CN111143428A - Protection abnormity alarm processing method based on correlation analysis method - Google Patents

Abstract

The invention relates to the technical field of protection abnormity alarm processing for data mining analysis of secondary equipment data, and particularly discloses a protection abnormity alarm processing method based on an association analysis method, which comprises the following steps of 1, establishing a transaction database D by utilizing alarm information data in a security system database, and converting the transaction database D into a Boolean transaction database D'; step 2, mining a frequent item set in the D 'by using an Apriori algorithm, scanning the transaction database D' and obtaining a candidate 1-item set C₁(ii) a Step 3, setting a minimum support count, and comparing the minimum support count with the value C₁Comparing the support counts of the medium item sets to obtain a frequent 1-item set L₁And the like. The inventionAnd on the basis of the data of the information protection system, performing correlation analysis on the action alarm information and the protection switching value alarm information of the protection device, and analyzing and mining the relationship between the action alarm information and the protection switching value alarm information to achieve the aim of early warning the protection state of the power system.

Description

Protection abnormity alarm processing method based on correlation analysis method

Technical Field

The invention relates to the technical field of protection abnormity alarm processing for data mining analysis of secondary equipment data.

Background

Generally, power system protection is referred to, and the protection device is mainly concerned, but power grid protection is a system in nature. The main factors influencing the protection performance of the secondary equipment comprise the protection type, the reliability of device hardware, the reliability of a protection principle, the influence of operation and maintenance operation on the protection reliability and the influence of an operation environment on the protection reliability.

Disclosure of Invention

The invention aims to provide a protection abnormity alarm processing method based on a correlation analysis method, which is characterized in that on the basis of data of a protection system, action alarm information of a protection device and protection switching value alarm information are subjected to correlation analysis, and the relation between the action alarm information and the protection switching value alarm information is analyzed and mined, so that the aim of early warning the protection state of an electric power system is fulfilled.

In order to achieve the above object, the basic scheme of the present invention provides a protection anomaly alarm processing method based on an association analysis method, which comprises the following steps,

step 1, establishing a transaction database D by utilizing alarm information data in a security system database, and converting the transaction database D into a Boolean transaction database D';

step 2, mining a frequent item set in the D 'by using an Apriori algorithm, scanning the transaction database D' and obtaining a candidate 1-item set C₁；

Step 3, setting a minimum support count, and comparing the minimum support count with the value C₁Comparing the support counts of the medium item sets to obtain a frequent 1-item set L₁；

Step 4, from L₁Connection generation C₂(C₂＝L₁×L₁) And scanning D' to obtain C₂The support of the middle item set is counted, and C is counted₂Repeating the process of step 3 to obtain L₂；

Step 5, from the set L of frequent 2-item sets₂Concatenating to generate a set C of candidate 3-item sets₃In the connection process, only the item set with one common item can be connected, and the connection result is frequently verified that all non-empty subsets of the connection result are also connected, and C is obtained₃Then carrying out support degree verification, and repeating the process until no item set meets the requirement, namely

Then

At this point, the frequent item set mining process is finished;

step 6, generating association rules by the frequent item sets after obtaining the frequent item sets of the transaction database D', and setting a minimum confidence threshold value to obtain strong association rules;

and 7, analyzing the obtained frequent item set and the association rule.

Further, step 6 specifically comprises:

the first step is as follows: for each frequent item set l, obtaining all non-empty subsets s of the l;

the second step is that: for each non-null s of l, calculate

Degree of confidence of

If it is not

Not less than the minimum confidence threshold Min _ confidence, then the strong association rule can be obtained

Further, the step 1 specifically comprises:

data preprocessing is carried out on data of a transaction database D, fault occurrence time is divided according to different seasons in one year, namely attribute value discretization is carried out, for alarm condition and protection type in fault alarm information, the attribute value is originally a discrete value, the discrete value is subjected to integral treatment, after the alarm information data are subjected to discretization treatment, the data are converted into Boolean type data suitable for being mined by an Apriori algorithm, after the original transaction database D is subjected to discretization treatment, an item set in the database is I { I ═ I { (I } I { (I) } n₁,i₂,i₃(in the formula, i₁、i₂、i₃Respectively representing ' alarm occurrence time ', ' alarm ' and ' protection type ' in the alarm information), converting the quantitative data in D into Boolean data to form a new database D ', and requiring to convert the item I in the item set I into the new database D_mIs compared with the set of terms in D '═ I'₁,i′₂… } of formula (I'_nAnd correspondingly.

Further, in step 3, if some item sets are empty, the empty item sets can be directly ignored.

Further, the analysis in step 7 includes:

according to the obtained frequent item set, which alarm information types and protection types are high concurrent events and frequently occur in which time periods, so that a better protection decision can be made for the protection of the power system;

and/or according to the obtained strong association rule, the probability of certain alarm information occurring on a specific protection type can be obtained, namely when certain alarm information occurs in the future;

and/or the protection type of the alarm information can be quickly predicted according to the previous mining analysis, so that the early warning purpose is achieved, the protection of the power system can be more quickly and accurately realized, and the generated strong association rule plays an important role in the early warning of the future protection state.

The invention has the following advantages:

the algorithm based on the invention is Apriori algorithm, which is an algorithm for mining the frequent item set of the Boolean association rule with the most influence. The purpose of the algorithm is to find out the relation between the alarm information and the protection type in the data set of the trust system, and to carry out the overall correlation analysis and mining on the researched data by obtaining the relation between the alarm information and the protection type.

The algorithm can provide two very substantial aids, the first way is to get a frequent set of terms that will give the elements that appear often together, providing some support for possible decisions; the second way is an association rule, each association rule means a relation of 'if … …' between element items, the element items to be examined can be analyzed with emphasis, and the mined information has important reference value in the decision making process.

Drawings

Fig. 1 is a logic block diagram of Apriori algorithm in a protection anomaly alarm processing method based on an association analysis method according to the present invention.

Detailed Description

The following is further detailed by the specific embodiments:

example (b):

the basic scheme of the invention provides a protection abnormity alarm processing method based on a correlation analysis method, which comprises the following steps,

step 1, establishing a transaction database D by utilizing alarm information data in a security system database, and converting the transaction database D into a Boolean transaction database D';

step 2, mining a frequent item set in the D 'by using an Apriori algorithm, scanning the transaction database D' and obtaining a candidate 1-item set C₁；

Step 3, setting a minimum support count, and comparing the minimum support count with the value C₁Comparing the support counts of the medium item sets to obtain a frequent 1-item set L₁；

Step 4, from L₁Connection generation C₂(C₂＝L₁×L₁) And scanning D' to obtain C₂The support of the middle item set is counted, and C is counted₂Repeating the process of step 3 to obtain L₂；

Step 5, from the set L of frequent 2-item sets₂Concatenating to generate a set C of candidate 3-item sets₃In the connection process, only the item set with one common item can be connected, and the connection result is frequently verified that all non-empty subsets of the connection result are also connected, and C is obtained₃Then carrying out support degree verification, and repeating the process until no item set meets the requirement, namely

Then

At this point, the frequent item set mining process is finished;

step 6, generating association rules by the frequent item sets after obtaining the frequent item sets of the transaction database D', and setting a minimum confidence threshold value to obtain strong association rules;

and 7, analyzing the obtained frequent item set and the association rule.

Wherein, the step 6 specifically comprises the following steps:

the first step is as follows: for each frequent item set l, obtaining all non-empty subsets s of the l;

the second step is that: for each non-null s of l, calculate

Degree of confidence of

If it is not

Not less than the minimum confidence threshold Min _ confidence, then the strong association rule can be obtained

Wherein, the step 1 specifically comprises the following steps:

data preprocessing is carried out on data of a transaction database D, fault occurrence time is divided according to different seasons in one year, namely attribute value discretization is carried out, for alarm condition and protection type in fault alarm information, the attribute value is originally a discrete value, the discrete value is subjected to integral treatment, after the alarm information data are subjected to discretization treatment, the data are converted into Boolean type data suitable for being mined by an Apriori algorithm, after the original transaction database D is subjected to discretization treatment, an item set in the database is I { I ═ I { (I } I { (I) } n₁,i₂,i₃(in the formula, i₁、i₂、i₃Respectively representing ' alarm occurrence time ', ' alarm ' and ' protection type ' in the alarm information), converting the quantitative data in D into Boolean data to form a new database D ', and requiring to convert the item I in the item set I into the new database D_mIs compared with the set of terms in D '═ I'₁,i′₂… } of formula (I'_nAnd correspondingly.

In step 3, if some item sets are empty, the empty item sets can be directly ignored.

Wherein the analysis in step 7 comprises:

according to the obtained frequent item set, which alarm information types and protection types are high concurrent events and frequently occur in which time periods, so that a better protection decision can be made for the protection of the power system;

and/or according to the obtained strong association rule, the probability of certain alarm information occurring on a specific protection type can be obtained, namely when certain alarm information occurs in the future;

and/or the protection type of the alarm information can be quickly predicted according to the previous mining analysis, so that the early warning purpose is achieved, the protection of the power system can be more quickly and accurately realized, and the generated strong association rule plays an important role in the early warning of the future protection state.

As shown in fig. 1, which is a flowchart of Apriori algorithm, it can be seen that Apriori algorithm searches frequent item sets layer by layer through an iterative method. First a set L of frequent 1-item sets is searched for in a transaction database D₁Then from L_k-1Search L_k(k 2, 3, …, n) until the collection of the obtained frequent (k +1) -term sets is empty, the search cannot be continued. The process of searching for frequent item sets can be divided into two steps, a connecting step and a pruning step according to Apriori properties.

A connecting step:

mixing L with_k-1And L_k-1The concatenation produces a set of candidate k-term sets, denoted C in the apriori algorithm flow diagram shown in FIG. 1_kThe connection method is C_k＝L_k-1×L_k-1

Wherein L is_k-1The item sets in (1) are connectable, requiring that the connected item sets share k-2 items.

Pruning:

obtaining a set of candidate items C in the concatenation step_kThen, the set L of frequent k-term sets is determined based on the minimum support count_k. But in this process, if C_kThe larger size involves a large amount of computation, and the (k-1) -subset may be excluded from L to reduce the computation_k-1The candidate k-item set in (1) is deleted. According to Apriori properties, it is unlikely that all infrequent (k-1) -term sets are a subset of frequent k-term sets, i.e., L_kThe subset of (k-1) items of all the item sets in (L) must be included in_k-1In (1).

In the example analysis process, a transaction database D is established by utilizing the alarm information data in the security system database.

Table 1 is a simple example of D after data preprocessing.

Table 1 simple example of a transaction database D

In the data example shown in table 1, the fault attributes included are the time of occurrence of a fault, the alarm condition, and the protection type.

In the alarm information data correlation analysis in this section, the "time to failure" is divided into different seasons of the year, so k is 4, and the attribute value of the "time to failure" after the dispersion is shown in table 2.

TABLE 2 discretization result of attribute value of "time of occurrence of failure

For the "alarm condition" and the "protection type" in the fault alarm information, the attribute value is originally a discrete value, and we need to integer the discrete value. The introduction of data mining is carried out by taking 9 alarm messages and the protection types in 5 as examples. Discrete value to integer value correspondence is shown in table 3,

TABLE 3 "failure cause" and "zone 1" attribute value integers

After the alarm information data is discretized, the data is converted into Boolean data suitable for mining by an Apriori algorithm. After the original transaction database D is subjected to discretization processing, the item set in the database is I ═ I₁,i₂,i₃(in the formula, i₁、i₂、i₃Respectively represent "alarm occurrence time", "alarm", "protection type" in the alarm information. Converting the quantized data in D into Boolean data to form a new database D', wherein the items I in the item set I need to be converted_mIs compared with the set of terms in D '═ I'₁,i′₂… } of formula (I'_nAnd correspondingly.

Specific conversion results are shown in table 4.

TABLE 4 conversion of quantized data to Boolean data mapping Table

After the quantized transaction database D is converted into the boolean transaction database D ', a frequent item set in D' may be mined by applying Apriori algorithm according to the flow shown in fig. 1.

Step 1: the transaction database D' is scanned, a hypothetical number is given to the model, and a set C of candidate 1-item sets is obtained₁，C₁The contents are shown in table 5.

TABLE 5 set C of candidate 1 item sets₁

Step 2: let the minimum support count Min _ count be 50(Min _ support 50/1914 be 2.65%), and compare with C₁Comparing the support counts of the medium item sets to obtain a frequent 1-item set L₁. It is noted at all that there is a set of items ({ i'₅}、{i′₁₃}、{i′₁₈H) is the result of the real value unknown or the gap value filling in the data processing, and the mining of the related rule by using the association rule has no practical significance, and in order to simplify the subsequent mining process, the step C is₁Generating L₁Can directly ignore these sets of items, L₁The contents are shown in table 6.

TABLE 6 set of frequent 1-item sets L₁

Item set	Count of support counts	Item set	Count of support counts
				{i1'}	321	{i9'}	419
{i2'}	496	{i10'}	268
				{i3'}	589	{i11'}	229
{i4'}	508	{i15'}	772
				{i7'}	377	{i16'}	238
{i8'}	131	{i17'}	866

And step 3: from L₁Connection generation C₂(C₂＝L₁×L₁) And scanning D' to obtain C₂The support of the middle item set is counted, and C is counted₂Repeating the process of step 2 to obtain L₂，L₂The contents are shown in table 7.

TABLE 7 set L of frequent 2-item sets₂

And 4, step 4: collections L of frequent 2-item sets₂Concatenating to generate a set C of candidate 3-item sets₃. Only a set of items that have one common item can be joined during the join process and it is also frequent for the join result to verify all its non-empty subsets, the so-called "pruning" process. Obtaining C₃Then carrying out support degree verification to obtain L₃，L₃The contents are shown in table 8.

TABLE 8 Collection of frequent 3-item sets L₃

Item set	Count of support counts
		{i2',i9',i15'}	56
{i2',i10',i17'}	56
		{i3',i9',i17'}	50
{i3',i10',i17'}	100
		{i4',i7',i17'}	68
{i4',i9',i15'}	57
		{i4',i9',i17'}	52

From L₃Connection generation C₄When the branch is cut, no item set meets the requirement, that is

Then

At this point, the frequent itemset mining process ends.

After the frequent item sets of the transaction database D' are obtained, association rules can be generated from the frequent item sets, and the method for obtaining the association rules is introduced in the above section. For set L of frequent 3-item sets shown in Table 8₃The generated association rules and the confidence of each rule are shown in appendix 3.

If the minimum confidence threshold Min _ confidence is set to 50%, then strong association rules can be obtained as shown in table 9.

Table 9 mined strong association rules and their confidence

By mining the association rules of the attributes of "alarm occurrence time", "alarm information type", and "protection type" in the alarm information in the database for one year, the association rules shown in table 9 can be obtained on the target, and the corresponding rules are:

58.95% of the alarm information caused by device hardware alarms in the second quarter occurred in circuit breaker protection;

of the power distribution network faults caused by device program alarms in the third quarter, 50% occur in circuit breaker protection;

of the alarm information caused by device hardware alarms in the third quarter, 66.67% occurred in circuit breaker protection, and so on;

the above description is made in conjunction with the accompanying drawings for the specific embodiments of the present invention, and the protection scheme is formulated according to the summary of the analysis results, which plays an important role in the protection state early warning.

The above description is only an example of the present invention, and the common general knowledge of the known specific structures and characteristics in the embodiments is not described herein. It should be noted that, for those skilled in the art, without departing from the structure of the present invention, several changes and modifications can be made, which should also be regarded as the protection scope of the present invention, and these will not affect the effect of the implementation of the present invention and the practical applicability of the present invention. The scope of the claims of the present application shall be defined by the claims, and the description of specific embodiments and the like in the specification shall be used to explain the contents of the claims.

Claims (5)

1. A protection abnormity alarm processing method based on a correlation analysis method is characterized by comprising the following steps,

step 1, establishing a transaction database D by utilizing alarm information data in a security system database, and converting the transaction database D into a Boolean transaction database D';

step 2, mining a frequent item set in the D 'by using an Apriori algorithm, scanning the transaction database D' and obtaining a candidate 1-item set C₁；

Step 3, setting a minimum support count, and comparing the minimum support count with the value C₁Comparing the support counts of the medium item sets to obtain a frequent 1-item set L₁；

Step 4, from L₁Connection generation C₂(C₂＝L₁×L₁) And scanning D' to obtain C₂The support of the middle item set is counted, and C is counted₂Repeating the process of step 3 to obtain L₂；

Step 5, from the set L of frequent 2-item sets₂Concatenating to generate a set C of candidate 3-item sets₃In the connection process, only the item set with one common item can be connected, and the connection result is frequently verified that all non-empty subsets of the connection result are also connected, and C is obtained₃Then carrying out support degree verification, and repeating the process until no item set meets the requirement, namely

Then

So far, the frequent item set mining process is finished;

step 6, generating association rules by the frequent item sets after obtaining the frequent item sets of the transaction database D', and setting a minimum confidence threshold value to obtain strong association rules;

and 7, analyzing the obtained frequent item set and the association rule.

2. The method for processing protection anomaly alarm based on the correlation analysis method according to claim 1, wherein the step 6 specifically comprises:

the first step is as follows: for each frequent item set l, obtaining all non-empty subsets s of the l;

the second step is that: for each non-null s of l, calculate

Degree of confidence of

If it is not

Not less than the minimum confidence threshold Min _ confidence, then the strong association rule can be obtained

3. The protection anomaly alarm processing method based on the correlation analysis method according to claim 1 or 2, wherein the step 1 specifically comprises:

data preprocessing is carried out on data of a transaction database D, fault occurrence time is divided according to different seasons in one year, namely attribute value discretization is carried out, for alarm condition and protection type in fault alarm information, the attribute value is originally a discrete value, the discrete value is subjected to integral treatment, after the alarm information data are subjected to discretization treatment, the data are converted into Boolean data suitable for being mined by an Apriori algorithm, after the original transaction database D is subjected to discretization treatment, and an item set in the database is I ═ I₁,i₂,i₃In the formula, i₁、i₂、i₃Respectively representing ' alarm occurrence time ', ' alarm ' and ' protection type ' in the alarm information, converting the quantitative data in D into Boolean data to form a new database D ', and requiring to convert the item I in the item set I_mIs compared with the set of terms in D '═ I'₁,i′₂… } of formula (I'_nAnd correspondingly.

4. The method for processing protection anomaly alarms based on correlation analysis method as claimed in claim 3, wherein in step 3, if some item sets are empty, these empty item sets can be directly ignored.

5. The protection anomaly alarm processing method based on the association analysis method according to any one of claims 1, 2 or 4, wherein the analysis in the step 7 comprises:

according to the obtained frequent item set, which alarm information types and protection types are high concurrent events and frequently occur in which time periods, so that a better protection decision can be made for the protection of the power system;

and/or according to the obtained strong association rule, the probability of certain alarm information occurring on a specific protection type can be obtained, namely when certain alarm information occurs in the future;

and/or the protection type of the alarm information can be quickly predicted according to the previous mining analysis, so that the early warning purpose is achieved, the protection of the power system can be more quickly and accurately realized, and the generated strong association rule plays an important role in the early warning of the future protection state.

Images