CN113139610A - Abnormity detection method and device for transformer monitoring data - Google Patents

Abstract

The embodiments of this specification disclose an abnormality detection method and device for transformer monitoring data. The method includes: acquiring a sequence to be detected of transformer online monitoring data; constructing an abnormal data identification model by using time series modeling and an isolated forest algorithm; constructing an abnormal type identification mode based on an improved multi-dimensional SAX vector representation method; using the abnormal data identification model Identify the abnormal data of the sequence to be detected; use the abnormal type identification mode to determine the abnormal type of the abnormal data, and the abnormal type includes an invalid abnormal mode and a valid abnormal mode; when the abnormal type is the invalid abnormal mode , use sequence correlation analysis to perform correlation check on the abnormal type. Based on the effective identification of abnormal data information, this solution can deeply analyze abnormal patterns and accurately distinguish valid abnormal points from invalid abnormal points.

Description

A kind of abnormal detection method and device for transformer monitoring data

technical field

The present application relates to the field of computer technology, and in particular, to an abnormality detection method and device for transformer monitoring data.

Background technique

With the wide application of big data and Internet of Things technology in power transformer status perception, operation and maintenance, the scale of transformer monitoring data shows an exponential growth trend, which provides an important data basis for comprehensive status evaluation and prediction of equipment. However, affected by various emergencies, the equipment online monitoring system will inevitably generate some abnormal data. Reliably identifying abnormal data and effectively distinguishing its patterns is an important basis for efficient cleaning of online monitoring data and accurate grasp of equipment operating status. Existing research on anomaly detection involves methods based on clustering, classification, and statistics.

Existing anomaly identification algorithms, such as the selection of initial cluster centers in clustering algorithms, will have a greater impact on the clustering convergence effect; classification algorithms are suitable for datasets with a large number of abnormal samples, and in most scenarios, abnormal data are There are very few parts; the method based on statistics is greatly interfered by the selected sample set, and the recognition effect will be reduced when the sample data fluctuates severely. Moreover, the existing methods are not deep enough on how to effectively distinguish different types of abnormal patterns, and further research is needed.

SUMMARY OF THE INVENTION

In view of this, the embodiments of the present application provide an abnormality detection method and device for transformer monitoring data. This solution can effectively identify abnormal data information, analyze abnormal patterns in depth, and realize effective abnormal points and invalid abnormal points. Distinguish accurately.

In order to solve the above-mentioned technical problems, the embodiments of this specification are implemented as follows:

An abnormality detection method for transformer monitoring data provided by the embodiments of this specification includes:

Obtain the sequence to be detected of the transformer online monitoring data;

Using time series modeling and isolation forest algorithm to build anomalous data identification model;

The abnormal type identification mode is constructed based on the improved multi-dimensional SAX vector representation method;

Identify the abnormal data of the sequence to be detected by using the abnormal data identification model;

Using the exception type identification mode to determine the exception type of the exception data, the exception type includes an invalid exception mode and a valid exception mode;

When the exception type is the invalid exception pattern, a sequence correlation analysis is used to perform a correlation check on the exception type.

Optionally, using the abnormal data identification model to identify the abnormal data of the sequence to be detected specifically includes:

Using empirical wavelet transform theory, the sequence to be detected is adaptively decomposed into time-series components with different frequencies;

The time series components are respectively modeled by the differential autoregressive moving average model, and the predicted value of each component is reconstructed to obtain the predicted value of the monitoring sequence;

Calculate the difference between the predicted value and the measured value to obtain a residual sequence;

The isolated forest algorithm is used to identify the abnormality of the residual sequence, so as to realize the effective extraction of abnormal information in the sequence to be detected.

Optionally, based on the improved multi-dimensional SAX vector representation method, considering the statistical characteristics, morphological characteristics and entropy characteristics of the time series, an eigenvalue vector composed of mean, slope and sample entropy is selected to fully represent the sequence characteristics.

Optionally, the use of sequence correlation analysis to perform correlation verification on the abnormal type specifically includes:

Sequence correlation analysis of the grey correlation analysis algorithm is used to perform correlation verification on the abnormal types.

Optionally, the gray correlation analysis algorithm judges the strength of the correlation degree between the parameters according to the similarity of the geometric shapes of the change curves of each parameter, and the gray correlation analysis algorithm is completed by quantitative analysis of the development trend of the dynamic process. Compare the geometric relationship of time series related statistical data, and find out the degree of correlation between the parameters.

Optionally, the invalid abnormal pattern includes noise points and missing values, and the observed value at the time when the abnormality occurs will seriously deviate from the expected value, and the time series before and after this time will maintain relatively consistent characteristics; The horizontal migration and trend change of monitoring data caused by abnormal state changes, and the time series characteristics before and after the abnormal occurrence time will show great differences.

Optionally, an exception type identification mode is constructed based on an improved multi-dimensional SAX vector representation method, which specifically includes:

Use zero-mean normalization (z-score) to normalize time series of different magnitudes;

The normalized time series is divided into equidistant segments, and the mean, slope and sample entropy are selected as the eigenvalues of the time series to construct an eigenvalue vector representing the characteristics of the time series;

The eigenvalue vector is symbolized.

Optionally, the determining the abnormal type of the abnormal data by using the abnormal type identification mode specifically includes:

inputting the location information of the abnormal data;

Segment the abnormal data according to the location information to generate a segment sequence;

By improving the multi-dimensional SAX vector representation method, the segmented sequence is represented by multi-dimensional symbolic vectors, and the correlation coefficients of the symbolic vectors on both sides of each abnormal point are calculated;

It is judged whether the correlation coefficient is higher than a preset threshold, and if not, it is determined that the abnormality type is an effective abnormality mode.

Optionally, the preset threshold is 0.7 to 0.8, more preferably 0.75.

An abnormality detection device for transformer monitoring data provided by the embodiments of this specification includes:

The sequence to be detected acquisition module is used to obtain the sequence to be detected of the transformer online monitoring data;

The abnormal data identification model building module is used to construct an abnormal data identification model by using time series modeling and isolated forest algorithm;

Anomaly type identification mode building module, used to construct anomaly type identification mode based on improved multi-dimensional SAX vector representation method;

an abnormal data identification module, used for identifying the abnormal data of the to-be-detected sequence by using the abnormal data identification model;

an exception type determination module, configured to use the exception type identification mode to determine the exception type of the exception data, where the exception type includes an invalid exception mode and a valid exception mode;

A correlation check module, configured to perform correlation check on the exception type by using sequence correlation analysis when the exception type is the invalid exception pattern.

An abnormality detection device for transformer monitoring data provided by the embodiments of this specification includes:

at least one processor; and,

a memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

Obtain the sequence to be detected of the transformer online monitoring data;

Using time series modeling and isolation forest algorithm to build anomalous data identification model;

The abnormal type identification mode is constructed based on the improved multi-dimensional SAX vector representation method;

Identify the abnormal data of the sequence to be detected by using the abnormal data identification model;

Using the exception type identification mode to determine the exception type of the exception data, the exception type includes an invalid exception mode and a valid exception mode;

When the exception type is the invalid exception pattern, a sequence correlation analysis is used to perform a correlation check on the exception type.

The above-mentioned at least one technical solution adopted in the embodiments of this specification can achieve the following beneficial effects:

1. On the basis of effectively identifying abnormal data information, in-depth analysis of abnormal patterns is performed to accurately distinguish valid abnormal points from invalid abnormal points.

2. Combine the EWT theory and the ARIMA model to model the time series relationship in the online monitoring data, obtain the residual sequence that can reflect the abnormal characteristics of the monitoring data, and further use the iForest algorithm to achieve efficient extraction of abnormal information in the residual sequence.

3. On the basis of in-depth analysis of the pattern difference between invalid abnormal data and valid abnormal data, an improved multi-dimensional SAX vector representation method is introduced to symbolize the time series, and the similarity score of the symbol vector is used to measure the two sides of the abnormal point. The characteristic difference of the segment sequence, combined with the judgment threshold, can effectively distinguish the abnormal mode.

4. Use the grey correlation analysis algorithm to accurately measure the degree of correlation between monitoring sequences, and further verify the abnormal pattern judgment results on the basis of considering the correlation of the time series, which effectively avoids the existence of the judgment threshold setting. limitation.

Description of drawings

The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The schematic embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation of the present application. In the attached image:

1 is a schematic flowchart of an abnormality detection method for transformer monitoring data provided by an embodiment of the present specification;

Fig. 2 is the moving process schematic diagram of target template;

Fig. 3 is the abnormality detection flow chart;

FIG. 4 is a schematic structural diagram of an abnormality detection device for transformer monitoring data corresponding to FIG. 1 according to an embodiment of the present specification.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be clearly and completely described below with reference to the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

Aiming at the shortcomings of the existing abnormal data detection methods, the present invention proposes a diagnosis strategy for reliably distinguishing valid abnormal points and invalid abnormal points on the basis of effectively identifying abnormal data points.

Invalid outliers refer to the outliers where the observed value at a certain moment in the time series is quite different from the expected value of the point, such as missing values, noise points, etc. For abnormal points with large differences in behavior, such as abnormal values of equipment operating status, different analysis methods should be adopted for different abnormal values.

The technical solutions provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

FIG. 1 is a schematic flowchart of an abnormality detection method for transformer monitoring data according to an embodiment of the present specification. From a program perspective, the execution body of the process may be a program mounted on an application server or an application client.

As shown in Figure 1, the process can include the following steps:

Step 102: Obtain the sequence to be detected of the transformer online monitoring data;

Step 104: construct an abnormal data identification model by using time series modeling and isolated forest algorithm;

Step 106: construct an abnormal type identification mode based on the improved multi-dimensional SAX vector representation method;

Step 108: using the abnormal data identification model to identify the abnormal data of the sequence to be detected;

Step 110: Determine the exception type of the exception data by using the exception type identification mode, where the exception type includes an invalid exception mode and a valid exception mode;

Step 112: When the exception type is the invalid exception pattern, use sequence correlation analysis to perform correlation verification on the exception type.

Optionally, using the abnormal data identification model to identify the abnormal data of the sequence to be detected specifically includes:

Using empirical wavelet transform theory, the sequence to be detected is adaptively decomposed into time-series components with different frequencies;

The time series components are respectively modeled by the differential autoregressive moving average model, and the predicted value of each component is reconstructed to obtain the predicted value of the monitoring sequence;

Calculate the difference between the predicted value and the measured value to obtain a residual sequence;

The isolated forest algorithm is used to identify the abnormality of the residual sequence, so as to realize the effective extraction of abnormal information in the sequence to be detected.

Optionally, based on the improved multi-dimensional SAX vector representation method, considering the statistical characteristics, morphological characteristics and entropy characteristics of the time series, an eigenvalue vector composed of mean, slope and sample entropy is selected to fully represent the sequence characteristics.

Optionally, the use of sequence correlation analysis to perform correlation verification on the abnormal type specifically includes:

Sequence correlation analysis of the grey correlation analysis algorithm is used to perform correlation verification on the abnormal types.

Optionally, the gray correlation analysis algorithm judges the strength of the correlation degree between the parameters according to the similarity of the geometric shapes of the change curves of each parameter, and the gray correlation analysis algorithm is completed by quantitative analysis of the development trend of the dynamic process. Compare the geometric relationship of time series related statistical data, and find out the degree of correlation between the parameters.

Optionally, the invalid abnormal pattern includes noise points and missing values, and the observed value at the time when the abnormality occurs will seriously deviate from the expected value, and the time series before and after this time will maintain relatively consistent characteristics; The horizontal migration and trend change of monitoring data caused by abnormal state changes, and the time series characteristics before and after the abnormal occurrence time will show great differences.

Optionally, an exception type identification mode is constructed based on an improved multi-dimensional SAX vector representation method, which specifically includes:

Use z-score (zero-mean normalization) to normalize time series of different magnitudes;

The normalized time series is divided into equidistant segments, and the mean, slope and sample entropy are selected as the eigenvalues of the time series to construct an eigenvalue vector representing the characteristics of the time series;

The eigenvalue vector is symbolized.

Optionally, the determining the abnormal type of the abnormal data by using the abnormal type identification mode specifically includes:

inputting the location information of the abnormal data;

Segment the abnormal data according to the location information to generate a segment sequence;

By improving the multi-dimensional SAX vector representation method, the segmented sequence is represented by multi-dimensional symbolic vectors, and the correlation coefficients of the symbolic vectors on both sides of each abnormal point are calculated;

It is judged whether the correlation coefficient is higher than a preset threshold, and if not, it is determined that the abnormality type is an effective abnormality mode.

Optionally, the preset threshold is 0.7 to 0.8, more preferably 0.75.

Based on the method of FIG. 1 , some specific implementations of the method are also provided in the embodiments of the present specification, which will be described below.

Aiming at the shortcomings of the existing abnormal data detection methods, the embodiments of this specification propose a diagnosis strategy for reliably distinguishing valid abnormal and invalid abnormal values on the basis of effectively identifying abnormal data points.

Invalid outliers refer to the outliers where the observed value at a certain moment in the time series is quite different from the expected value of the point, such as missing values, noise points, etc. For abnormal points with large differences in behavior, such as abnormal values of equipment operating status, different analysis methods should be adopted for different abnormal values.

1. Anomaly data identification based on time series modeling and isolation forest algorithm

Aiming at the abnormal identification of transformer online monitoring data, the original sequence is adaptively decomposed into time-series components with different frequencies by using empirical wavelet transform theory, so as to weaken the mutual influence between different scales of information; The components are separately modeled in time series, and the predicted values of each component are reconstructed to obtain the predicted value of the monitoring sequence; on this basis, the difference between it and the measured value is calculated to obtain the residual sequence, and the abnormal data characteristics will be in the residual sequence. Finally, the anomaly identification of the residual sequence is carried out by using the isolated forest algorithm to realize the effective extraction of the abnormal information in the monitoring sequence.

1.1 EWT

Empirical wavelet transform (EWT) is a signal adaptive analysis method. The core idea is to construct a suitable orthogonal wavelet filter bank to extract the AM-FM components of the original signal by adaptively dividing the Fourier spectrum of the original signal. Taking the discrete signal in time domain as an example, the specific steps of empirical wavelet transform are as follows:

1) Fourier transform is performed on the input signal f(t), and its Fourier spectrum F(ω) is obtained, and ω is defined in the range of [0, π].

2) The Fourier spectrum of the signal is adaptively divided into N segments, and ω _n (n=1, 2, . . . , N) represents the boundary of segment numbers.

3) N empirical wavelets are constructed according to the Fourier spectrum segment. The calculation formulas of the empirical wavelet function and the empirical scale function are shown in formulas (1) and (2) respectively, where the values of β and γ are as shown in formula (3) ) and (4).

4) Construct the empirical wavelet transform, and perform the inner product operation on the original signal with the empirical wavelet function and the empirical scale function respectively to obtain the detail coefficient and approximation coefficient:

与

分别为φ₁(t)与ψ_n(t)的复共轭。where:

and

are the complex conjugates of φ ₁ (t) and ψ _n (t), respectively.

5) The original signal is reconstructed according to formula (7), and the original signal decomposition results f ₀ (t) and f _k (t) are obtained accordingly.

1.2 Differential Autoregressive Moving Average Model

A differential autoregressive moving average (ARIMA) model, usually denoted ARIMA(p,d,q). Its basic idea is to make a d-order difference for a non-stationary time series to make it a stationary time series, and then use the autoregressive moving average model (ARMA) to model the stationary series, and then obtain the original sequence through inverse transformation. .

First, the stationarity test of the input time series needs to be carried out to determine the value of the difference order. This patent selects the construction test statistic for hypothesis testing to judge the stationarity of the input time series. For non-stationary time series, it is necessary to repeatedly perform differential processing until the processed time series is stabilized. The difference processing process for a non-stationary time series {x _t } is shown in formula (10).

为有序差分算子；d表示差分阶数。In the formula, B is the delay operator;

is an ordered difference operator; d represents the difference order.

The non-stationary time series {x _t } is transformed into a stationary time series {y _t } by difference processing. On this basis, an ARMA(p,q) model is established for it:

表示t时刻的预测值；p和q分别表示模型中自回归项和移动平均项的阶数；

表示第i个自回归项的系数；θ_j表示第j个移动平均项的系数； {ε_t}表示服从独立正态分布的白噪声序列。In the formula,

Represents the predicted value at time t; p and q represent the order of the autoregressive term and the moving average term in the model, respectively;

represents the coefficient of the i-th autoregressive term; θ _j represents the coefficient of the j-th moving average term; {ε _t } represents the white noise sequence obeying an independent normal distribution.

The construction process of ARMA model includes model order determination and parameter estimation. In this paper, on the basis of using the maximum likelihood method to estimate the model parameters, based on the akaike information criterion (AIC), by limiting the value range of p and q, the order combination that minimizes the AIC value is selected as the Model order results.

The multi-scale decomposition of the transformer monitoring sequence is carried out by the EWT theory, and the ARIMA prediction model is constructed for the modal components obtained by the decomposition through the above steps. In order to ensure the prediction accuracy of the ARIMA model, this paper only performs single-step prediction on the component values. By sliding the fitting window and the prediction window to the right over time, the complete prediction sequence of the modal components can be obtained; then the prediction results of each component can be obtained. Reconstruction yields a complete sequence of predictions about the monitoring data.

1.3 iForest Theory

By using the EWT and ARIMA models to obtain the predicted value of the monitoring index, it is subtracted from the actual measured value to obtain the residual item at the corresponding moment, as shown in Equation (12). Since the residual series numerically eliminates the influence of the periodicity and trend of the original series in the changing process, the residual term fluctuates around the zero value. Therefore, abnormal data caused by various emergencies will be more obvious in the residual sequence in the form of outliers.

The isolation forest (iForest) algorithm is an unsupervised anomaly detection method suitable for continuous data. Different from the distance-based and density-based anomaly detection methods, the isolated forest algorithm does not rely on any distance or density measurement, which greatly reduces the computational cost and has the advantages of high accuracy and high computational efficiency. At the same time, the outliers in the residual sequence are consistent with the definition of anomalous data in the isolation forest algorithm, that is, data points that are sparsely distributed and far away from high-density groups. Therefore, this paper chooses to use the isolated forest algorithm to identify the anomaly of the residual sequence, so as to realize the effective extraction of the abnormal information in the monitoring sequence.

2. Distinguishing technology of abnormal mode of monitoring data flow

On the basis of the effective extraction of abnormal data information, the accurate judgment of its abnormal mode is realized. The invalid anomaly mode mainly includes noise points and missing values. When the anomaly occurs, the observed value will seriously deviate from the expected value, and the time series before and after this time will maintain relatively consistent characteristics; while the effective anomaly mode mainly refers to the abnormal change of equipment status. The horizontal migration and trend change of the monitoring data, and the time series characteristics before and after the abnormal occurrence time will show great differences. Therefore, on the basis of segmenting the original sequence with the abnormal point as the segment boundary point, this patent introduces an improved multi-dimensional SAX vector representation method to represent the segmented subsequence by multi-dimensional symbolized vector. The similarity score is combined with the judgment threshold to distinguish different abnormal patterns, and the pattern judgment results are further verified by sequence correlation analysis.

2.1 Anomaly pattern determination based on improved multi-dimensional SAX vector representation

The SAX algorithm can characterize a continuous time series as a discrete symbol sequence. By using the characteristics of the standard normal distribution to divide the interval, and use different symbols to represent the values in the interval, the numerical sequence can be converted into a symbol sequence.

On the basis of segmenting time series, the traditional SAX method takes the numerical mean of each segment of time series as the representation feature of the segmented sequence. Taking into account the large limitations of the mean value representation method, the improved multi-dimensional SAX vector representation method adopted in this patent selects the features composed of the mean value, slope and sample entropy from the perspective of the statistical characteristics, morphological characteristics and entropy characteristics of the time series. The value vector is used to fully represent the sequence characteristics. The specific process includes:

1) z-score normalization of time series

Z-score standardization can convert data of different magnitudes into a unified measure for measurement to ensure comparability between data.

2) Equidistantly segment the time series and represent the eigenvalues

By equidistantly segmenting the standardized time series, and selecting the mean, slope and sample entropy as the eigenvalues of the time series, an eigenvalue vector that can fully characterize the characteristics of the time series is constructed to improve the accuracy of subsequent similarity retrieval queries. sex.

3) Symbolic vector representation of time series

因此，时间序列的各子段特性均可用三维空间中的一条符号向量进行表示，即可用

来表征时间序列的第i个子段的特性。According to the numerical distribution of the eigenvalues of the interval sequence, the numerical space of each type of eigenvalue is divided into equal probability, and different characters are used to represent the divided numerical subspace area, such as the set of letters {A, B, C ,D,E,…}. The scale parameter of the set is denoted as α, and the larger the value of α, the finer the granularity of the average value space and the higher the discrimination accuracy. Usually, the value range of α is [3, 20]. The character sequences representing the mean, slope, and sample entropy features are recorded as

Therefore, the characteristics of each subsection of the time series can be represented by a symbol vector in the three-dimensional space, that is, the

to characterize the characteristics of the ith subsection of the time series.

When an anomaly point belongs to an effective anomaly pattern, the characteristics of the subsequences on the left and right sides of the anomaly point will be quite different; and when an anomaly point belongs to an invalid anomaly pattern, the subsequences on the left and right sides of the anomaly point will maintain relatively consistent characteristics. Therefore, by calculating the similarity value of the symbol vector of the subsequences on both sides of the abnormal point, the abnormal pattern can be accurately determined. The specific process is as follows:

作为待匹配序列，将短序列Q的多维符号化向量序列

作为目标模板序列。1) For a segment boundary point, compare the lengths of the multi-dimensional symbolized vectors of the subsequences on both sides. Multidimensional symbolic vector sequence of long sequence L

As the sequence to be matched, the multi-dimensional symbolic vector sequence of the short sequence Q is

as the target template sequence.

在待匹配序列

上平移，如图1所示。并在平移过程中计算二者在每个位置时的相似度值，如式(13)、(14)。在获取平移过程中生成的相似度分值集合的基础上，选取其中的最小值作为该分段点的异常模式判定分值。2) Put the target template sequence

in the sequence to be matched

Pan up, as shown in Figure 1. And in the translation process, the similarity value of the two at each position is calculated, such as formula (13), (14). On the basis of obtaining the similarity score set generated during the translation process, the minimum value among them is selected as the abnormal mode judgment score of the segment point.

In the formula, w represents the length of the target template sequence; dist() represents the metric function of the character distance, and the distance between any two characters can be obtained by looking up the table. The similarity calculation is carried out on this basis. Compared with the numerical calculation without symbolic representation, the judgment conclusion is consistent, but the calculation efficiency is effectively improved.

3) Set the threshold value T for mode determination. If the score here is greater than T, it is determined that the abnormal point belongs to the valid abnormal mode; if the score here is less than T, it is determined that the abnormal point belongs to the invalid abnormal mode.

4) Repeat the above steps until all abnormal points in the monitoring sequence are determined.

Based on the examples in this paper, it is found through multiple similarity retrieval experiments that the similarity values of the two sets of sequences with relatively consistent patterns are stable below 0.5, so the pattern determination threshold is set to 0.5. However, considering that the threshold setting has certain limitations, this paper uses the threshold to distinguish abnormal patterns, and introduces sequence association analysis to further verify the judgment results.

2.2 Sequence Association Analysis Based on Grey Association Algorithm

The grey correlation analysis algorithm judges the strength of the correlation between the parameters according to the similarity of the geometric shapes of the parameter change curves. Through the quantitative analysis of the dynamic process development situation, the algorithm completes the comparison of the geometric relationship of the time series statistical data, and obtains the correlation between the parameters.

并假设存在m组比较序列，分别记作

其中，i＝1,2,3,…,m。由于各监测指标物理意义不同，导致其数据的量纲也不一定相同，因此，需要对上述序列进行无量纲化处理：Reference sequences are denoted herein as

And assume that there are m groups of comparison sequences, respectively denoted as

Among them, i=1, 2, 3, ..., m. Due to the different physical meanings of the monitoring indicators, the dimensions of the data are not necessarily the same. Therefore, the above sequence needs to be dimensionless:

On this basis, the correlation coefficient between each comparison sequence and the corresponding element of the reference sequence is calculated:

Among them, ρ is the resolution coefficient, which is generally taken as 0.5, n is the minimum difference between the two levels, and m is the maximum difference between the two levels.

By synthesizing the gray correlation coefficients at each time point, the gray correlation degree between the reference sequence and the i-th group of comparison sequences can be obtained:

The larger the _ri is, the stronger the correlation between the comparison sequence and the sequence to be detected is. The correlation threshold _rm is set to 0.75, and the comparison sequence greater than 0.75 is regarded as the correlation sequence.

3. Technical Framework of Monitoring Data Anomaly Detection

Based on the above content, a transformer monitoring data anomaly detection technology framework including anomaly identification and mode determination functional modules is constructed, as shown in Figure 3. The specific detection process is summarized as follows:

1) The degree of correlation between the sequence to be detected and the rest of the monitored sequences is measured by the grey correlation analysis algorithm. If there is a correlation sequence, the verification link is retained in the abnormal mode determination process; if there is no correlation sequence, the verification link is removed.

2) Use EWT theory to decompose the monitoring sequence at multiple scales, and establish an ARIMA prediction model for the modal components obtained by the decomposition. On this basis, the prediction results of each component are reconstructed to obtain the prediction sequence of the monitoring index.

3) Calculate the difference between the predicted value and the actual value to obtain the residual sequence, and combine the iForest algorithm to identify the abnormal value of the residual sequence, and then use the abnormal point as the segmentation boundary point to segment the original monitoring sequence.

4) The segmentation sequence is represented by multi-dimensional symbolized vectors by improving the multi-dimensional SAX vector representation method, and the similarity score of the symbol vectors on both sides of each abnormal point is calculated, thereby distinguishing different abnormal patterns in combination with the judgment threshold.

5) From the perspective of ensuring the safe and stable operation of the equipment, when an abnormal point in the monitoring sequence is judged to be an invalid abnormal mode, it is necessary to verify the judgment result in combination with the associated sequence. If there is no abnormal point in the correlation sequence of the monitoring sequence at the same or adjacent time, it can be determined that the abnormal point belongs to the invalid abnormal mode; if there is an abnormal point in the correlation sequence at the same or adjacent time, the abnormal point is classified as In the effective abnormal mode, the abnormal cause may be abnormal changes in the operating state of the power transformer, or the related monitoring quantities are interfered by external factors during the measurement or transmission process, and further intervention and judgment by the relevant operation and maintenance personnel are required.

This scheme has the following advantages:

1. This scheme combines the EWT theory and the ARIMA model to model the time series relationship in the online monitoring data, obtains the residual sequence that can reflect the abnormal characteristics of the monitoring data, and further uses the iForest algorithm to achieve efficient extraction of abnormal information in the residual sequence.

2. On the basis of in-depth analysis of the pattern difference between invalid abnormal data and valid abnormal data, an improved multi-dimensional SAX vector representation method is introduced to symbolize the time series, and the similarity score of the symbol vector is used to measure the two sides of the abnormal point. The characteristic difference of the segment sequence, combined with the judgment threshold, can effectively distinguish the abnormal mode.

3. Use the grey correlation analysis algorithm to accurately measure the degree of correlation between the monitoring sequences, and further verify the abnormal pattern judgment results on the basis of considering the correlation of the time series, which effectively avoids the existence of the judgment threshold setting. limitation.

4. On the basis of effectively identifying abnormal data information, this patent deeply analyzes abnormal patterns, and accurately distinguishes valid exceptions from invalid exceptions.

5) The abnormal detection technology framework constructed by this patent can provide key technical support for efficient cleaning of power transformer online monitoring data and accurate grasp of equipment operating status.

Based on the same idea, the embodiments of the present specification also provide a device corresponding to the above method. FIG. 4 is a schematic structural diagram of an abnormality detection device for transformer monitoring data corresponding to FIG. 1 according to an embodiment of the present specification. As shown in Figure 4, the device may include:

A sequence to be detected acquisition module 402, configured to acquire a sequence to be detected of the transformer online monitoring data;

The abnormal data identification model building module 404 is used for constructing the abnormal data identification model by using time series modeling and isolated forest algorithm;

Abnormal type identification pattern building module 406, used for constructing an abnormal type identification pattern based on the improved multi-dimensional SAX vector representation method;

An abnormal data identification module 408, configured to identify the abnormal data of the to-be-detected sequence by using the abnormal data identification model;

An exception type determination module 410, configured to use the exception type identification mode to determine the exception type of the exception data, where the exception type includes an invalid exception mode and a valid exception mode;

The correlation checking module 412 is configured to perform correlation checking on the exception type by adopting sequence correlation analysis when the exception type is the invalid exception mode.

The embodiments of this specification also provide an abnormality detection device for transformer monitoring data, including:

at least one processor; and,

a memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

Obtain the sequence to be detected of the transformer online monitoring data;

Using time series modeling and isolation forest algorithm to build anomalous data identification model;

The abnormal type identification mode is constructed based on the improved multi-dimensional SAX vector representation method;

Identify the abnormal data of the sequence to be detected by using the abnormal data identification model;

Using the exception type identification mode to determine the exception type of the exception data, the exception type includes an invalid exception mode and a valid exception mode;

When the exception type is the invalid exception pattern, a sequence correlation analysis is used to perform a correlation check on the exception type.

It should also be noted that the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device comprising a series of elements includes not only those elements, but also Other elements not expressly listed, or which are inherent to such a process, method, article of manufacture, or apparatus are also included. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article of manufacture, or device that includes the element.

The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, as for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for related parts, please refer to the partial descriptions of the method embodiments.

The above descriptions are merely examples of the present application, and are not intended to limit the present application. Various modifications and variations of this application are possible for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the scope of the claims of this application.

Claims (11)

1. an abnormal detection method for transformer monitoring data, is characterized in that, described method comprises: Obtain the sequence to be detected of the transformer online monitoring data; Using time series modeling and isolation forest algorithm to build anomalous data identification model; The abnormal type identification mode is constructed based on the improved multi-dimensional SAX vector representation method; Identify the abnormal data of the sequence to be detected by using the abnormal data identification model; Using the exception type identification mode to determine the exception type of the exception data, the exception type includes an invalid exception mode and a valid exception mode; When the exception type is the invalid exception pattern, a sequence correlation analysis is used to perform a correlation check on the exception type. 2. The method according to claim 1, wherein the identifying the abnormal data of the to-be-detected sequence using the abnormal data identification model specifically comprises: Using empirical wavelet transform theory, the sequence to be detected is adaptively decomposed into time-series components with different frequencies; The time series components are respectively modeled by the differential autoregressive moving average model, and the predicted value of each component is reconstructed to obtain the predicted value of the monitoring sequence; Calculate the difference between the predicted value and the measured value to obtain a residual sequence; The isolated forest algorithm is used to identify the abnormality of the residual sequence, so as to realize the effective extraction of abnormal information in the sequence to be detected. 3. method as claimed in claim 1, is characterized in that, described based on improved multi-dimensional SAX vector representation method respectively considers from the statistical characteristic, morphological characteristic and entropy characteristic angle of time series, selects the composition of mean value, slope and sample entropy. A vector of eigenvalues to fully represent the sequence properties. 4. The method according to claim 1, wherein the performing correlation check on the abnormal type by using sequence correlation analysis, specifically comprises: Sequence correlation analysis of the grey correlation analysis algorithm is used to perform correlation verification on the abnormal types. 5. The method according to claim 4, wherein the gray correlation analysis algorithm judges the strength of the correlation degree between the parameters according to the similarity degree of the geometric shapes of each parameter change curve, and the gray correlation analysis algorithm Through the quantitative analysis of the development trend of the dynamic process, the comparison of the geometric relationship of the relevant statistical data of the time series is completed, and the correlation degree between the parameters is obtained. 6. The method of claim 1, wherein the invalid anomaly pattern includes noise points and missing values, and the observed value at the moment when the anomaly occurs will seriously deviate from the expected value, and the time series before and after this moment will remain relatively consistent. The effective abnormal mode refers to the horizontal migration and trend change of the monitoring data caused by the abnormal change of the equipment state, and the time series characteristics before and after the abnormal occurrence time will show a large difference. 7. method as claimed in claim 3, is characterized in that, adopts and constructs abnormal type identification pattern based on improved multi-dimensional SAX vector representation method, specifically comprises: Use zero-mean normalization to normalize time series of different magnitudes; The normalized time series is divided into equidistant segments, and the mean, slope and sample entropy are selected as the eigenvalues of the time series to construct an eigenvalue vector representing the characteristics of the time series; The eigenvalue vector is symbolized. 8. The method according to claim 1, wherein the determining the abnormal type of the abnormal data by using the abnormal type identification mode specifically comprises: inputting the location information of the abnormal data; Segment the abnormal data according to the location information to generate a segment sequence; By improving the multi-dimensional SAX vector representation method, the segmented sequence is represented by multi-dimensional symbolic vectors, and the correlation coefficients of the symbolic vectors on both sides of each abnormal point are calculated; It is judged whether the correlation coefficient is higher than a preset threshold, and if not, it is determined that the abnormality type is an effective abnormality mode. 9. The method of claim 8, wherein the preset threshold is 0.75. 10. An abnormality detection device for transformer monitoring data, wherein the device comprises: The sequence to be detected acquisition module is used to obtain the sequence to be detected of the transformer online monitoring data; The abnormal data identification model building module is used to construct an abnormal data identification model by using time series modeling and isolated forest algorithm; Anomaly type identification mode building module, used to construct anomaly type identification mode based on improved multi-dimensional SAX vector representation method; an abnormal data identification module, used for identifying the abnormal data of the to-be-detected sequence by using the abnormal data identification model; an exception type determination module, configured to use the exception type identification mode to determine the exception type of the exception data, where the exception type includes an invalid exception mode and a valid exception mode; A correlation check module, configured to perform correlation check on the exception type by using sequence correlation analysis when the exception type is the invalid exception pattern. 11. An abnormality detection device for transformer monitoring data, characterized in that, comprising: at least one processor; and, a memory communicatively coupled to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: Obtain the sequence to be detected of the transformer online monitoring data; Using time series modeling and isolation forest algorithm to build anomalous data identification model; The abnormal type identification mode is constructed based on the improved multi-dimensional SAX vector representation method; Identify the abnormal data of the sequence to be detected by using the abnormal data identification model; Using the exception type identification mode to determine the exception type of the exception data, the exception type includes an invalid exception mode and a valid exception mode; When the exception type is the invalid exception pattern, a sequence correlation analysis is used to perform a correlation check on the exception type.

Images