster, the anomaly distribution characteristics of nodes within the cluster, and the anomaly propagation information between clusters.

7. The meter box fault monitoring system based on intelligent sensing elements according to claim 1, characterized in that, The generation of the multidimensional history embedding matrix includes: Receive the node anomaly probability matrix and cluster-level anomaly evolution sequence, and organize the anomaly probability and cluster-level evolution characteristics of each node at each time step according to the node number and cluster number to form a multi-source anomaly information set. Multidimensional encoding processing is performed on the multi-source anomaly information set. The node anomaly probability, cluster-level anomaly evolution pattern vector and node topology information are combined to form a tensor structure. Each dimension in the tensor is standardized to generate a preliminary historical embedding matrix. Adaptive feature compression is performed on the initial historical embedding matrix, singular value decomposition is performed, the main feature dimension is selected, and a low-dimensional historical embedding matrix is ​​generated. The low-dimensional historical embedding matrix is ​​processed by multi-view encoding, including encoding anomalous evolution patterns by time dimension and cluster dimension respectively. The encoding results are then spliced ​​and normalized to generate a multi-dimensional historical embedding matrix.

8. The meter box fault monitoring system based on intelligent sensing elements according to claim 1, characterized in that, The generation of the dynamic graphical report includes: Receive the multidimensional historical embedding matrix and the abnormal cluster index table, and organize the abnormal evolution features corresponding to each node and cluster in the multidimensional historical embedding matrix according to the node number and cluster number to form an aggregated information set; The aggregated information set is structured and integrated to combine node anomaly evolution characteristics, cluster-level anomaly evolution patterns, and intra-cluster statistical information into a hierarchical data structure, generating a preliminary anomaly aggregation matrix. Perform inter-cluster aggregation analysis on the preliminary anomaly aggregation matrix to calculate the anomaly similarity, anomaly density, and anomaly propagation relationship between clusters, forming a cluster-level anomaly aggregation feature matrix; Multidimensional feature encoding and normalization are performed on the cluster-level anomaly aggregation feature matrix, including encoding the anomaly pattern by time dimension and cluster dimension respectively, and concatenating the encoding results to generate a multidimensional anomaly aggregation embedding matrix. Organize multidimensional anomaly aggregation embedding matrix and anomaly cluster index table, generate structured anomaly information archives, and display dynamic graphical reports showing the changing trends of anomaly clusters and nodes over time.

Images