CN117057150A - Water supply network pipe explosion detection and identification method based on unsupervised superposition integration - Google Patents

Abstract

The invention provides a water supply network pipe explosion detection and identification method based on unsupervised superposition integration, which aims to detect and identify abnormal situations of a water supply network caused by faults of pipe explosion and a monitoring system of the water supply network and clean abnormal monitoring data. The method comprises a single-point abnormality recognition module and a time sequence abnormality recognition module, and various abnormal situations are recognized and distinguished according to the abnormality alarming conditions of the sensors and the association conditions among the sensors. Alarming the abnormal situation in time after the abnormality is found, identifying the duration of the abnormal situation and cleaning the abnormality monitoring data. Based on the example pipe network model Net3, the case study is carried out, and the result shows that the proposed method can accurately identify the pipe explosion and distinguish the abnormal situations of various sensor data.

Description

Water supply network pipe explosion detection and identification method based on unsupervised superposition integration

Technical Field

The invention belongs to the field of detection of pipe explosion of an urban water supply network, and particularly relates to a water supply network pipe explosion detection and identification method based on unsupervised superposition integration.

Background

Burst tubes are a major form of water loss in water supply systems, which are large in water loss despite their short duration. The pipe explosion not only can cause a large amount of water resource waste, but also can cause the pipe network pressure to decrease so as to influence normal water supply. In addition, the pipeline is easy to invade after being broken, so that the quality of drinking water is affected. The pipe explosion detection method can help water supply companies to find out the pipe explosion in time, so that the pipe explosion is repaired, and the damage of the pipe explosion is reduced.

Various methods of burst detection have been proposed by researchers, and data-driven-based methods have been widely used due to the large number of uses of data acquisition and monitoring (SCADA) systems. Classification-based methods, prediction-based methods, and statistical-based methods can be classified according to the detection principle. The classification-based method trains the model with historical tube bursting data and then detects the tube bursting, but this method requires a large amount of historical tube bursting data. The prediction-based method is to train the model by using normal monitoring data, and then detect whether the real-time monitoring data is abnormal by using a model prediction value. The statistical method is to compare the historical monitoring data with the real-time monitoring data, and alarm if the real-time monitoring data exceeds the threshold value. Considering that prediction-based methods are affected by prediction accuracy, false alarms may occur. And the method based on statistics only utilizes the existing data characteristics to detect the tube explosion, and omits the prediction process, thereby obviously improving the tube explosion detection precision. Various statistical-based methods are widely used, such as detecting a pipe burst using similarities (or dissimilarities) between multiple sensor flow monitoring data in a water supply network. The method converts flow monitoring data of different sensors into vectors, and identifies the pipe explosion by using the low similarity between the vector induced by the pipe explosion and other normal vectors. Furthermore, the similarity-based approach eliminates the impact of non-stationary conditions (e.g., weather, holiday, and seasonal variations) on detection performance. Pressure sensors are widely used in water supply networks compared to the expensive price of flow sensors. When a pipe network explodes, the pressure of each node of the pipe network is generally reduced suddenly, so most researches monitor the explosion based on abnormal values in the pressure monitoring values. And once the monitoring value of the pressure sensor is found to be remarkably reduced compared with the contemporaneous historical data, a pipe explosion early warning is sent out. The squib features are extracted from existing pressure monitoring data, for example, using interference extraction and independent forest integration techniques.

These methods all consider tube burst detection as anomaly detection, and although good detection performance is achieved, the influence of anomaly monitoring data is not considered. The accuracy of the tube burst detection of the above method may be suspected when the quality of the monitored data is poor. In addition, these methods cannot distinguish between bad data and pipe burst event data, nor can they identify various types of SCADA faults. In practice, besides the occurrence of abnormal values caused by pipe explosion, the occurrence of abnormal values is caused by the failure of the SCADA system. The SCADA system collects data from the plurality of sensors and then transmits it to a control center or application. Typically, the sensor will acquire the correct data, but when the sensor fails or fails in communication, the monitored data will be incorrect. In addition, network attacks may also cause anomalies in the monitored data. Obviously, if the tube explosion detection method does not consider the influence of abnormal values, the tube explosion detection result is misled once the SCADA system monitoring data is abnormal, and a large number of false alarms are generated. For a long time, the accuracy of the tube explosion detection system is doubted by a water supply company, so that the application of the method in practice is limited. On the one hand, when monitoring data are abnormal, the detection precision of the tube explosion can be influenced. On the other hand, if abnormal monitoring data cannot be identified and cleaned, the data can influence subsequent pipe explosion detection after being imported into a database. Considering the influence of weather and seasonal changes on water demand, the historical monitoring values need to be updated irregularly, and the latest monitoring data is added into the historical database to replace older historical monitoring data. When the latest monitoring data is added, the abnormal value in the monitoring data needs to be cleaned, so that the historical monitoring data can accurately reflect the normal operation condition of the pipe network. In view of the fact that monitoring of a water supply network is a continuous process, updating of a historical database and cleaning of latest monitoring data should be an online process. At the same time, the data update and cleaning process should be made more efficient.

Disclosure of Invention

Aiming at the problems, the invention aims to provide a water supply network pipe explosion detection and identification method based on unsupervised superposition integration, which considers the influence of abnormal monitoring data when detecting the pipe explosion, distinguishes the pipe explosion and monitoring system faults according to the alarm condition of an abnormal identification module when abnormal values occur in real-time monitoring data, determines the type and duration of the abnormal values, and simultaneously cleans the abnormal monitoring data.

In order to achieve the technical characteristics, the aim of the invention is realized in the following way: the water supply network pipe explosion detection and identification method based on the non-supervision superposition integration is characterized by comprising the following steps of:

step (1): performing hydraulic simulation on the pipe network model by using the EPANET to obtain pressure monitoring data of each pressure monitoring point under normal working conditions and abnormal working conditions of the water supply pipe network;

step (2): constructing a water supply network pipe explosion detection and abnormality identification frame, wherein the frame comprises 4 abnormality detection modules: (a) a single point anomaly detection module; (b) a single point qualitative detection module; (c) a monitoring point self-sequence module; (d) a sequence module between monitoring points;

step (3): training data is prepared, each abnormal detection module is trained, and the threshold value of each module is determined;

Step (4): and detecting various abnormal situations by using an abnormal detection frame to obtain the condition that pipe network pipe explosion and monitoring points are in fault.

Preferably, the step (1) specifically includes the following steps:

step (1.1), carrying out hydraulic simulation on a pipe network by utilizing the EPANET to obtain pressure monitoring data of each pressure monitoring point under normal working conditions of the pipe network, wherein the pressure monitoring data are shown in the following formula:

in the method, in the process of the invention,represents pressure monitoring point k under normal working condition of pipe network ₁ Pressure monitoring data at time t of day 0,

represents pressure monitoring point k under normal working condition of pipe network _n In the nth _d Pressure monitoring data at time t;

step (1.2), carrying out hydraulic simulation on the condition of pipe bursting of each pipeline of the pipe network by utilizing the EPANET to obtain pressure monitoring data of each pressure monitoring point when the pipe network bursts, wherein the pressure monitoring data are shown in the following formula:

in the method, in the process of the invention,representing pipe network pipe ₁ Pressure monitoring point k after pipe explosion ₁ Pressure monitoring data at time t; />Representing pipe network pipe _P Pressure monitoring point k after pipe explosion _n Pressure monitoring data at time t;

step (1.3), considering the situation that the monitoring point breaks down, adding partial error data into the pressure monitoring data under the normal working condition of the water supply network to obtain the pressure monitoring data under the situation that the monitoring point breaks down, and considering the following situations: (a) an anomaly monitoring value; (b) data delay; (c) monitoring point number errors.

Preferably, the step (2) specifically includes the following steps:

step (2.1), constructing four abnormality detection modules, detecting single-point abnormality and time sequence abnormality in pressure monitoring data of each pressure monitoring point, detecting abnormal values in real-time monitoring data of a water supply pipe network, and realizing abnormality detection;

and (2.2) if abnormal values exist in the real-time monitoring data of the water supply network, distinguishing various abnormal situations of various water supply network according to the alarm conditions of the four abnormal detection modules, and accurately distinguishing the conditions of pipe explosion of the water supply network and faults of the monitoring system.

Preferably, the step (2.1) specifically includes:

step (2.1.1), single-point anomaly detection module research and development:

the single-point anomaly detection module mainly detects single anomaly monitoring data, integrates various machine learning algorithms for improving the accuracy of single-point anomaly detection, and is divided into three layers: (a) the first layer is an independent forest algorithm; (b) The second layer is K-means clustering and local outlier probability algorithm; (c) The third layer is the integration of the K-means clustering and the output result of the local outlier probability algorithm;

for monitoring point k _i The input data of the single-point abnormality recognition module is as follows:

wherein:for monitoring point k _i In the nth _d Monitoring value at time t;

first, p (k _i ) Inputting into independent forest algorithm to obtain each p ^t (k _i ) Is an anomaly score of (2):

in the method, in the process of the invention,represents p (k) _i ) The i-th observation p in (a) _i ^t (k _i ) I=0, 1, …, n _d ，c(n _d +1)＝/>For searching unsuccessful average path lengths in a binary search tree, tr is the total number of trees and,is the observation +.>Path length of>Is->Average value of (2);

after obtaining the abnormal scores of the real-time monitoring data of each monitoring point, taking the abnormal scores of the real-time monitoring data as input, entering a second layer of the single-point abnormal detection module, and obtaining the abnormal detection results of the abnormal scores in the K-means clustering and the local abnormal value probability algorithm respectively;

in K-means clustering, for s ^t (k _i ) Clustering the abnormal scores in the database to obtain binary data, wherein the binary data is 0 if normal and 1 if abnormal; in K-means clustering, the initial cluster list isEach->Is divided into clusters nearest to its square Euclidean distance:

wherein:is the ith cluster; s is(s) _p A dataset for each anomaly score; />The monitoring value of the ith monitoring point at the moment of t number is obtained; / >The monitoring value of the j-th monitoring point at the moment of t is obtained; k is the total number of monitoring points; j is the number of the monitoring point; t is the time when each monitoring point collects data;

each cluster is then updated using the following equation:

wherein: s is(s) _j Score for each anomaly within the cluster;the ith cluster at the time t; />The clustering center of the ith cluster at the time t+1; x is x _j For cluster C _i A value of an inner jth anomaly score;

formally, the goal is to obtain a relationship shown in the following formula:

wherein ρ is the center of each cluster, varC _i For cluster C _i Variance of each anomaly score in the cluster, s is cluster C _i Abnormality score for each monitored data, C _i For the ith cluster, xi _i Is C _i Average of points in (a), i.e. minimizing the square deviation of each monitored value in the same cluster in pairs:

let C be the output of the K-means clustering algorithm, C be a set of n-magnitudes _d Clustering tag of +1, C _i =1 orx and y are monitoring values in the clusters, and k is the total number of monitoring value points;

obtaining the anomaly score of each monitored value in a local anomaly probability algorithmProbability of each of (a)The probability of (2) is defined by->The standard distance to the reference point R is obtained:

in the method, in the process of the invention,representation->And r, using Euclidean distance;

Point s _i The probability set distance to the reference point R has a "significance" λ, defined as:

then, using nearest neighbor as a reference set, the nearest neighbor is the nearest Euclidean distance between observations from independent forest algorithms, and for a given field size k and saliency λ, the values are monitoredThe probability local anomaly factor PLOF of is defined as:

finally, calculate to obtainProbability of becoming a local outlier:

let L be the output of the local outlier probability algorithm, a set of lengths n _d Probability of +1; l (L) _i Represents the ithProbability of becoming abnormal value is 0.ltoreq.l _i ≤1；

After the clustering result of each anomaly score and the probability of becoming an anomaly value are obtained, entering a third layer of the single-point anomaly detection module, and finally obtaining each real-time monitoring data s according to the output result of the K-means clustering and the local anomaly value probability algorithm ^t (k _i ) The probability of becoming an outlier is determined,ith observation s ^t (k _i ) The probability of becoming an outlier is:

P _i ＝C _i ·l _i ；

in K-means clustering, the number of clusters k= 2,K-means clustering divides all monitor values into normal and abnormal two groups, since it minimizes the sum of squares, thereby avoiding adding more weight to monitor values other than normal data, dividing normal data into the same cluster, however, in the second group, normal data or small changes may be considered as outliers, normal data is marked 0, abnormal data is marked 1, and therefore c _i =0 represents normal data, c _i =1 denotes an outlier, and l is near 0 _i Normal data are represented, normal data are prevented from being distributed to abnormal values by multiplying the K-means clustering result by the local abnormal value probability algorithm result, normal data detected by the K-means clustering are covered, and accuracy is improved by integrating the K-means clustering result with different methods.

Preferably, the step (2.1) further includes:

step (2.1.2), single-point qualitative detection module research and development:

the single-point qualitative module is mainly used for judging the monitoring value of each moment, and for a single monitoring point k, the single-point qualitative module is firstly used for judging the monitoring value according to the historical monitoring valuei＝1,2,…,n _d Obtaining qualitative threshold [ ζ ] ^- (k),ξ ⁺ (k)]：

Will beWith xi ^- (k) And xi ⁺ (k) For comparison, three cases are divided: if->Output-1; if->Then output 0; if->Then output 1.

6. The method for detecting and identifying the pipe explosion of the water supply network based on the unsupervised superposition integration according to claim 4, wherein the step (2.1) further comprises:

step (2.1.3), research and development of a monitoring point self sequence module:

the monitoring point self-sequence module is used for detecting time sequence dissimilarity of monitoring data of different days of the monitoring points, time sequence curves of different days and the same time period of a single monitoring point are similar to each other under normal working conditions of the water supply network, and when the working conditions of the water supply network change or the monitoring data are abnormal, the dissimilarity of the time sequence of the monitoring point monitoring data self-sequence can change;

For a single monitoring point k _i Calculating to obtain the time series of the monitoring data at the t moment of the i day and the j dayAnd (3) withSequence distance between->

Wherein M is _i,j (k _i ) Is thatAnd->Dot product of->Sum sigma _i (k _i ) Respectively the monitoring points k _i Mean and standard deviation of time series at time t of day i;

monitoring point k _i Current time and previous n _d The time series distance of the day corresponding time is expressed asAnd obtain a minimum +.>

According to the first n _d Time series distance of monitoring data at time of day tCalculating to obtain decision threshold value xi ₂ (k _i )：

In the method, in the process of the invention,and->Respectively time series distance->(i≠j,i,j＝1,2,…,n _d ) Mean and variance of (a);

at the decision threshold value xi ₂ (k _i ) After that, it is combined with the minimum threshold valueComparing ifThen the monitoring point k is indicated _i And outputting a detection result 0 when the monitoring data time sequence at the current moment is not abnormal, and outputting a detection result 1 when the monitoring data time sequence at the current moment is not abnormal.

Preferably, the step (2.1) further includes:

step (2.1.4), research and development of a sequence module between monitoring points:

the sequence module among the monitoring points is mainly used for detecting whether the time series dissimilarity of the monitoring data of different monitoring points changes or not, under the normal working condition of the water supply network, the dissimilarity of the time series of the monitoring data of different days among the monitoring points is similar, and when the working condition of the water supply network changes or the monitoring data is abnormal, the dissimilarity of the time series of the monitoring data among the monitoring points changes;

The time sequence dissimilarity between different monitoring points indicates the distance between the monitoring points and the time sequence of the same day and the same time between the monitoring points, for two monitoring points k ₁ And k ₂ Time series of (2)And->D for its dissimilarity _i (k ₁ ,k ₂ ) The representation is:

wherein M is _i (k ₁ ,k ₂ ) Is thatAnd->Dot product of->μ _i (k ₁ ) Sum sigma _i (k ₁ ) Respectively->Mean and standard deviation, sigma _i (k ₁ ) Sum sigma _i (k ₂ ) Respectively->And->Standard deviation of (2);

calculating to obtain the monitoring point and the current time and the previous n of the monitoring point _d Time series distance d of day corresponding time ^t (k ₁ ,k ₂ )：

In the method, in the process of the invention,represents the current t moment monitoring point k ₁ And k ₂ Distance between time series,/, for>Represents the first n _d Monitoring point k at time t ₁ And k ₂ Distance between time series;

according to the first n _d Time sequence distance calculation at time t of day to obtain decision threshold value xi ₁ ，ξ ₁ From the following componentsAverage and variance of (a) are obtained:

wherein μ (d ^t (k ₁ ,k ₂ ) And sigma (d) ^t (k ₁ ,k ₂ ) Respectively representing time series distances(i＝1,2,…,n _d ) Mean and variance of (a);

at the decision threshold value xi ₁ (k ₁ ,k ₂ ) After that, it is separated from the time seriesComparing ifThen the monitoring point k is indicated ₁ And k ₂ And outputting a detection result 0 when the monitoring data at the current moment is abnormal, and outputting a detection result 1 when the monitoring data at the current moment is not abnormal.

Preferably, the step (2.2) is specifically as follows:

step (2.2.1), distinguishing abnormal events mainly comprises distinguishing the fault condition of a blasting SCADA system, and distinguishing the fault condition through qualitative thresholds of all monitoring points and self sequence alarm conditions of all monitoring points; after pipe bursting occurs in the pipe network, the pressure of the pipe network node is reduced due to the increase of the flow demand in the pipe network; therefore, the qualitative threshold value of each monitoring point at each moment is-1 or 0, namely, the situation that the monitoring point fails once the qualitative threshold value is 1 appears; classifying various anomalies according to the anomaly detection results of the anomaly detection modules;

Step (2.2.2), judging the abnormal alarm and false alarm conditions according to the qualitative threshold, if the qualitative threshold at each moment of all monitoring points is 0, the abnormal detection result is false alarm, the SCADA system monitoring data is abnormal and not alarm, otherwise, the abnormal condition needs to be distinguished;

and (2.2.3), wherein the pressure of the node is reduced after the pipe explosion occurs, so that the monitoring data value of each monitoring point is obviously lower than the normal value, the time sequence shape is not changed normally although the monitoring data value is reduced after the pipe explosion occurs in the pipe network, namely, the monitoring point self sequence does not continuously alarm, therefore, if the condition that the monitoring point self sequence continuously alarms occurs, the condition is considered to be the condition that the SCADA system fails, and meanwhile, the monitoring point with the alarm occurs in the self sequence is the monitoring point with the failure.

Preferably, the step (3) specifically includes:

step (3.1), preparing single-point historical monitoring data of each pressure monitoring point under normal working conditions of the water supply network, wherein the single-point historical monitoring data are represented by the following formula:

in the method, in the process of the invention,representing a monitoring point k ₁ Pressure monitoring data, k at time t _i (i=1, 2, … n) represents the ith monitoring point arranged in the pipe network, and when monitoring values at all time points are detected, the monitoring points are mainly +. >And->Comparing, confirming->Whether the value is abnormal or not, namely, comparing the value of each column in the formula;

step (3.2), obtaining time series data of each monitoring point and historical time series data corresponding to the time series data, wherein the time series data are represented by the following formula:

in the method, in the process of the invention,representing a monitoring point k ₁ Time series data at time t:

S ^t (j)＝{p ^t-l+1 (j),p ^t-l+2 (k),…,p ^t (j)}；

wherein p is ^t-l+1 (k) Data representing the monitoring point k at the time t-l+1, wherein l is the length of the time sequence;

and (3.3) training and testing the four abnormal detection modules by utilizing various monitoring data under the normal working condition and the abnormal working condition to obtain the threshold value of each abnormal detection module.

Preferably, the step (4) specifically includes:

step (4.1), inputting real-time monitoring data of a pipe network under various abnormal working conditions into a pipe explosion detection and abnormality identification framework to obtain alarm conditions of each module;

step (4.2), evaluating the performance of the proposed method according to the pipe explosion detection and anomaly identification results, considering the following three performance evaluation indexes: 1) Detecting accuracy (sigma) ₁ ) The method comprises the steps of carrying out a first treatment on the surface of the 2) Abnormality recognition rate (sigma) ₂ ) The method comprises the steps of carrying out a first treatment on the surface of the 3) Abnormality detection rate (σ) ₃ )；

Wherein N is _dn 、N _n And N _in Respectively representing the detected abnormal event, the total abnormal event and the number of the correctly identified abnormal events; t is t _dn And t _t Representing the duration of detection and the actual duration of the abnormal event, respectively, it is evident that σ ₁ 、σ ₂ Sum sigma ₃ The higher the better.

The invention has the following beneficial effects:

the invention provides a method for identifying abnormal values of a pipe explosion detection and monitoring system. The method considers the influence of abnormal monitoring data when detecting the pipe explosion, distinguishes the pipe explosion and the monitoring system fault according to the alarm condition of the abnormal identification module when the abnormal value occurs in the real-time monitoring data, determines the type and duration of the abnormal value, and simultaneously cleans the abnormal monitoring data. Based on the example pipe network model Net3, the case study is carried out, and the result shows that the proposed method can accurately identify the pipe explosion and distinguish the abnormal situations of various sensor data.

Drawings

The invention is further described below with reference to the drawings and examples.

FIG. 1 is a flowchart of one embodiment of a method for detecting and identifying a pipe explosion of a water supply network based on unsupervised superposition integration.

Fig. 2 is a schematic diagram of an exemplary pipe network Net3 of an embodiment of the present invention, EPANET.

FIG. 3 is a time series plot of pressure monitoring data according to an embodiment of the present invention: (a) normal operating conditions; (b) pipe network pipe explosion; (c) failure of part of the monitoring points; (d) all monitoring points fail.

Fig. 4 is a flowchart of a water supply network pipe explosion detection and identification method based on unsupervised superposition integration, which is provided by the invention: (1) abnormality detection; (2) abnormality classification.

FIG. 5 shows alarm conditions of each module after pipe explosion of the pipe network according to the embodiment of the invention: (a) a single point anomaly detection module; (b) a monitoring point self sequence module; (c) a sequence module between monitoring points; (d) a single point qualitative detection module.

FIG. 6 shows the alarm conditions of each module after a single monitoring point fails in an embodiment of the present invention: (a) a single point anomaly detection module; (b) a monitoring point self sequence module; (c) a sequence module between monitoring points; (d) a single point qualitative detection module.

FIG. 7 shows the alarm condition of each module after two monitoring points fail in accordance with the embodiment of the present invention: (a) a single point anomaly detection module; (b) a monitoring point self sequence module; (c) a sequence module between monitoring points; (d) a single point qualitative detection module.

FIG. 8 shows the alarm condition of each module after the three monitoring points fail in the embodiment of the present invention: (a) a single point anomaly detection module; (b) a monitoring point self sequence module; (c) a sequence module between monitoring points; (d) a single point qualitative detection module.

Fig. 9 illustrates anomaly detection rates, detection accuracy rates, and anomaly recognition rates for various anomaly scenarios according to an embodiment of the present invention.

Detailed Description

Embodiments of the present invention will be further described with reference to the accompanying drawings.

The embodiment of the invention provides a water supply network pipe explosion detection and identification method based on unsupervised superposition integration. The method comprises four abnormality detection modules, namely single-point abnormality, a monitoring point self sequence, a monitoring point sequence and single-point qualitative, wherein the frame effectively detects the faults of the explosion tube and the monitoring point by utilizing the single-point and time sequence abnormality of real-time monitoring data, and effectively distinguishes the faults of the explosion tube and the monitoring point according to the detection results of the four abnormality detection modules. The method specifically comprises the following steps:

and (1) carrying out hydraulic simulation on the pipe network model by utilizing the EPANET to obtain pressure monitoring data of each pressure monitoring point under normal working condition and abnormal working condition of the pipe network. The step (1) specifically comprises the following steps:

and (1.1) carrying out hydraulic simulation on the water supply network to obtain pressure monitoring data of each pressure monitoring point under the normal working condition of the network. As shown in fig. 2, the present invention uses an example pipe network model Net 3 as an example. Assuming that 3 pressure monitoring points, namely a monitoring point 169, a monitoring point 204 and a monitoring point 275 are arranged in the example pipe network model, simulating to obtain pressure monitoring data under normal working conditions of the pipe network;

Step (1.2), simulating the condition of pipe explosion of the water supply pipe network by using the EPANET to obtain pressure monitoring data of the pressure monitoring points 169, 204 and 275 after the pipe explosion of the pipe network;

step (1.3), consider the situation that the monitoring point breaks down, namely, the pressure monitoring data of 3 pressure monitoring points (monitoring point 169, monitoring point 204 and monitoring point 275) break down under the normal working condition of the pipe network, the invention considers 3 different situations: (a) Scenario 1, wherein monitoring data of a single monitoring point are abnormal; (b) Scenario 2, wherein monitoring data of two monitoring points are abnormal; (c) And 3, detecting abnormality of monitoring data of three monitoring points.

As shown in fig. 3, the time series curve of the pressure monitoring data of three pressure monitoring points for two days is that normal monitoring data is in a gray box, and abnormal monitoring data is in a gray box. As shown in fig. 3 (a), the network pressure monitoring data follows a specific periodic pattern, i.e., a typical daily demand pattern, under normal operating conditions. The time series of the monitoring data of the same monitoring point have similar shapes at the same moment, and the monitoring data curves of different monitoring points at specific times are similar. Under normal conditions, no anomaly is observed in the single value and time series of the monitored data. After pipe network is burst, the pressure of the node can be reduced due to the additional requirement generated by the burst. As shown in fig. 3 (b), the pressure monitoring data changes in both single value and time series after the tube explosion. Besides the abnormality of the monitoring data caused by the pipe explosion, the abnormality of the monitoring data can be caused by the failure of the monitoring points, and the abnormality of the monitoring data of part of the monitoring points and all the pressure monitoring points can be included. Fig. 3 (c) shows a case where abnormality occurs in the single pressure monitoring point monitoring data. The pressure monitoring point with faults monitors that the data are abnormal at a single moment, and the time sequence shape is changed. Fig. 3 (d) shows a case where abnormality occurs in the monitoring data of three pressure monitoring points (all), and abnormality occurs in the time-series curves of the three pressure monitoring points.

And (2) constructing a water supply network pipe explosion detection and abnormality identification framework, as shown in fig. 4. The framework contains 4 anomaly detection modules: (a) a single point anomaly detection module; (b) a single point qualitative detection module; (c) a detection point self sequence module; (d) a sequence module between monitoring points; specifically, assuming that each pipeline of the hydraulic model Net3 of the example pipe network is detonated, simulating the detonated pipeline by adopting pressure driving to obtain the pressure change of each node after the pipe network pipeline is detonated. The specific implementation process of the step (2) is as follows:

and step (2.1), detecting the monitoring data of each moment of the three monitoring points 169, 204 and 275 by using a single-point abnormality detection module, and confirming whether the monitoring data is an abnormal value or not. For example, the pressure monitoring values at the three monitoring points at 1h are 47.39, 39.22 and 40.19, respectively. Taking the monitoring point 169 as an example, the historical monitoring value of the past 5 days at 1h is [47.38,47.36,47.38,47.37,47.38 ]]47.39 and [47.38,47.36,47.38,47.37,47.38 ]]Input into the anomaly detection module together to obtain probability scores of the respective values, confirm whether 47.39 is an anomaly value, if P _i If the value of (1) is an abnormal value, if P _i If the value of (2) is 0, it is a normal value;

And (2.2) detecting the monitoring data of each moment of the three monitoring points 169, 204 and 275 by using a single-point qualitative detection module to confirm whether the monitoring data is an abnormal value or not. For example, the pressure monitoring values at the three monitoring points at 1h are 47.39, 39.22 and 40.19, respectively. Taking the monitoring point 169 as an example, 47.39 and are input into an order point detection module, and the order point detection module is connected with a threshold value xi ^- (k) And xi ⁺ (k) A comparison is made. If it is43.79 is less than ζ ^- (k) Outputting-1; if 43.79 is greater than ζ ⁺ (k) Output 1; otherwise, outputting 0;

and (2.3) detecting the time sequences of the three monitoring points 169, 204 and 275 by using a monitoring point self sequence module, and confirming whether the time sequences of the monitoring points change or not. For example, if the length of the monitored data time series is 5, the monitored data time series includes 5 monitored data including the current time and the first 4 times, and the 5 monitored data of the 1h-2h monitoring point 169 are sequentially: 47.39, 47.46, 47.53, 47.60 and 48.34, calculated using the time series and the time series 15 days before the monitoring point 169Then will->With xi ₂ (k _i ) Comparing ifThen output 0, indicating that the time series of the monitoring point 169 is not abnormal at the current time; otherwise, output 1 indicates that the time sequence of the current moment of the monitoring point 169 is abnormal;

Step (2.4), detecting the time sequence dissimilarity among the three monitoring points 169,204 and 275 by using a sequence module among the monitoring points, and determining whether the time sequence shape among the monitoring points changes, wherein for the three monitoring points, 3 groups of time sequences need to be judged, namely: [169, 204], [169, 275] and [204, 275]. For example, it is determined whether or not the time series at a certain time is changed [169, 204] and calculated

And then calculate and get xi ₁ (169,204) will be->With xi ₁ (169,204) comparison, if->The monitoring data indicating the current time of the monitoring points 169 and 204 is not abnormal, and the detection result 0 is output. Otherwise, outputting the detection result 1.

And (3) preparing training data, training each module, and determining the threshold value of each module. The specific implementation process of the step (3) is as follows:

step (3.1), preparing normal working condition history monitoring data, normal working condition monitoring data and abnormal working condition monitoring data of three monitoring points 169,204 and 275, inputting the normal working condition history monitoring data, the normal working condition monitoring data and the abnormal working condition monitoring data into a single-point abnormal detection module for training a model, determining a threshold value of the single-point abnormal detection module, ensuring that the threshold value does not alarm on the monitoring data under the normal working condition, and alarming on the monitoring data under the abnormal working condition;

Step (3.2), preparing normal working condition history monitoring data, normal working condition monitoring data and abnormal working condition monitoring data of three monitoring points 169, 204 and 275, inputting the normal working condition history monitoring data, the normal working condition monitoring data and the abnormal working condition monitoring data into a single-point qualitative detection module for training a model, and determining qualitative thresholds [ ζ ] of the three monitoring points ^- (169),ξ ⁺ (169)]、[ξ ^- (204),ξ ⁺ (204)]And [ xi ] ^- (275),ξ ⁺ (275)]；

Step (3.3), preparing a time sequence of normal working condition history monitoring data, a time sequence of normal working condition monitoring data and a time sequence of abnormal working condition monitoring data of three monitoring points 169, 204 and 275, respectively inputting the time sequence monitoring data of each monitoring point into a monitoring point self sequence module, and determining the minimum threshold value of the three monitoring points And->

Step (3.4), preparing normal working condition calendars of three monitoring points 169, 204 and 275History monitoring data time series, normal condition monitoring data time series, and abnormal condition monitoring data time series will [169, 204, respectively]、[169，275]And [204, 275]The time sequence monitoring data of (2) are input into a sequence module among monitoring points to determine decision threshold value xi of three groups of time sequences ₁ (169,204)、ξ ₁ (169,275) and ζ ₁ (204,275)。

And (4) detecting each module by using an abnormality detection frame to obtain the condition that pipe network pipe explosion and a sensor fail. The specific test procedure of the step (4) is as follows:

Step (4.1), inputting real-time monitoring data of a pipe network under various abnormal working conditions into a pipe explosion detection and abnormality identification frame to obtain alarm conditions of each module, and considering four abnormal working conditions, wherein the method comprises the following steps: (a) pipe network pipe explosion; (b) failure of a single monitoring point; (c) failure of two monitoring points; (d) failure of three monitoring points;

fig. 5 shows an alarm condition of each abnormality detection module after pipe explosion of the pipe network model Net 3 according to the embodiment. Fig. 5 (a) shows the detection result of the single-point abnormality detection module, 1 indicates that an abnormality is detected, and 0 indicates that no abnormality is detected. The pressure of part of nodes is reduced after pipe explosion occurs to the pipe network, so that the module detects abnormal monitoring values of three pressure monitoring points. As shown in fig. 5 (b), 1 indicates that an abnormality occurs in the time series at this time, and 0 is no abnormality. When the pipe burst occurs, the sequence of the monitoring points alarms at the beginning of a few moments, but after the pipe burst occurs for a period of time, the sequence of the monitoring points does not alarm any more. Obviously, the time sequence shape changes due to the pressure drop of the node at the beginning of the pipe explosion, so that an alarm occurs. However, after a certain period of time the pressure at the node of the pipe burst is continuously reduced, the shape is similar to that before, and the alarm is not continued. Fig. 5 (c) shows an alarm situation of a sequence between monitoring points, and 2 indicates that two time sequences are abnormal. Fig. 5 (d) shows the abnormal recognition result of the single-point qualitative detection module, and the pressure of each node of the pipe network is reduced after pipe explosion occurs, so that most of the qualitative modules have the situation of "-1".

The embodiment shown in fig. 6 is an abnormal detection condition of each module when a single monitoring point of the pipe network model Net 3 fails (monitoring point 1). As shown in fig. 6 (a), the abnormal monitoring data caused by the failure of the monitoring point is closer to the normal monitoring data, so that the single-point abnormality recognition module does not detect the abnormality at most times. As shown in fig. 6 (b), the sequence of monitoring points themselves all present an alarm condition. Obviously, the occurrence of abnormal monitoring data causes the shape of the time series of monitoring data to change, thereby the condition of continuous alarm occurs. And for alarm conditions from monitoring point to monitoring point. As shown in fig. 6 (c), the time series of the monitoring point 1 and the monitoring point 2 are in alarm condition, while the series between the monitoring point 2 and the monitoring point 3 are not in alarm. As shown in fig. 6 (d), an abnormality in the monitoring data of the monitoring point 1 is detected and alerted (1 and-1), while the monitoring data of the monitoring points 2 and 3 are not abnormal. Therefore, when the single monitoring point breaks down to cause the monitoring data to be abnormal, the monitoring data can be accurately judged according to the alarm conditions of the four detection modules (the monitoring point with the fault alarms, and the rest monitoring points do not alarm).

Fig. 7 shows an alarm condition when two monitoring points (monitoring point 1 and monitoring point 2) of the pipe network model Net 3 of the embodiment fail. As shown in fig. 7 (a), the monitoring data of the monitoring point 1 and the monitoring point 2 in the single-point abnormality recognition module have alarm conditions, while the monitoring data of the monitoring point 3 has no alarm. As shown in fig. 7 (b), a large number of alarm conditions occur in the time series of the monitoring point 1 and the monitoring point 2, while no alarm condition occurs in the time series of the monitoring point 3. As shown in fig. 7 (c), an alarm condition occurs from monitoring point to monitoring point in sequence. As shown in fig. 7 (d), the monitoring data of both monitoring points 1 and 2 are in alarm condition, while monitoring point 3 is not in alarm condition. Obviously, when part (two) of the monitoring points simultaneously fail, the abnormality in the monitoring data of the failed monitoring point can be detected by each abnormality detection module, and the time sequence between the failed monitoring point and the normal monitoring point can be changed.

Fig. 8 shows an alarm condition when all monitoring points (monitoring point 1, monitoring point 2 and monitoring point 3) of the pipe network model Net 3 of the embodiment fail. As shown in fig. 8 (a), continuous alarm appears in the monitoring data of three monitoring points in the single-point abnormality detection module. As shown in fig. 8 (b), a number of alarm conditions occur at each of the three monitoring points in their own time series. As shown in fig. 8 (c), an alarm condition occurs from monitoring point to monitoring point in sequence. As shown in fig. 8 (d), the three monitoring points monitor data for each occurrence of an alarm condition. Obviously, when all (three) monitoring points simultaneously fail, the abnormal monitoring data at the failed monitoring points can be detected by each abnormal detection module, and particularly, the monitoring point self sequence detection module has continuous alarm.

Step (4.2), evaluating the performance of the proposed method according to the pipe explosion detection and anomaly identification results, wherein 9 anomaly scenarios are considered in the method, as shown in table 1;

table 1 various monitoring data anomaly scenarios

Fig. 9 shows the detection accuracy (σ) of nine abnormal scenarios ₁ ) Abnormality recognition rate (sigma) ₂ ) And anomaly detection rate (sigma) ₃ ) Is a schematic of the results of (a). When various abnormal conditions are detected, no false alarm condition occurs, namely all scenes giving an alarm are actually generated abnormal conditions. Sigma of nine abnormal scenes ₁ All are more than 95%, and the condition that monitoring data are abnormal can be effectively detected by the method. Sigma for all scenarios except scenarios 4 and 8 ₂ All are about 98%. The method not only can accurately detect the abnormality in the monitoring data, but also can effectively distinguish various abnormal conditions. Wherein, the situation 4 recognizes the situation that the three monitoring points fail as a tube explosion. When distinguishing between a squib and a SCADA system failure, it is often easy to distinguish between single or partial monitoring points where they fail. However, in the case that all monitoring points fail at the same time (all monitoring values are significantly reduced), the system may misjudge that the system is judged to be tube explosion. In practice, for safety reasons, it is obviously necessary to initiate an explosionAnd the tube alarm eliminates suspected tube explosion. And when the two monitoring points are identified, the system mistakes the two monitoring points as single monitoring points or three monitoring points for error.

Claims (10)

1. The water supply network pipe explosion detection and identification method based on the non-supervision superposition integration is characterized by comprising the following steps of:

Step (1): performing hydraulic simulation on the pipe network model by using the EPANET to obtain pressure monitoring data of each pressure monitoring point under normal working conditions and abnormal working conditions of the water supply pipe network;

step (2): constructing a water supply network pipe explosion detection and abnormality identification frame, wherein the frame comprises 4 abnormality detection modules: (a) a single point anomaly detection module; (b) a single point qualitative detection module; (c) a monitoring point self-sequence module; (d) a sequence module between monitoring points;

step (3): training data is prepared, each abnormal detection module is trained, and the threshold value of each module is determined;

step (4): and detecting various abnormal situations by using an abnormal detection frame to obtain the condition that pipe network pipe explosion and monitoring points are in fault.

2. The water supply network pipe explosion detection and identification method based on the unsupervised superposition integration according to claim 1, wherein the step (1) specifically comprises the following steps:

step (1.1), carrying out hydraulic simulation on a pipe network by utilizing the EPANET to obtain pressure monitoring data of each pressure monitoring point under normal working conditions of the pipe network, wherein the pressure monitoring data are shown in the following formula:

in the method, in the process of the invention,represents pressure monitoring point k under normal working condition of pipe network ₁ Pressure monitoring data at time t of day 0,represents pressure monitoring point k under normal working condition of pipe network _n In the nth _d Pressure monitoring data at time t;

step (1.2), carrying out hydraulic simulation on the condition of pipe bursting of each pipeline of the pipe network by utilizing the EPANET to obtain pressure monitoring data of each pressure monitoring point when the pipe network bursts, wherein the pressure monitoring data are shown in the following formula:

in the method, in the process of the invention,representing pipe network pipe ₁ Pressure monitoring point k after pipe explosion ₁ Pressure monitoring data at time t;representing pipe network pipe _P Pressure monitoring point k after pipe explosion _n Pressure monitoring data at time t;

step (1.3), considering the situation that the monitoring point breaks down, adding partial error data into the pressure monitoring data under the normal working condition of the water supply network to obtain the pressure monitoring data under the situation that the monitoring point breaks down, and considering the following situations: (a) an anomaly monitoring value; (b) data delay; (c) monitoring point number errors.

3. The water supply network pipe explosion detection and identification method based on the unsupervised superposition integration according to claim 1, wherein the step (2) specifically comprises the following steps:

step (2.1), constructing four abnormality detection modules, detecting single-point abnormality and time sequence abnormality in pressure monitoring data of each pressure monitoring point, detecting abnormal values in real-time monitoring data of a water supply pipe network, and realizing abnormality detection;

And (2.2) if abnormal values exist in the real-time monitoring data of the water supply network, distinguishing various abnormal situations of various water supply network according to the alarm conditions of the four abnormal detection modules, and accurately distinguishing the conditions of pipe explosion of the water supply network and faults of the monitoring system.

4. The method for detecting and identifying the pipe explosion of the water supply network based on the unsupervised superposition integration according to claim 3, wherein the step (2.1) specifically comprises the following steps:

step (2.1.1), single-point anomaly detection module research and development:

the single-point anomaly detection module mainly detects single anomaly monitoring data, integrates various machine learning algorithms for improving the accuracy of single-point anomaly detection, and is divided into three layers: (a) the first layer is an independent forest algorithm; (b) The second layer is K-means clustering and local outlier probability algorithm; (c) The third layer is the integration of the K-means clustering and the output result of the local outlier probability algorithm;

for monitoring point k _i The input data of the single-point abnormality recognition module is as follows:

wherein:for monitoring point k _i In the nth _d Monitoring value at time t;

first, p (k _i ) Inputting into independent forest algorithm to obtain each p ^t (k _i ) Is an anomaly score of (2):

in the method, in the process of the invention,represents p (k) _i ) I-th observation of (a)>I=0, 1, …, n _d ，/> For searching unsuccessful average path length in binary search tree,/>e，/>Tr is the total number of trees, < >>Is the observation +.>Path length of>Is->Average value of (2);

after obtaining the abnormal scores of the real-time monitoring data of each monitoring point, taking the abnormal scores of the real-time monitoring data as input, entering a second layer of the single-point abnormal detection module, and obtaining the abnormal detection results of the abnormal scores in the K-means clustering and the local abnormal value probability algorithm respectively;

in K-means clustering, for s ^t (k _i ) Clustering the abnormal scores in the database to obtain binary data, wherein the binary data is 0 if normal and 1 if abnormal; in K-means clustering, the initial cluster list isEach->Is divided into clusters nearest to its square Euclidean distance:

wherein:is the ith cluster; s is(s) _p A dataset for each anomaly score; />The monitoring value of the ith monitoring point at the moment of t number is obtained; />The monitoring value of the j-th monitoring point at the moment of t is obtained; k is the total number of monitoring points; j is the number of the monitoring point; t is the time when each monitoring point collects data;

each cluster is then updated using the following equation:

Wherein: s is(s) _j Score for each anomaly within the cluster;the ith cluster at the time t; />The clustering center of the ith cluster at the time t+1; x is x _j For cluster C _i A value of an inner jth anomaly score;

formally, the goal is to obtain a relationship shown in the following formula:

wherein ρ is the center of each cluster, varC _i For cluster C _i Variance of each anomaly score in the cluster, s is cluster C _i Abnormality score for each monitored data, C _i For the ith cluster, xi _i Is C _i Average of points in (a), i.e. minimizing the square deviation of each monitored value in the same cluster in pairs:

let C be the output of the K-means clustering algorithm, C be a set of n-magnitudes _d Clustering tag of +1, C _i =1 orx and y are monitoring values in the clusters, and k is the total number of monitoring value points;

obtaining the anomaly score of each monitored value in a local anomaly probability algorithmProbability of (a) each->The probability of (2) is defined by->The standard distance to the reference point R is obtained:

in the method, in the process of the invention,representation->And r, using Euclidean distance;

point s _i The probability set distance to the reference point R has a "significance" λ, defined as:

then, using nearest neighbor as a reference set, the nearest neighbor is the nearest Euclidean distance between observations from independent forest algorithms, and for a given field size k and saliency λ, the values are monitored The probability local anomaly factor PLOF of is defined as:

finally, calculate to obtainProbability of becoming a local outlier:

let L be the output of the local outlier probability algorithm, a set of lengths n _d Probability of +1; l (L) _i Represents the ithProbability of becoming abnormal value is 0.ltoreq.l _i ≤1；

After the clustering result of each anomaly score and the probability of becoming an anomaly value are obtained, entering a third layer of the single-point anomaly detection module, and finally obtaining each real-time monitoring data s according to the output result of the K-means clustering and the local anomaly value probability algorithm ^t (k _i ) The probability of becoming an outlier is determined,ith observation s ^t (k _i ) The probability of becoming an outlier is:

P _i ＝C _i ·l _i ；

in K-means clustering, the number of clusters k= 2,K-means clustering divides all monitor values into normal and abnormal two groups, since it minimizes the sum of squares, thereby avoiding adding more weight to monitor values other than normal data, dividing normal data into the same cluster, however, in the second group, normal data or small changes may be considered as outliers, normal data is marked 0, abnormal data is marked 1, and therefore c _i =0 represents normal data, c _i =1 denotes an outlier, and l is near 0 _i Normal data are represented, normal data are prevented from being distributed to abnormal values by multiplying the K-means clustering result by the local abnormal value probability algorithm result, normal data detected by the K-means clustering are covered, and accuracy is improved by integrating the K-means clustering result with different methods.

5. The method for detecting and identifying the pipe explosion of the water supply network based on the unsupervised superposition integration according to claim 4, wherein the step (2.1) further comprises:

step (2.1.2), single-point qualitative detection module research and development:

the single-point qualitative module is mainly used for judging the monitoring value of each moment, and for a single monitoring point k, the single-point qualitative module is firstly used for judging the monitoring value according to the historical monitoring valueObtaining qualitative threshold [ ζ ] ^- (k),ξ ⁺ (k)]：

Will beWith xi ^- (k) And xi ⁺ (k) For comparison, three cases are divided: if->Output-1; if it isThen output 0; if->Then output 1.

6. The method for detecting and identifying the pipe explosion of the water supply network based on the unsupervised superposition integration according to claim 4, wherein the step (2.1) further comprises:

step (2.1.3), research and development of a monitoring point self sequence module:

the monitoring point self-sequence module is used for detecting time sequence dissimilarity of monitoring data of different days of the monitoring points, time sequence curves of different days and the same time period of a single monitoring point are similar to each other under normal working conditions of the water supply network, and when the working conditions of the water supply network change or the monitoring data are abnormal, the dissimilarity of the time sequence of the monitoring point monitoring data self-sequence can change;

for a single monitoring point k _i Calculating to obtain the time series of the monitoring data at the t moment of the i day and the j dayAnd->Sequence distance between->

Wherein M is _i,j (k _i ) Is thatAnd->Dot product of->μ _i (k _i ) Sum sigma _i (k _i ) Respectively the monitoring points k _i Mean and standard deviation of time series at time t of day i;

monitoring point k _i Current time and previous n _d Pair of heavenThe time series distance of the moment of time is expressed asAnd obtain the minimum value

According to the first n _d Time series distance of monitoring data at time of day tCalculating to obtain decision threshold value xi ₂ (k _i )：

In the method, in the process of the invention,and->Respectively time series distance->Mean and variance of (a);

at the decision threshold value xi ₂ (k _i ) After that, it is combined with the minimum threshold valueComparing ifThen the monitoring point k is indicated _i And outputting a detection result 0 when the monitoring data time sequence at the current moment is not abnormal, and outputting a detection result 1 when the monitoring data time sequence at the current moment is not abnormal.

7. The method for detecting and identifying the pipe explosion of the water supply network based on the unsupervised superposition integration according to claim 4, wherein the step (2.1) further comprises:

step (2.1.4), research and development of a sequence module between monitoring points:

the sequence module among the monitoring points is mainly used for detecting whether the time series dissimilarity of the monitoring data of different monitoring points changes or not, under the normal working condition of the water supply network, the dissimilarity of the time series of the monitoring data of different days among the monitoring points is similar, and when the working condition of the water supply network changes or the monitoring data is abnormal, the dissimilarity of the time series of the monitoring data among the monitoring points changes;

The time sequence dissimilarity between different monitoring points indicates the distance between the monitoring points and the time sequence of the same day and the same time between the monitoring points, for two monitoring points k ₁ And k ₂ Time series of (2)And->D for its dissimilarity _i (k ₁ ,k ₂ ) The representation is:

wherein M is _i (k ₁ ,k ₂ ) Is thatAnd->Dot product of->μ _i (k ₁ ) Sum sigma _i (k ₁ ) Respectively->Mean and standard deviation, sigma _i (k ₁ ) Sum sigma _i (k ₂ ) Respectively->And->Standard deviation of (2);

calculating to obtain the monitoring point and the current time and the previous n of the monitoring point _d Time series distance d of day corresponding time ^t (k ₁ ,k ₂ )：

In the method, in the process of the invention,represents the current t moment monitoring point k ₁ And k ₂ Distance between time series,/, for>Represents the first n _d Monitoring point k at time t ₁ And k ₂ Distance between time series;

according to the first n _d Time sequence distance calculation at time t of day to obtain decision threshold value xi ₁ ，ξ ₁ From the following componentsAverage and variance of (a) are obtained:

wherein μ (d ^t (k ₁ ,k ₂ ) And sigma (d) ^t (k ₁ ,k ₂ ) Respectively representing time series distancesMean and variance of (a);

at the decision threshold value xi ₁ (k ₁ ,k ₂ ) After that, it is separated from the time seriesComparing ifThen the monitoring point k is indicated ₁ And k ₂ And outputting a detection result 0 when the monitoring data at the current moment is abnormal, and outputting a detection result 1 when the monitoring data at the current moment is not abnormal.

8. The method for detecting and identifying the pipe explosion of the water supply network based on the unsupervised superposition integration according to claim 3, wherein the step (2.2) is specifically as follows:

Step (2.2.1), distinguishing abnormal events mainly comprises distinguishing the fault condition of a blasting SCADA system, and distinguishing the fault condition through qualitative thresholds of all monitoring points and self sequence alarm conditions of all monitoring points; after pipe bursting occurs in the pipe network, the pressure of the pipe network node is reduced due to the increase of the flow demand in the pipe network; therefore, the qualitative threshold value of each monitoring point at each moment is-1 or 0, namely, the situation that the monitoring point fails once the qualitative threshold value is 1 appears; classifying various anomalies according to the anomaly detection results of the anomaly detection modules;

step (2.2.2), judging the abnormal alarm and false alarm conditions according to the qualitative threshold, if the qualitative threshold at each moment of all monitoring points is 0, the abnormal detection result is false alarm, the SCADA system monitoring data is abnormal and not alarm, otherwise, the abnormal condition needs to be distinguished;

and (2.2.3), wherein the pressure of the node is reduced after the pipe explosion occurs, so that the monitoring data value of each monitoring point is obviously lower than the normal value, the time sequence shape is not changed normally although the monitoring data value is reduced after the pipe explosion occurs in the pipe network, namely, the monitoring point self sequence does not continuously alarm, therefore, if the condition that the monitoring point self sequence continuously alarms occurs, the condition is considered to be the condition that the SCADA system fails, and meanwhile, the monitoring point with the alarm occurs in the self sequence is the monitoring point with the failure.

9. The method for detecting and identifying the pipe explosion of the water supply network based on the unsupervised superposition integration according to claim 1, wherein the step (3) specifically comprises the following steps:

step (3.1), preparing single-point historical monitoring data of each pressure monitoring point under normal working conditions of the water supply network, wherein the single-point historical monitoring data are represented by the following formula:

in the method, in the process of the invention,representing a monitoring point k ₁ Pressure monitoring data, k at time t _i (i=1, 2, … n) represents the ith monitoring point arranged in the pipe network, and when monitoring values at all time points are detected, the monitoring points are mainly +.>And->Comparing, confirming->Whether the value is abnormal or not, namely, comparing the value of each column in the formula;

step (3.2), obtaining time series data of each monitoring point and historical time series data corresponding to the time series data, wherein the time series data are represented by the following formula:

in the method, in the process of the invention,representing a monitoring point k ₁ Time series data at time t:

S ^t (k)＝{p ^t-l+1 (k)，p ^t-l+2 (k)，…，p ^t (k)}；

wherein p is ^t-l+1 (k) Data representing the monitoring point k at the time t-l+1, wherein l is the length of the time sequence;

and (3.3) training and testing the four abnormal detection modules by utilizing various monitoring data under the normal working condition and the abnormal working condition to obtain the threshold value of each abnormal detection module.

10. The method for detecting and identifying the pipe explosion of the water supply network based on the unsupervised superposition integration according to claim 1, wherein the step (4) specifically comprises the following steps:

Step (4.1), inputting real-time monitoring data of a pipe network under various abnormal working conditions into a pipe explosion detection and abnormality identification framework to obtain alarm conditions of each module;

step (4.2), evaluating the performance of the proposed method according to the pipe explosion detection and anomaly identification results, considering the following three performance evaluation indexes: 1) Detecting accuracy (sigma) ₁ ) The method comprises the steps of carrying out a first treatment on the surface of the 2) Abnormality recognition rate (sigma) ₂ ) The method comprises the steps of carrying out a first treatment on the surface of the 3) Abnormality detection rate (σ) ₃ )；

Wherein N is _dn 、N _n And N _in Respectively representing the detected abnormal event, the total abnormal event and the number of the correctly identified abnormal events; t is t _dn And t _t Representing the duration of detection and the actual duration of the abnormal event, respectively, it is evident that σ ₁ 、σ ₂ Sum sigma ₃ The higher the better.