CN114841212A

CN114841212A - Intelligent power grid time sequence anomaly detection method and system based on capsule network

Info

Publication number: CN114841212A
Application number: CN202210540141.7A
Authority: CN
Inventors: 王堃; 徐悦; 陈志刚; 张立中; 郑晨; 谭源
Original assignee: Central South University; Information and Telecommunication Branch of State Grid Ningxia Electric Power Co Ltd
Current assignee: Central South University; Information and Telecommunication Branch of State Grid Ningxia Electric Power Co Ltd
Priority date: 2022-05-18
Filing date: 2022-05-18
Publication date: 2022-08-02
Anticipated expiration: 2042-05-18
Also published as: CN114841212B

Abstract

The embodiment of the disclosure provides a method and a system for detecting time sequence abnormality of a smart power grid based on a capsule network, which belong to the technical field of data identification and specifically comprise the following steps: step 1, collecting an operation and maintenance data set of a target power grid, inputting the operation and maintenance data set into a feature extraction layer of a capsule network, and obtaining a time sequence feature set corresponding to the operation and maintenance data set; step 2, packaging the time sequence feature set into a plurality of time sequence sub-capsules containing low-level features, and compressing by using a square function; step 3, calculating the relation between all the time sequence sub-capsules and each time sequence father capsule according to a weight matrix, and then updating the weight of the time sequence father capsule according to a dynamic routing protocol; and 4, generating a target capsule according to all the time sequence father capsules, reconstructing the target capsule, and generating a detection result. Through the scheme disclosed by the invention, the detection efficiency, the precision, the adaptability and the real-time performance are improved.

Description

Intelligent power grid time sequence anomaly detection method and system based on capsule network

Technical Field

The embodiment of the disclosure relates to the technical field of data identification, in particular to a method and a system for detecting time sequence abnormity of a smart power grid based on a capsule network.

Background

At present, with the expansion of power grid coverage and application scenes, power grid safety becomes a crucial part, when a power grid fails, machine damage and business loss caused by online service interruption are caused, and power grid information operation and maintenance cost is increased, so how to timely and effectively detect power grid faults is a problem which needs to be solved urgently at present.

Therefore, an efficient, accurate and strong-adaptability intelligent power grid time sequence anomaly detection method based on a capsule network is urgently needed.

Disclosure of Invention

In view of this, the embodiments of the present disclosure provide a method and a system for detecting an abnormal time sequence of a smart grid based on a capsule network, which at least partially solve the problems of poor detection efficiency, poor accuracy and poor adaptability in the prior art.

In a first aspect, an embodiment of the present disclosure provides a smart grid time sequence anomaly detection method based on a capsule network, including:

step 1, collecting an operation and maintenance data set of a target power grid, inputting the operation and maintenance data set into a feature extraction layer of a capsule network, and obtaining a time sequence feature set corresponding to the operation and maintenance data set;

step 2, packaging the time sequence feature set into a plurality of time sequence sub-capsules containing low-level features, and compressing by using a square function;

step 3, calculating the relation between all the time sequence sub-capsules and each time sequence father capsule according to a weight matrix, and then updating the weight of the time sequence father capsule according to a dynamic routing protocol;

and 4, generating a target capsule according to all the time sequence father capsules, reconstructing the target capsule, and generating a detection result.

According to a specific implementation manner of the embodiment of the present disclosure, before step 1, the method further includes:

acquiring historical data of the target power grid;

defining a plurality of abnormal modes according to the actual operation and maintenance scene of the target power grid and preset knowledge;

respectively injecting abnormal data and corresponding labels into the historical data according to each abnormal mode, mining suspected abnormalities in the historical data based on statistical discrimination and unsupervised algorithm and labeling, and dividing the labeled data into a training set, a verification set and a test set;

iteratively training the capsule network using the training set, the validation set, and the test set until an iteration stop condition is reached.

According to a specific implementation manner of the embodiment of the present disclosure, the feature extraction layer includes three layers of one-dimensional convolutional neural networks.

According to a specific implementation manner of the embodiment of the present disclosure, the step 1 specifically includes:

and inputting the operation and maintenance data into the feature extraction layer, performing one-dimensional convolution through window sliding, and obtaining the time sequence feature set through linear activation.

According to a specific implementation manner of the embodiment of the present disclosure, the step 2 specifically includes:

packaging according to the feature vectors of different positions in the time sequence feature set to obtain a plurality of time sequence sub-capsules, wherein the feature vectors comprise positions, sizes and directions of features;

each of the time sequential sub-capsules is compressed using a squash function.

According to a specific implementation manner of the embodiment of the present disclosure, the step 3 includes:

coding the features extracted in a period of time by each time series sub-capsule, and predicting each time series father capsule to generate a prediction vector;

the extracted features in the time-series sub-capsule can be sent to the time-series parent capsule most consistent with the prediction according to the prediction vector and the dynamic routing protocol, and the weight of the time-series parent capsule is updated.

In a second aspect, an embodiment of the present disclosure provides a smart grid time series anomaly detection system based on a capsule network, including:

the acquisition module is used for acquiring an operation and maintenance data set of a target power grid and inputting the operation and maintenance data set into a feature extraction layer of a capsule network to obtain a time sequence feature set corresponding to the operation and maintenance data set;

the encapsulation module is used for encapsulating the time sequence feature set into a plurality of time sequence sub-capsules containing low-level features and compressing the time sequence sub-capsules by using a square function;

the calculation module is used for calculating the relation between all the time sequence sub-capsules and each time sequence parent capsule according to a weight matrix and then updating the weight of the time sequence parent capsule according to a dynamic routing protocol;

and the detection module is used for generating a target capsule according to all the time sequence father capsules and reconstructing the target capsule to generate a detection result.

The intelligent power grid time sequence anomaly detection scheme based on the capsule network in the embodiment of the disclosure comprises the following steps: step 1, collecting an operation and maintenance data set of a target power grid, inputting the operation and maintenance data set into a feature extraction layer of a capsule network, and obtaining a time sequence feature set corresponding to the operation and maintenance data set; step 2, packaging the time sequence feature set into a plurality of time sequence sub-capsules containing low-level features, and compressing by using a square function; step 3, calculating the relation between all the time sequence sub-capsules and each time sequence father capsule according to a weight matrix, and then updating the weight of the time sequence father capsule according to a dynamic routing protocol; and 4, generating a target capsule according to all the time sequence father capsules, reconstructing the target capsule, and generating a detection result.

The beneficial effects of the embodiment of the disclosure are: according to the scheme, the abnormal detection problem of the operation and maintenance data of the power grid is processed based on the capsule network, the convolution structure and the capsule network are superposed to extract the characteristics of the operation and maintenance monitoring time sequence in a layering mode, the time sequence data are processed by combining scalar quantity and vector calculation, and the detection efficiency, the precision, the adaptability and the real-time performance are improved.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings needed to be used in the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present disclosure, and it is obvious for those skilled in the art that other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a schematic flowchart of a smart grid time sequence anomaly detection method based on a capsule network according to an embodiment of the present disclosure;

FIG. 2 is a schematic diagram illustrating a process for detecting suspected abnormalities by an unsupervised algorithm according to an embodiment of the present disclosure;

FIG. 3 is a schematic diagram illustrating a process of labeling mining suspected abnormalities based on statistical discrimination and unsupervised algorithm according to an embodiment of the present disclosure;

FIG. 4 is a graph of classification results for each tag on a test set for NNCapsNet provided by embodiments of the present disclosure;

FIG. 5 is a graph illustrating ROC curves for individual tags on a test set for NNCapsNet, according to an embodiment of the present disclosure;

FIG. 6 is a five-fold cross-validation line graph of an NNCapsNet provided by embodiments of the present disclosure;

FIG. 7 is a graph comparing performance of different feature extraction layers provided by embodiments of the present disclosure;

FIG. 8 is a graph comparing the performance of an NNCapsNet with four other methods provided by embodiments of the disclosure;

fig. 9 is a schematic structural diagram of a smart grid time sequence anomaly detection system based on a capsule network according to an embodiment of the present disclosure.

Detailed Description

The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

The embodiments of the present disclosure are described below with specific examples, and other advantages and effects of the present disclosure will be readily apparent to those skilled in the art from the disclosure in the specification. It is to be understood that the described embodiments are merely illustrative of some, and not restrictive, of the embodiments of the disclosure. The disclosure may be embodied or carried out in various other specific embodiments, and various modifications and changes may be made in the details within the description without departing from the spirit of the disclosure. It is to be noted that the features in the following embodiments and examples may be combined with each other without conflict. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure.

It is noted that various aspects of the embodiments are described below within the scope of the appended claims. It should be apparent that the aspects described herein may be embodied in a wide variety of forms and that any specific structure and/or function described herein is merely illustrative. Based on the disclosure, one skilled in the art should appreciate that one aspect described herein may be implemented independently of any other aspects and that two or more of these aspects may be combined in various ways. For example, an apparatus may be implemented and/or a method practiced using any number of the aspects set forth herein. Additionally, such an apparatus may be implemented and/or such a method may be practiced using other structure and/or functionality in addition to one or more of the aspects set forth herein.

It should be noted that the drawings provided in the following embodiments are only for illustrating the basic idea of the present disclosure, and the drawings only show the components related to the present disclosure rather than the number, shape and size of the components in actual implementation, and the type, amount and ratio of the components in actual implementation may be changed arbitrarily, and the layout of the components may be more complicated.

In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects may be practiced without these specific details.

The embodiment of the disclosure provides a method for detecting time sequence abnormity of a smart power grid based on a capsule network, and the method can be applied to a fault detection process in a power grid operation and maintenance scene.

Referring to fig. 1, a schematic flow chart of a smart grid time sequence anomaly detection method based on a capsule network according to an embodiment of the present disclosure is provided. As shown in fig. 1, the method mainly comprises the following steps:

further, before the step 1, the method further includes:

acquiring historical data of the target power grid;

Optionally, the feature extraction layer includes three layers of one-dimensional convolutional neural networks.

On the basis of the above embodiment, the step 1 specifically includes:

In specific implementation, a capsule network is adopted to extract a multidimensional time sequence for classification, iterative learning is required to be carried out on the capsule network before classification is carried out, and the fact that a training data set lacks labels and normal data are more than abnormal data is considered. 10 abnormal types of the typical service server of the power information system can be defined by combining the actual operation and maintenance scene of the power grid and expert knowledge, and various types of abnormal data and fault data are injected into the data set, so that the diversity of the abnormal types is guaranteed. In addition, in order to ensure the scientificity of the data set, a statistical discrimination and an unsupervised algorithm are used for judging, a large number of positive samples are filtered, suspected abnormalities are output, and labeling is carried out. A total of 15 anomalies were noted in the data set, with normal data noted as 0. The problem of unbalance of positive and negative samples of the data set is solved by adopting an up-sampling and over-sampling technology, so that the ratio of normal data to abnormal data is 1: 1. And finally, performing abnormal classification on the labeled data set by using NNCapsNet, and then iteratively training the capsule network by using the training set, the verification set and the test set until an iteration stop condition is reached to obtain the trained capsule network.

Then, inputting the operation and maintenance data into a feature extraction layer composed of three layers of one-dimensional convolution neural networks, performing one-dimensional convolution through window sliding to fully extract features of a time sequence, capturing time dependence and correlation of the time sequence, processing multi-dimensional time sequence data and extracting complex intrinsic features, and obtaining the time sequence feature set through linear activation, wherein the time sequence feature set is specifically shown as the following formula:

wherein x _t Input representing an operation and maintenance monitoring time series corresponding to time t, x _tk It is shown that the k-th feature,

representing a convolution operation, a _tk Representing shared weight of connection input, b _k Indicating deviation, f (.)And representing an activation function, wherein the activation function can be a ReLu function.

optionally, the step 2 specifically includes:

each of the time sequential sub-capsules is compressed using a squash function.

In specific implementation, the time sequence sub-capsules can be obtained by encapsulating the time sequence feature set according to feature vectors at different positions, wherein the feature vectors comprise positions, sizes and directions of features, and then compressing each time sequence sub-capsule by using a square function. The capsule is a multidimensional vector neuron, encapsulating important information about the characteristics of the subject. In general, the length of the output vector represents the probability of existence of a certain class instance, and the direction represents the pose information such as the position, size and direction of the feature. The capsule network is a novel deep neural network and is characterized in that vector calculation is used among capsules instead of traditional scalar calculation, and the vector calculation among capsules can detect the existence of a specific example.

further, the step 3 comprises:

In one embodiment, each time series capsule is a multi-dimensional vector, denoted as μ _i Each time series sub-capsule encodes features extracted over a period of time, and each latitude of the vector represents an abstract feature. Then, for the father capsule V _j A prediction is made that characterizes the time series. Wherein the weight matrix W _ij Representing a part-whole relationship between the ith child capsule and the jth parent capsule. As shown in equation (2):

in the formula: mu.s _i The i-th capsule representing the upper layer, W _ij A matrix of the weights is represented by,

representing the prediction vector.

The prediction of a time-sequential capsule requires that most of it point to the red centroid of the same parent capsule. Time sequence sub-capsule is obtained by adjusting coupling coefficient C _ij To determine which timing parent capsule to route to, coupling coefficient C _ij Calculated by the softmax function, as in equation (3):

C _ij ＝exp(b _ij )/∑ _m exp(b _mk ) (3)

in the formula: sigma _j C _ij ＝1，C _ij >0。b _ij Is a temporary variable, initialized to 0. Output vector S _j All prediction vectors can be summed by weighting

As shown in equation (4):

in the formula: using a square function to make an output vector V _j Is not more than 1, thereby representing a time-series characteristicAnd detecting the probability. As shown in equation (5), where the index j represents the jth output vector.

In the formula: temporary variable b _ij Updated by equation (6)

In the formula: ". represents V _j And

the dot product of (a). The more similar the prediction of the time series capsule is to the characteristics of the time series, the larger the dot product of the two. Equation (6) by updating b _ij To further update the coupling coefficient C _ij ,V _j Modified S according to each forward propagation _j But may vary. And obtaining a group of optimal coupling coefficients through a dynamic routing loop iteration process.

In specific implementation, after all the time-sequence sub-capsules are routed to corresponding time-sequence parent capsules, a target capsule can be generated according to all the time-sequence parent capsules and reconstructed to generate a detection result, so that the abnormal type of the target power grid is judged.

According to the intelligent power grid time sequence anomaly detection method based on the capsule network, 1) an anomaly mode of a training data set is defined according to an actual operation and maintenance scene of a power grid, and anomaly data and fault data are injected into an existing data set by combining expert knowledge, so that the diversity of anomaly types is guaranteed. In addition, the method combining the up-sampling and the over-sampling solves the problem of unbalance of positive and negative samples.

2) And judging by adopting a statistical discrimination and unsupervised algorithm, filtering a large number of positive samples, outputting suspected abnormalities, and labeling the unmarked data set by combining expert knowledge.

3) The abnormal detection problem of the PC server monitoring data is processed based on an abnormal multi-classification model NNCapsNet of the capsule network, the model superposes a convolution structure and the capsule network to hierarchically extract the characteristics of an operation and maintenance monitoring time sequence and processes the time sequence data by combining scalar and vector calculation.

Therefore, the efficiency, the accuracy, the real-time performance and the adaptability of the power grid fault detection are improved.

The present solution will be described with reference to a specific embodiment, in this embodiment, a data set is collected from monitoring time series data of marketing service application server production monitoring data of the network Ningxia electric power company, and attributes of the data set are shown in table 1. The data set provides server monitoring data from 3/1/2020 to 5/31/2020 with a sampling interval of once every 5 minutes. The categories of dataset attributes include: the number of host processes, the usage rate of SysCpu, the usage rate of NiceCpu, the usage rate of UserCpu, the memory load, the healthy running time, the average load of host CPU, the usage rate of idleccu, the usage rate of virtual memory, and the state are shown in table 1.

TABLE 1

And finally, selecting three attributes of UserCpu utilization rate, memory load and host CPU average load as the measurement indexes of the abnormal detection by analyzing the attributes of the data set. The memory load can reflect the state of the memory change of the server, and the average load of a host CPU and the utilization rate of the UserCpu can reflect the health condition of the CPU from the whole situation and the local situation. The three attributes can comprehensively reflect the running health condition of the server.

Due to the lack of labels in the training data set, and much more normal data than abnormal data. Therefore, the data set needs to be processed, abnormal data is injected, and an unsupervised algorithm is used for mining suspected abnormality and labeling. The method of constructing a data set herein comprises three steps: defining an anomaly pattern, injecting anomaly data, and mining suspected anomalies using an unsupervised algorithm.

According to the actual operation and maintenance scene of the power grid and expert knowledge, 10 types of fault data are defined in total. And when the utilization rates of the UserCpu utilization rate, the memory load and the host CPU average load reach 100%, the server is blocked and is marked as 1. When the utilization rate of the memory load is 0, the memory cannot be accessed, and the reference is 2. When the utilization rates of the three are all 0, the server crashes and is marked as 3. When both the UserCpu utilization and the host CPU average load utilization are 0, the CPU is not accessible, labeled 4. When the UserCpu usage and memory load are 0, the CPU and memory are simultaneously failing, labeled 5. When UserCpu usage is 0, the application server is down, labeled 6. When the memory load and the host CPU average load are not coordinated and changed, the performance of the server is disordered, and the service operation state of the server is not consistent with the actual monitoring threshold design logic. Where the memory load is at a peak state and the host CPU average load is at a low peak state, labeled 7. The host CPU average load is at a peak state and the memory load is at a low peak state, labeled 8. When the memory load and the UserCpu utilization rate are not coordinated and changed, the performance of the server is disordered, and the service operation state of the server is not consistent with the actual monitoring threshold value design logic. Where UserCpu usage is at peak and memory load is at low peak, labeled 9. The memory load is at a peak state and UserCpu usage is at a low peak state, labeled 10.

According to a well-defined abnormal mode, abnormal data in the data set are mined, fault data are injected at the same time, and the unbalanced problem of the data set is solved by adopting an oversampling and upsampling technology, so that the data of each abnormal type is 400.

In addition to the already defined anomaly types, it is intended herein to exploit unsupervised algorithms to mine suspected anomalies in the data set. And filtering a large number of positive samples by using a statistical discrimination and unsupervised algorithm, and manually labeling the positive samples and the negative samples. The method utilizes the idea of ensemble learning, adopts a statistical anomaly detection method 3-sigma and an unsupervised anomaly detection algorithm to isolate forests, k-means clusters and a one class SVM. The principle of the 3-sigma algorithm and various unsupervised algorithms is as follows:

3-sigma: the data need to follow a normal distribution. Under the 3sigma principle, an outlier can be considered to be an outlier if it exceeds 3 times the standard deviation. If the data does not follow a normal distribution, it can also be described by a 3-fold standard deviation from the mean.

Outliers are small and distinct observations and are therefore easier to identify. The isolated forest integrates isolated trees, isolating outliers in a given data point. The tree path for an outlier data point is shorter than other normal data points.

And (3) K-means clustering, namely, distributing data to K clusters in continuous iteration cycles by calculating the distance from the sample object to each clustering center, and finding abnormal values by predefining good scores.

one class SVM classifies time series data into two categories by modeling the density distribution of training data: normal and abnormal.

The combination of multiple algorithms increases the filtering capacity of normal samples and improves the accuracy. The unsupervised algorithm detects suspected abnormalities as shown in fig. 2:

as shown in fig. 2, the multivariate time series is divided into univariate time series, and the user CPU utilization, the memory load, and the host CPU average load are respectively subjected to anomaly detection. The logic of anomaly detection based on statistical discrimination and unsupervised algorithm is that firstly, anomaly is detected based on statistical discrimination 3-sigma algorithm, and under the 3-sigma principle, if sample data exceeds 3 times of standard deviation, the sample data can be regarded as an abnormal value and directly marked as suspected anomaly. And if the 3-sigma algorithm is detected to be normal, detecting by using an unsupervised algorithm and outputting suspected abnormality. The k-means algorithm firstly carries out clustering on the time sequence, secondly determines an abnormal score according to the distance from the subsequence to the clustering center, and judges that the abnormal score is suspected to be abnormal when the abnormal score is larger than a certain threshold value. The anomaly detection algorithm based on the isolated forest specifies that data close to the root node of the binary tree is abnormal data, and normal data are far away from the root node of the binary tree. And modeling the data by using a one class SVM algorithm, and dividing abnormal data. And if the 3-sigma algorithm is detected to be normal, performing joint detection by using the three unsupervised algorithms, and marking the time points of two or more algorithms considered to be abnormal as suspected abnormalities by utilizing the idea of ensemble learning.

FIG. 3 shows how suspected anomalies mined based on statistical discrimination and unsupervised algorithms are labeled. Firstly, respectively using an unsupervised algorithm to detect the UserCpu utilization rate, the memory load and the host CPU average load, and if the UserCpu utilization rate and the memory load are detected to be abnormal at the same time point, marking as 11. Meanwhile, when the memory load and the host CPU average load are simultaneously detected as abnormal at the same time point, it is labeled as 12. When only the UserCpu usage is abnormal at a certain point in time, it is marked 13. When only the memory load is abnormal at a certain point in time, it is labeled as 14. Similarly, when only the host CPU average load is abnormal at a certain point in time, it is labeled 15. Because normal data is much more than detected suspected abnormality, the problem of imbalance of positive and negative samples of a data set is solved by adopting an oversampling technology.

The labeled data set is shown in table 2, and the ratio of positive and negative samples is 1:1, both positive and negative sample data entries are 7000. The negative examples include 15 types of abnormal data, the data entries from tag 1 to tag 10 are all 400, and the data entries from tag 11 to tag 15 are all 600.

TABLE 2

The data set is collected from UserCpu utilization rate, memory load and host CPU average load data of the production monitoring data of the marketing service application server of Ningxia electric power company Limited in China network, and statistical data about each monitoring data index is shown in Table 3. All algorithms herein were implemented using Python3.8, and the experimental environment used Window10, AMD Ryzen 53550H with RadeonVega Mobile Gfx 2. 10GHz, 16Gbyte memory. The neural network is implemented using a Pytorch 1.4.0+ cu 92.

TABLE 3

According to the method, an abnormal multi-classification model based on the capsule network is established. In order to keep the latitude of the input data, the four latitudes of year, month, day and minute are extracted from the time stamp, and the usage rate of UserCpu, the memory load and the average load of the CPU of the host computer are added. Thus, the size of the input layer is 7 × 1. The batch size of the experiment is 100, the training times are 200, and the learning rate is 1 e-3. The feature extraction layer is composed of 3 layers of 1D-CNN (kernel size: 3, stride: 1, padding: 2). The capsule length of the sub-capsule layer is 4D, and the number of the capsules is 16. The parent capsule layer is composed of 16 8D capsules, each corresponding to the probability of occurrence of an abnormal class. More detailed experimental superparameters are shown in table 4:

TABLE 4

The capsule network loss function consists of two parts, the interval loss (margin loss) and the reconstruction loss (reconstruction loss). Wherein the interval loss function expression is:

L _k ＝T _k max(0,m ⁺ -||v _k ||) ² +λ(1-T _k )max(0,||v _k ||-m ^- ) ² (7)

t in formula (7) _k Denotes where the value of k is 1 when present, otherwise 0.m ⁺ Indicating an upper bound of punishment false positives. m is ^- The lower bound of penalty false negatives is indicated. M in the experiment ⁺ ＝0.9，m ^- ＝0.1，λ＝0.5。

The effectiveness of the abnormal multi-classification of the training data set and the testing data set can be evaluated through different indexes, the relation between the false positive rate and the true positive rate is drawn through an ROC curve, and the performance of the model is evaluated through calculating the Area (AUC) under the ROC curve. The AUC value can visually reflect the effect of the classifier, and the classification effect is better when the value is larger. In addition, top k (k ═ 1,2) accuracy, precision (p), recall (r), and F1-Score (F1) were used herein to further measure the performance of the model. They are defined as follows:

top k accuracy is calculated by determining if the correct tag is among the first k predicted tags. The top ACC1 is used herein to represent the calculation of top 1 accuracy in 1 predictive tag and the top ACC2 is used to represent the calculation of top 2 accuracy in the first 2 predictive tags. In addition, the false positive rate and true positive rate of the AUC curve are defined as follows:

where TP represents the number of true positive results, FP represents the number of false positive results, TN represents the number of true negative results, and FN represents the number of false negative results. Precision represents the ratio of the number of correctly predicted positive samples to the number of all predicted positive samples. Recall represents the ratio of the number of correctly predicted positive samples to the total number of true positive samples. F1-score reflects the harmonic mean of model accuracy and recall.

The training set, test set, and validation set are divided into 6:2:2 sets to evaluate the performance of NNCapsNet, and the classification of each label in the test set is summarized in FIGS. 4 and 5. Wherein fig. 4 visually reflects the classification performance of each label using a histogram, and fig. 5 plots an ROC graph of each label. As can be seen from fig. 4 and 5, each label achieves a better classification effect. The label 1 has the best classification effect, and the Accuracy, AUC, precision, call and F1-score all reach 1. It follows that NNCapsNet can identify such abnormalities very well. Namely, when the utilization rates of the UserCpu utilization rate, the memory load and the host CPU average load all reach 100%, the server is blocked. The label 2, the label 3, the label 4, the label 6, the label 8 and the label 9 all achieve a good classification effect, and the Accuracy, precision, call and F1-score all reach more than 0.95. The AUC values for all tags except tag 2 were 1, except for 0.988. Experimental results show that the NNCapsNet can well identify faults such as dead halt of a server, failure in accessing a CPU, simultaneous faults of the CPU and a memory, interruption of an application server, server performance disorder, inconsistency of a service operation state of the server with an actual monitoring threshold design logic and the like. In addition, Accuracy, call and F1-score of

Claims

1. A smart grid time sequence anomaly detection method based on a capsule network is characterized by comprising the following steps:

2. The method of claim 1, wherein prior to step 1, the method further comprises:

acquiring historical data of the target power grid;

3. The method of claim 1, wherein the feature extraction layer comprises three layers of one-dimensional convolutional neural networks.

4. The method according to claim 1, wherein step 1 specifically comprises:

5. The method according to claim 1, wherein the step 2 specifically comprises:

each of the time sequential sub-capsules is compressed using a squash function.

6. The method of claim 1, wherein step 3 comprises:

7. A smart grid time series anomaly detection system based on a capsule network is characterized by comprising:

the calculation module is used for calculating the relation between all the time sequence sub-capsules and each time sequence father capsule according to a weight matrix and then updating the weight of the time sequence father capsule according to a dynamic routing protocol;