CN117851920B - Power Internet of things data anomaly detection method and system - Google Patents

Abstract

The invention relates to the technical field of power data anomaly detection, in particular to a power internet of things data anomaly detection method and a system, which utilize stacked discrete wavelet transformation to decompose original power data, and input the decomposed data into a space-time network model, so that complex correlations between time sequence characteristics and sequences can be simultaneously mined. In the training process, the data slice is used as an input training anomaly detection model, finally, the data to be detected is preprocessed and then is input into the anomaly detection model, anomaly scores are calculated with real data, whether the scores exceed a threshold value or not is judged, and the situation that the scores exceed the threshold value is abnormal is judged. By using discrete wavelet transformation, a space-time network and a variation self-coding method, time series data can be better represented, so that the accuracy of anomaly identification is improved.

Description

Power Internet of Things data anomaly detection method and system

Technical Field

The present invention relates to the technical field of power data anomaly detection, and in particular to a power Internet of Things data anomaly detection method and system.

Background technique

The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

In the power system, cross-domain and cross-system power Internet of Things data is increasing. These multi-source data are highly time-series and complexly correlated. Although they can provide important information for the operation and management of the power system, anomaly detection is required to ensure the stable operation of the entire power Internet of Things system. According to the presence or absence of labels, time series anomaly detection methods can be divided into supervised, semi-supervised and unsupervised methods. Among them, the cost of obtaining labels for supervised methods is high, so most detections are concentrated on unsupervised methods that do not use labels.

From a methodological perspective, traditional anomaly detection methods often have difficulty coping with the characteristics of these cross-domain and cross-system power IoT data. They often model and analyze data based on a single system or a specific field, ignoring the correlation and time series characteristics between data, resulting in unsatisfactory detection results.

Summary of the invention

In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a method and system for detecting anomaly in power Internet of Things data, which can better process cross-domain and cross-system data, mine time series characteristics and complex associations, realize efficient identification and analysis of abnormal data, and ensure the reliability and stability of the power system.

In order to achieve the above object, the present invention adopts the following technical solution:

A first aspect of the present invention provides a method for detecting abnormality in power Internet of Things data, comprising:

Obtain and preprocess the power time series data, decompose it to obtain the frequency components and the corresponding number of channels, number of sequences and length of the prediction time window, and form a data set;

The obtained data set is based on the trained anomaly detection model, which captures the long-distance time dependency of time series and the characteristic relationship between multiple series, and reconstructs the predicted value based on the time series data;

The obtained prediction value uses multivariate Gaussian distribution to determine the anomaly score, and the Mahalanobis distance is used as the metric for the anomaly score. When the anomaly score exceeds the threshold, the corresponding data point is anomaly.

Furthermore, the preprocessing includes obtaining N power time series and cleaning some noise data as input for training.

Furthermore, the frequency components are obtained by stacking discrete wavelet transform method to construct a data set (C, T, N), where C is the number of channels corresponding to the number of sequences obtained after discrete wavelet decomposition, T is the length of the prediction time window, and N is the number of multiple time series, as shown in the following formula:

;

In the formula, x represents the original input multi-sequence data, w represents the discrete wavelet basis function, represents the coefficients obtained by stacking discrete wavelet transforms, Represents a high pass filter At the moment The value of .

Furthermore, the anomaly detection model includes a feature processing layer, a spatiotemporal network module and a prediction layer. The feature processing layer includes a preprocessing layer and a convolutional network. The spatiotemporal network module has multiple groups, each group of spatiotemporal network modules is a double-layer graph convolution layer connected in parallel with the Transformer model, and adopts a residual connection method. The prediction layer is reconstructed by a convolutional layer and a variational autoencoder, in which the convolutional layer and the linear layer respectively reduce the feature dimensions, and the variational autoencoder reconstructs the sequence and time dimensions and outputs the prediction results.

Furthermore, the spatiotemporal network module includes a spatiotemporal position embedding layer, a graph convolutional layer and a Transformer, which reconstructs the time series data by encoding the temporal dependencies in each time series and the relationships between different time series pairs.

Furthermore, the spatiotemporal position embedding layer is used to inject the time length into the input sequence and construct the position vector based on the set function.

Furthermore, the graph convolution layer obtains the adjacency matrix and sequence input and constructs a filter in the Fourier domain. The filter captures the spatial features between nodes through its first-order neighborhood, and a graph convolution model is constructed by stacking multiple convolution layers.

Furthermore, multivariate time series data modeled in the time dimension and feature dimension are detected separately by multi-head attention to obtain the relationship between temporal hidden information.

Furthermore, the Mahalanobis distance is used as the metric for the anomaly score, as shown in the following formula:

;

in, The feature vector representing the data point, represents the mean vector of multiple nodes, represents the covariance matrix of the node vector, Represents the data point to the mean vector The Mahalanobis distance.

A second aspect of the present invention provides a power IoT data anomaly detection system, comprising the following steps:

The data acquisition module is configured to: acquire and pre-process the power time series data, decompose and obtain the frequency components and the corresponding number of channels, number of sequences and length of the prediction time window, and form a data set;

The feature mining module is configured to: based on the trained anomaly detection model, the obtained data set captures the long-distance time dependency of the time series and the characteristic relationship between multiple sequences, and reconstructs the time series data to obtain the predicted value;

The anomaly detection module is configured as follows: the obtained prediction value uses multivariate Gaussian distribution to determine the anomaly score, and the Mahalanobis distance is used as the metric of the anomaly score. When the anomaly score exceeds a threshold, the corresponding data point is anomaly.

A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-mentioned distribution power Internet of Things data anomaly detection method.

A fourth aspect of the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps in the above-mentioned power Internet of Things data anomaly detection method when executing the program.

Compared with the prior art, one or more of the above technical solutions have the following beneficial effects:

The process of decomposing the original data to obtain frequency components and the corresponding number of channels, number of sequences and length of the prediction time window forms a stacked discrete wavelet transform method. This method is combined with the anomaly detection model composed of a space-time graph network to capture the mutual abnormal patterns between multiple sequences, and integrate the prediction task and the reconstruction task to better represent the time series data, thereby reducing the false alarm rate and safety risks. It can better handle cross-domain and cross-system data, and realize efficient identification and analysis of abnormal data by mining time series characteristics and complex associations, thereby ensuring the reliability and stability of the power system.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

FIG1 is a schematic diagram of an anomaly detection process provided by one or more embodiments of the present invention;

FIG2 is a schematic diagram of the structure of an anomaly detection model provided by one or more embodiments of the present invention;

FIG3 is a schematic diagram of an original subsequence in a stacked discrete wavelet decomposition effect provided by one or more embodiments of the present invention;

FIG4 is a schematic diagram of a wavelet subsequence of Level 1 in a stacked discrete wavelet decomposition effect provided by one or more embodiments of the present invention;

5 is a schematic diagram of a Level 2 wavelet subsequence in a stacked discrete wavelet decomposition effect provided by one or more embodiments of the present invention;

6 is a schematic diagram of a Level 3 wavelet subsequence in a stacked discrete wavelet decomposition effect provided by one or more embodiments of the present invention;

7 is a schematic diagram of a Level 4 wavelet subsequence in a stacked discrete wavelet decomposition effect provided by one or more embodiments of the present invention;

FIG. 8 is a schematic diagram of anomaly detection results provided by one or more embodiments of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

As introduced in the background technology, traditional anomaly detection methods often have difficulty coping with the characteristics of these cross-domain and cross-system power IoT data. They often model and analyze data based on a single system or a specific field, ignoring the correlation and time series characteristics between data, resulting in unsatisfactory detection results.

Therefore, the following embodiment provides a method and system for detecting anomalies in power IoT data, using stacked discrete wavelet transform to decompose the original power data, and input the decomposed data into the spatiotemporal network model. The spatiotemporal network model consists of a feature processing layer, a spatiotemporal network module and a prediction layer, wherein the feature processing layer uses different convolutional layers to further extract local and global feature information. The spatiotemporal network module combines a double-layer graph convolutional network and a Transformer model, and adopts residual connection technology to simultaneously mine complex associations between time series features and sequences. The prediction layer realizes the unification of prediction tasks and reconstruction tasks, reduces the feature dimension through the convolutional layer, and then reconstructs the sequence and time dimension through the variational autoencoder. During the training process, the data slice is used as input to train the anomaly detection model, and finally the data to be detected is input into the anomaly detection model after preprocessing, and the anomaly score is calculated with the real data to determine whether the score exceeds the threshold, which is abnormal. By using discrete wavelet transform, spatiotemporal network and variational autoencoding methods, time series data can be better characterized, thereby improving the accuracy of anomaly recognition.

Embodiment 1:

As shown in Figures 1 to 8, the power Internet of Things data anomaly detection method includes the following steps:

1) Data preprocessing: Obtain N power time series and perform preprocessing operations; preprocess the power time series data to remove unimportant features in the data and clean some noise data. The results of data preprocessing are used as the input for the next step of model training; decompose the original sequence by stacking discrete wavelet method, and each sequence will generate C-1 detailed coefficients (higher frequency) and 1 trend sequence, thereby generating a C×N dimensional data set Xd .

In this embodiment, the power time series is distributed photovoltaic power data, which belongs to a category of IoT data collection in the power grid, covering the power information of N photovoltaic sites. Since the abnormal situation of photovoltaic data may be affected by many factors, including but not limited to climate, equipment status, etc., this embodiment selects this complex and diverse data source for anomaly detection. The method aims to demonstrate its applicability to a wider range of power IoT detection scenarios by coping with good anomaly detection in multi-source complex scenarios of photovoltaic power data.

2) Model design: According to the correlation coefficient and prior experience, an adjacency matrix is constructed, and a multi-time series anomaly detection model based on variational autoencoder and spatiotemporal graph network model is designed. The model includes feature processing layer, spatiotemporal network module and prediction layer. The feature processing layer includes preprocessing layer and convolutional network. The single spatiotemporal network module is a two-layer GCN network in parallel with Transformer model, and adopts residual connection. The prediction layer is reconstructed by convolutional layer and variational autoencoder (VAE). The convolutional layer and linear layer reduce the feature dimension respectively, and VAE reconstructs the sequence and time dimensions to output the prediction result.

3) Model training: After data preprocessing, for the time series data of N sensors, set the prediction time window length T1 and the output time dimension T2, and divide them into small samples. Set the number of single training samples to B, and construct a single input dimension of (B, C, T1, N). Use them as input samples to train the anomaly detection model, and use the standardized samples of the original sequence as output. Similarly, construct a standardized output dimension (B, T2, N).

4) Anomaly scoring: After the model is trained, the data to be detected is preprocessed and input into the anomaly detection model, and the sample prediction task output is output. The output data and the real data are input into the anomaly scoring model to obtain the anomaly score. Based on the training set model evaluation method, the anomaly detection threshold is set to determine whether the anomaly score exceeds the threshold. If so, it is judged as an anomaly, otherwise it is considered normal.

As shown in Figure 1, the overall flow chart of the anomaly detection task, the discrete wavelet basis function w is used in the preprocessing stage, and the high-pass filter and low pass filter By stacking discrete wavelet transform MODWT to obtain frequency components, (C, T, N) three-dimensional data is constructed, where C is the number of channels corresponding to the number of sequences obtained after discrete wavelet decomposition, T is the length of the prediction time window, and N is the number of multiple time series. The formula can be expressed as: ;

Among them, x represents the original input multi-sequence data, w represents the discrete wavelet basis function, represents the coefficients obtained by stacking discrete wavelet transforms, Represents a high pass filter At the moment The value of .

In the model design, the graph structure data is constructed as a directed graph G , with each time series data as a node of the graph. First, based on the prior information, it can be flexibly represented as a set of candidate relationships C _i for each sensor i , that is, the sensors it can depend on: .

If there is no prior information, the candidate relationships of sensor i are all sensors except itself. In order to select the dependency relationship of sensor i among these candidate nodes, the similarity between the embedding vector of node i and the embedding of its candidate node j ∈ C _i is calculated: , .

Compute the normalized dot product between the embedding vector of sensor i and the candidate relation j∈C _i , select the top k such normalized dot products: Here TopK represents the indices of the top k values in its input (i.e., normalized dot products).

The anomaly detection model is shown in Figure 2. The network consists of a feature extraction layer, a spatiotemporal network, and a prediction layer. First, the convolutional layer CNN is used to accept training data to mine feature dimensions. Then, the spatiotemporal network module ST-block, which is implemented based on the combination of the graph convolutional layer GCN and the Transformer model, encodes not only the temporal dependency in each time series, but also the mutual relationship between different time series pairs. Finally, the convolutional layer is connected to the VAE as a prediction layer to implement a prediction-based anomaly detection model.

The overall prediction task can be expressed as: ; Where G is the generated graph structure, F is the anomaly detection model, T is the time window dimension, and S is the prediction output dimension.

Considering the prediction effect and the effect after VAE reconstruction, the model training function is as follows: ;in, is the square error between the output value and the actual value, It is used to measure the difference between the learned latent variable distribution and the standard normal distribution. Represents the weight used to balance the MSE loss and the KL divergence loss.

In the anomaly scoring stage, for the N-dimensional T-length sensor operating state sequence, the prediction result is input into the anomaly detection model and compared with the test set data. The score is calculated as follows: ;in, It is the square error between the predicted value and the actual value. After calculating the error, it is necessary to determine whether the current point is an anomaly. The 95% confidence level is used as the threshold, and the quantile of the reconstruction error mean of the training set is used for anomaly detection to ensure high accuracy and reliability.

specific:

Step 1: Get the original data and preprocess it: In this step, in order to prevent the model from being affected by extreme values of the data, enhance the stability of model training, and improve the speed of model learning, each column represents a sequence, which can be expressed as X = {x1 _, x2 _, ..., _xn }. Each sequence data will be normalized in the following way, and all data will be classified between [0, 1]: ;in, Representing time series After standardization, the results Indicates time series, Representing time series The mean of Representing time series The standard deviation of .

Will The frequency components are obtained by stacking discrete wavelet transform (MODWT) to construct (C, T, N) three-dimensional data, where C is the number of channels corresponding to the number of sequences obtained after discrete wavelet decomposition, T is the length of the prediction time window, and N is the number of multiple time series.

The formula can be expressed as: ; where x represents the original input multi-series data, w represents the discrete wavelet basis function, represents the coefficient obtained by stacking discrete wavelet transform, and represents the value of the high-pass filter at time. The decomposition effect is shown in Figures 3 to 7, where the horizontal axis is time (seconds, s) and the vertical axis is amplitude.

Step 2: Anomaly detection model As shown in Figure 2, the graph network model first uses two layers of convolutional CNN layers for processing. The first layer uses a smaller convolution kernel (k1×k1) to extract local feature information and expand the number of channels, and the second layer uses a larger convolution kernel (k2×k2) to capture more global feature information and enhance the number of channels, realizing multi-layer feature dimension mining of the input data, which can be expressed as: .

The model structure of the ST-block of the spatiotemporal network module is shown in Figure 2. After the feature processing layer, it enters the spatiotemporal network module. In this embodiment, the network module consists of a spatiotemporal position embedding layer (Positional Embedding Layer), a graph convolutional network (GCN) and a Transformer. The two-layer GCN network is connected in parallel with the Transformer model to capture the long-distance temporal dependency of the time series and the characteristic relationship between multiple sequences, respectively, and remodel the time series data accordingly.

Spatiotemporal Position Embedding Layer: Since Transformer cannot use a fully connected feedforward structure to capture the observed spatial and temporal information, it is necessary to first embed the position and inject the time length into the input sequence. The position vector p is constructed by trigonometric functions. The position vector p corresponding to the position t is constructed by adding the position vector p to the input sequence to obtain the input sequence with position information as follows: ; .

The graph convolution layer (GCNLayer) obtains the adjacency matrix A and the sequence input X , and the GCN model constructs a filter in the Fourier domain. The filter acts on the nodes of the graph, captures the spatial features between the nodes through its first-order neighborhood, and then constructs the GCN model by stacking multiple convolutional layers, which is expressed as: ;in, is the matrix for adding self-connection, I is the identity matrix, is the degree matrix, , For the The output of the layer, express The parameters contained in the layer, The sigmoid activation function represents a nonlinear model. Usually, a single-layer graph convolutional network cannot fully capture the dependencies between features.

Therefore, the model sets a double-layer GCN network for deep mining, which can be expressed as: ; Among them, the first layer selects the ReLU function as the activation function to filter the input information, and W ₀ and W ₁ are the weight matrices between the layers respectively.

GCN handles time series problems, mines spatial relationships through graph convolution operations, and only mines stable spatial dependencies. The Transformer model takes time as the main aspect and is used to process the time dependencies of multivariate time series data. The model design consists of a multi-head attention mechanism and a feedforward network. The multi-head attention is used to detect multivariate time series data modeled in the time dimension and feature dimension respectively, and obtain the relationship between time hidden information; the three matrices MQ, MK, and MV are respectively represented as the query matrix Q , the key matrix K , and the value matrix V ; the calculation formula for self-attention is: ; Where: Represents the Softmax function, which maps the obtained weights to [0, 1] to normalize spatial correlation. Used to scale weights to avoid oversaturation of the Softmax function. Finally, based on the residual connection design, The module output O is obtained through a double-layer feedforward network, and the ReLU function is used as the activation function, which is as follows: .

By introducing the gate mechanism, the fusion of parallel network data is realized, and the output value is: ; ;in, They are all single-layer linear networks that realize the mapping of one-dimensional vectors. It is the output value of the spatiotemporal module ST-block.

Finally, The input prediction layer is used for dimensionality reduction and reconstruction, and the experimental results are output. The prediction layer consists of a convolutional layer and a VAE model. The convolutional layer reduces the number of channels to a single channel, and VAE reconstructs the time dimension to construct the output data format (B, N, T2).

Step 3: Data collection: The data set is a time series of power data from 19 distributed sensors of the electric field. With 30 minutes as a sampling point, the multi-time series has 9125 time steps. The sequence contains 5 pre-set abnormal intervals, and the abnormal time length is set to 30, 60 or 90 time steps.

Step 4: Model training: The preprocessed training data is divided according to the prediction input time dimension T1 and the output time dimension T2 to construct the training data. The sliding window with a size of T1 and a stride of 1 is used for segmentation. Each segment can be expressed as , the set of all segments is represented as , where T1 is set to 6 by default and T2 is set to 1 by default. In order to consider the batch processing of neural network training, the single training data is constructed as a standard input with dimensions (B, C, T1, N), where B is the batch number of a single training, C corresponds to the number of approximate sequences based on wavelet decomposition J, T1 is the input time dimension, and N is the number of multiple sequences. Similarly, the output constructed from the standardized original sequence is (B, T2, N), and the number of training times for a single epoch is , where L is the length of the sample sequence. Finally, the constructed sample sequence is sent to the model for network parameter training. The model training uses the root mean square error MSE as the loss function, which is as follows: ;in, is the predicted value, is the true value of the sample, represents the mean and variance sampled from the latent vector.

Step 5: Anomaly detection: After model training is completed, the test set data is input into the anomaly detection model to obtain the model's prediction value. The anomaly score is calculated based on the multivariate Gaussian distribution, and the Mahalanobis distance function is used as the metric for the anomaly score, which comprehensively considers the covariance between each feature and the distance from the data point to the feature mean. ;in, The feature vector representing the data point, represents the mean vector of multiple nodes, represents the covariance matrix of the node vector, Represents the data point to the mean vector The Mahalanobis distance.

In order to determine the threshold of the anomaly score, this embodiment relies on the anomaly score of the training data, and based on the chi-square distribution theory, sets a key value associated with the number of features at a 95% confidence level for determining the high or low anomaly score. The threshold represents the value that the anomaly score needs to exceed at a given confidence level. This embodiment will detect which data points have anomaly scores higher than the set threshold to determine whether they are abnormal data points, as shown in Figure 8.

Table 1 shows the performance comparison results of this embodiment and the other three methods on the same multi-time series dataset, using three indicators, namely Precision, Recall and F1Score, to evaluate the anomaly detection performance of each method. The same threshold (Threshold) is set to 27.2036, the epoch is set to 20 generations, the experiment on the same dataset is repeated 10 times, and the average results are output for comparison.

Table 1: Comparison results between this model and other benchmark models

It can be seen that compared with the other three methods, the MSE index shows that the model of this embodiment has obviously better prediction performance, and the comprehensive F1 score shows that this embodiment is more competitive in correctly identifying anomalies.

The above process is based on the multivariate time-series power IoT data anomaly detection method of discrete wavelet decomposition and graph convolutional neural network, and combines multivariate Gaussian distribution for anomaly detection. Discrete wavelet decomposition helps to mine the information of different frequencies of the original sequence, so as to grasp the global trend and local details. This step can more comprehensively understand the time-frequency characteristics of the data through the multi-scale decomposition of the sequence, providing a richer data information basis for subsequent network input.

The anomaly identification part calculates the anomaly score based on the multivariate Gaussian distribution, which can comprehensively characterize the joint probability distribution of multivariate data and determine the threshold of the anomaly score by setting the confidence level. Compared with the traditional threshold setting method, this method is more objective and has stronger interpretability, providing a more reliable basis for anomaly detection.

By proposing a spatiotemporal network model based on graph convolution and Transformer, it is possible to adaptively mine the dependencies between features and the evolution laws of the time series measurement data itself, and realize accurate anomaly detection of multivariate time series power IoT data. The model design takes advantage of the characteristics of the graph convolutional neural network (GCN) and the Transformer model. As a spatial network, GCN is mainly responsible for mining spatial features, while the Transformer focuses on mining time trends through the attention mechanism, and then outputs adaptive weights through the gating mechanism to fuse together to form a powerful encoder. The variational autoencoder (VAE) model is further introduced, which adaptively learns the distribution of sequence data and helps to more accurately identify anomalies compared to the feedforward network. As a decoder, VAE provides stronger support for anomaly detection.

Embodiment 2:

The power IoT data anomaly detection system includes:

The data acquisition module is configured to: acquire and pre-process the power time series data, decompose and obtain the frequency components and the corresponding number of channels, number of sequences and length of the prediction time window, and form a data set;

The feature mining module is configured to: based on the trained anomaly detection model, the obtained data set captures the long-distance time dependency of the time series and the characteristic relationship between multiple sequences, and reconstructs the time series data to obtain the predicted value;

The anomaly detection module is configured as follows: the obtained prediction value uses multivariate Gaussian distribution to determine the anomaly score, and the Mahalanobis distance is used as the metric of the anomaly score. When the anomaly score exceeds a threshold, the corresponding data point is anomaly.

The system combines multivariate Gaussian distribution for anomaly detection, and can adaptively mine the dependencies between features and the evolution laws of time series measurement data itself, to achieve accurate multivariate time series power IoT data anomaly detection. By introducing decomposition technology, multi-scale time-frequency feature extraction of power data is achieved, thereby effectively capturing local details and global trends of the data, and providing richer multivariate time series information.

Embodiment three:

This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the power Internet of Things data anomaly detection method as described in the above-mentioned embodiment 1 are implemented.

Embodiment 4:

This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the power Internet of Things data anomaly detection method as described in the first embodiment above are implemented.

The steps involved in the above embodiments 2 to 4 correspond to those in embodiment 1. For the specific implementation, please refer to the relevant description of embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood to include any medium that can store, encode or carry an instruction set for execution by a processor and enable the processor to execute any method in the present invention.

The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims (8)

1. The method for detecting the abnormality of the electric power internet of things data is characterized by comprising the following steps of:

acquiring and preprocessing power time sequence data, decomposing to obtain frequency components, corresponding channel numbers, sequence numbers and predicted time window lengths, and forming a data set;

The obtained data set is based on the trained abnormality detection model, the characteristic relation between the long-distance time dependence of the time sequence and the multiple sequences is respectively captured, and the predicted value is obtained by reconstruction according to the time sequence data;

Determining an anomaly score by using the obtained predicted value through multi-element Gaussian distribution, taking the mahalanobis distance as a measurement standard of the anomaly score, and taking the corresponding data point as the anomaly when the anomaly score exceeds a threshold value;

the anomaly detection model comprises a feature processing layer, a space-time network module and a prediction layer, wherein the feature processing layer comprises a preprocessing layer and a convolution network, the space-time network module is provided with a plurality of groups, each group of space-time network module is provided with a double-layer graph convolution layer and a transform model which are connected in parallel, the prediction layer is reconstructed through the convolution layer and a variation self-encoder, the convolution layer and the linear layer respectively reduce the feature dimension, the variation self-encoder reconstruct the sequence and the time dimension, and a prediction result is output;

The spatio-temporal network module includes a spatio-temporal position embedding layer, a picture volume stacking layer, and a transform, and reconstructs time-series data by encoding a time dependency in each time series and correlations between different time series pairs.

2. The method for detecting anomalies in electrical data on an internet of things of claim 1, wherein the preprocessing includes acquiring N electrical time series, and cleaning noise data as input to training.

3. The method for detecting the anomaly of the electric power internet of things data according to claim 1, wherein a frequency component is obtained by stacking discrete wavelet transform methods, and a data set (C, T, N) is constructed, wherein C is the number of sequences obtained after the discrete wavelet decomposition corresponding to the number of channels, T is the length of a predicted time window, and N is the number of multiple time sequences, as shown in the following formula:

；

where x represents the multi-sequence data representing the original input, w represents the discrete wavelet basis function, Representing coefficients obtained via stacked discrete wavelet transforms,Representing a high pass filterAt the moment of timeIs a value of (a).

4. The method of claim 1, wherein the time length is injected into the input sequence by using a space-time position embedding layer, and the position vector is constructed based on a set function.

5. The method for detecting anomalies in electrical data over internet of things of claim 1, wherein the graph convolution layer obtains an adjacency matrix and a sequence input, and constructs a filter in a fourier domain, the filter constructs a graph convolution model by stacking multiple convolution layers through spatial features between its first-order neighborhood capture nodes.

6. The method for detecting anomalies in electrical data of an internet of things according to claim 1, wherein the relationship between the time hidden information is obtained by detecting multivariate time series data modeled by a time dimension and a feature dimension, respectively, with multiple attentions.

7. The method for detecting anomaly of electric power internet of things data according to claim 1, wherein a mahalanobis distance is used as a measure of anomaly score, as shown in the following formula:

；

Wherein, A feature vector representing a data point,A mean vector representing a plurality of nodes,Representing the covariance matrix of the node vector,Representing data point to mean vectorIs a mahalanobis distance.

8. Electric power thing allies oneself with data anomaly detection system, its characterized in that includes:

a data acquisition module configured to: acquiring and preprocessing power time sequence data, decomposing to obtain frequency components, corresponding channel numbers, sequence numbers and predicted time window lengths, and forming a data set;

A feature mining module configured to: the obtained data set is based on the trained abnormality detection model, the characteristic relation between the long-distance time dependence of the time sequence and the multiple sequences is respectively captured, and the predicted value is obtained by reconstruction according to the time sequence data;

An anomaly detection module configured to: determining an anomaly score by using the obtained predicted value through multi-element Gaussian distribution, taking the mahalanobis distance as a measurement standard of the anomaly score, and taking the corresponding data point as the anomaly when the anomaly score exceeds a threshold value; the anomaly detection model comprises a feature processing layer, a space-time network module and a prediction layer, wherein the feature processing layer comprises a preprocessing layer and a convolution network, the space-time network module is provided with a plurality of groups, each group of space-time network module is provided with a double-layer graph convolution layer and a transform model which are connected in parallel, the prediction layer is reconstructed through the convolution layer and a variation self-encoder, the convolution layer and the linear layer respectively reduce the dimension of the feature dimension, the variation self-encoder is used for reconstructing the sequence and the time dimension, and a prediction result is output;

The spatio-temporal network module includes a spatio-temporal position embedding layer, a picture volume stacking layer, and a transform, and reconstructs time-series data by encoding a time dependency in each time series and correlations between different time series pairs.