An Anomaly Detection Ensemble for Protection Systems in Distribution Networks

Abstract

Due to the complex topology, multi-line branches, and dense spatial distribution characteristics of a distribution network, potential disturbances and failures cannot be eliminated in real scenes, which means that higher levels of both reliability and stability are required in its corresponding protection system. For this reason, the timely monitoring and pinpoint identification of an underlying abnormal operation status in those protection systems must be ensured. To this end, a data-driven-based real-time anomaly detection ensemble is proposed in this paper. First, the kernel principal components investigation (KPCI) process is deployed to compress the dimensionality of input data, which can reduce the computational complexity within such high-dimensional data environments. Next, the isolated forest (IF) model is applied to excavate potential outliers according to the numeric range of the normal operating states of different features. Thus, a better detection performance in biased or sparse distributions can be achieved by reacting swiftly to those outliers. Finally, the operation data of the power distribution network protection system in a certain area is used as a simulation case. It is evident that compared with the single model IF detection method, combining the IF with the data dimension reduction model can effectively reduce data complexity. Due to the addition of kernel functions, KPCI can adapt to high-dimensional data environments better than standard PCI, and it also has certain advantages in calculation efficiency. This validates the theory that the proposed model has a high level of anomaly detection in practical applications, can assist in the automatic identification of and response to power distribution network security risks, effectively dig out potential system operational disturbances and state abnormalities, and achieve real-time anomaly monitoring and early warning.

1. Introduction

In operating scenarios with a complex architecture, comprehensive load, and diverse equipment, the current distribution network used in response to the construction needs of the new power system has higher requirements for its own safety and stability levels. In a protection system, which is one of the main lines of defense for network security, the importance of ensuring its normal and reliable operating condition is increasingly rising [1]. However, with the increasing complexity of both power demand and grid structure, abnormal operating conditions in the protection system are inevitable. If abnormalities cannot be detected in time, they not only seriously affect the quality of power supply but could even provoke a chaotic power consumption order [2,3,4,5]. Therefore, it is urgent to study effective and feasible means of detecting abnormal states in the protection system.

Currently, researchers have provided various methods for data monitoring of the power grid protection system. The first one is based on the detection methods of peripheral devices. For example, references [6,7,8,9,10,11] use infrared temperature measurement technology during the operation and maintenance of transmission line equipment for the abnormal monitoring of protective equipment. The authors of [12] detected SF6 protective equipment faults through a gas monitor, and those of [13,14,15,16,17,18] conducted abnormal monitoring of the relay protection system through inspection robots. The authors of [19,20,21,22,23] used artificial intelligence for the data detection of protective equipment. These methods can achieve timely detection and rapid processing, but they usually require additional specific facilities to implement monitoring, increasing the cost and making it difficult to realize comprehensive coverage of the distribution network under the prerequisite conditions.

Generally, anomalies in the operation of the relay protection system often originate from changes in state parameters. Therefore, accurate identification of abnormal operating state quantities can effectively identify existing or potential deterioration phenomena in the protection system. Hence, data-driven operation anomaly detection has become another feasible direction of research. For example, reference [24] introduces the affinity propagation (AP) clustering method and combines the local outlier factor (LOF) algorithm to detect outliers in the cluster center, thereby accurately identifying abnormalities. The authors of [25] fitted the failure rate model of the protection system based on historical data and corrected the actual failure rate model, based on medium, long-term, and short-term factors, to set a cumulative failure rate threshold. Reference [26] relies on the random truncation characteristics of defect data, adopts the maximum likelihood estimation method, and implements parameter estimation based on the Weibull distribution model. A joint distribution model of the overall defect distribution of the device is then established to achieve parameter estimation for a probability distribution model of the defects of each module and the whole system. The authors of [27] applied a wide-area information method and conducted a global real-time state assessment of a single relay protection action behavior through information sources such as the power grid scheduling system. References [28,29,30,31,32] also introduce various new methods to participate in the operation of relay protection equipment. Those methods have achieved good anomaly detection results, but there is still the potential for further improvement in method performance in a multi-type, high-dimensional data environment.

With these motivations, this paper develops a unique combination of two advanced machine learning models—kernel principal components investigation (KPCI) and the isolation forest (IF) anomaly detection model. The objective is to construct a data-driven ensemble model that can effectively detect abnormal operation states for power distribution network protection. KPCI comes into play during the pre-processing stage. This model is essentially a non-linear extension of traditional principal component analysis (PCA), rendering it capable of efficiently managing non-linear and non-Gaussian distributed data. Harnessing the Sigmoid kernel function, KPCI maps the original input data into a high-dimensional space. The superior linear separability of the data points in this transformed space allows for effective dimensional reduction through projection, thereby enhancing the ensemble model’s capability when processing high-dimensional data environments. The subsequent stage in our detection strategy involves the deployment of the isolation forest model. IF is especially adept at distinguishing outlier sample points that are grounded on the values associated with diverse features under typical operating conditions. The process entails the construction of multiple binary decision trees, each of which is randomly divided. The depth of leaf nodes within each tree is established through iterative training, and the average path length of each data point is computed to pinpoint outliers. The tree-structured architecture of IF grants the model a remarkable level of robustness when coping with high-dimensional or biased data environments, which results in maintained high detection performance and computational advantage. Validation of the ensemble’s effectiveness is attained through a case study that is grounded on actual operation data from a specific region’s distribution network protection system. The results demonstrate that this innovative ensemble model exhibits excellent anomaly detection performance. Unlike other existing models, this novel approach can perform parallel anomaly identification across diverse parameters within the protection systems. This capability significantly enhances the ensemble’s comprehensiveness and applicability in practical scenarios, further cementing its superior feasibility in terms of actual implementation.

This article proposes a data-driven real-time model for detecting potential abnormal operating conditions in the distribution network protection system. The overall flow chart is shown in Figure 1 below.

2. Data Dimension Reduction Model Based on KPCI

To facilitate subsequent analysis and application, the original input data must go through the corresponding preprocessing to provide effective, smaller-scale, and relatively pure training and testing data. The core idea is this: to map the original data into a higher-dimensional space for linear operation, so as to reduce the computational load and improve the operational efficiency [33]. Among them, data dimension reduction is a key step in data preprocessing. Considering the nonlinear characteristics of data, we adopt a method based on KPCI to seek the optimal projection of data and to solve relatively important features, aiming to reduce the computational burden, speed up response time, and achieve visualization of the results [34]. Principal components investigation (PCI) is one of the most fundamental and important methods for data dimension reduction. PCI can examine the correlation among multiple original variables and then use a few principal components to further reflect the internal structure relationship of all the original variables [35].

PCI mainly achieves a data dimension reduction through orthogonal basis transformation. We assume that the input data set is:

$$\left\{a_n\in R^K\mid n=1,\dots ,m\right\}$$

(1)

and diagonalize the covariance matrix after the evaluation:

$$C=⟨(a_j-⟨a_n⟩),{(a_j-⟨a_n⟩)}^T⟩=\frac{1}{M}\sum _{m=1}^M{a}_m{a}_m^T$$

(2)

This calculates the covariance of the centered data $(a_j-⟨a_n⟩)$.

From Equation (2), it can be concluded that the corresponding parameters in the eigenvector basis are the principal components of this data set.

To reduce the number of principal components under consideration and decrease calculation complexity, PCI can be used to solve linear data dimension reduction problems:

$$A\cdot u=\lambda \cdot u \left|\right|u|{|}_2=1$$

(3)

In the equation,$u$ represents the unit vector, and $A=\frac{1}{k-1}\left(a_j-\bar{a}\right)\left(b_j-\bar{b}\right)$ represents the sample data matrix. $b$ is a different input data set with the same definition as $a$. PCI mainly finds a solution for the eigenvalues $\lambda$ and eigenvectors $u$ of the corresponding sample data matrix $A$. The direction of the eigenvectors from the solved matrix $A$ is the direction of data point projection during the PCI solving process.

However, when faced with some datasets that cannot be linearly separated, it is necessary to implement a non-linear data dimensionality reduction. KPCI mainly uses a mapping function to map data from the input space to a feature space [36]. This mapping ensures that the data become easier to separate, thereby enhancing the dimensionality reduction effect of PCI. The top $k$ eigenvectors (with the largest eigenvalues) corresponding to the k largest variances are retained to reconstruct an approximation of the data in the lower dimension space. An operational example is shown in the following Figure 2.

For this purpose, nonlinear mapping is first used to map all samples in the input space to a high-dimensional or even infinite-dimensional feature space (FS) $\mathrm{S}$, making them linearly separable. Then, PCI dimensionality reduction is performed in this high-dimensional space. The basic idea of the kernel technique is to map data that are inseparable in a low-dimensional space to a high-dimensional space. Data that are linearly inseparable in a low-dimensional space will have a higher probability of being linearly separable after being mapped to a high-dimensional space. For example, the difficulty of separating data linearly in a one-dimensional space is greater than in a two-dimensional space, and it is harder to separate data linearly in a two-dimensional space than in a three-dimensional space. The mapping function is shown as follows:

$$\Psi \to S$$

(4)

In the formula, $\Psi$ is a nonlinear function. The only constraint on the feature space $S$ is that it must have the structure of a reproducing kernel Hilbert space.

KPCI can be used to solve the following eigenvalue problem. The goal is to find the eigenvector α that maximizes the ratio of the variability in that direction to the total variability:

$$X\cdot \alpha =\lambda \cdot \alpha ,\parallel \alpha {\parallel }_2=\frac{1}{\lambda }$$

(5)

In the formula, $\lambda$ is the eigenvalue of the matrix X. $\alpha$ is a column vector with a dimension of $k$, and $X$ is the kernel matrix, constructed as follows:

$$X=\left[\begin{array}{ccc}x\left(a^1,a^1\right)& \cdots & x\left(a^1,a^k\right)\\ x\left(a^2,a^1\right)& \cdots & x\left(a^2,a^k\right)\\ ⋮& \ddots & ⋮\\ x\left(a^k,a^1\right)& \cdots & x\left(a^k,a^k\right)\end{array}\right]$$

(6)

In the formula, $x\left(a_j,a_i\right)$ denotes the kernel evaluating the similarity between samples $a_j$ and $a_i$.

The function $x$ is the core of KPCI, which is a positive semi-definite function in the input space used to deal with nonlinear problems. This function is often referred to as a kernel. The most commonly used kernel functions include polynomial, Gaussian, etc., and are expressed as follows:

$$x\left(a_j,a_i\right)={\left(a_j^T{a}_i+c\right)}^d$$

(7)

$$x\left(a_j,a_i\right)=exp\left(-\frac{\parallel a_j-a_i{\parallel }^2}{2{\gamma }^2}\right)$$

(8)

In Equation (7), $c\in R^{+}$ and $d\in K^{+}$; in Equation (8), $\gamma \in R^{+}$.

Kernel principal component investigation (KPCI) performs a linear principal component investigation (PCI) in the implicit feature space that is induced by the kernel, which can help tie all the data together. In this context, the “kernel” refers to the kernel function, a mathematical technique used to transform input data into a higher-dimensional space. The advantage of KPCI is that it can capture nonlinear relationships in the data, making it more powerful than standard PCI for certain types of data.

Based on the characteristic that the data do not easily diverge during transmission, this paper selects Sigmoid, and its mathematical expression is as follows:

$$x\left(a_j,a_i\right)=arctan\left(m{a}_j^T{a}_i+c\right)$$

(9)

In the formula, $c$ is a constant that can control the length of the lower order term, and in this paper, it is set to 1. $a_j$ and $a_i$ are sample vectors.

Based on the principle of PCI, the eigenvector corresponding to the maximum eigenvalue is the direction in which KPCI needs to be projected, and the calculation method is as follows:

$${\Psi }^l={\sum }_{j=1}^k{u}_j^{l}a\left(a^j,a^i\right)$$

(10)

In the formula, ${\Psi }^l$ is the first principal component and $u_j$ are the eigenvectors. If $X$ has not been centered yet, the following formula is used to implement centering. Centralization refers to the process of subtracting the mean from each variable so that the mean value of each feature becomes zero. Standardization is the process of dividing each feature value by its standard deviation. This process ensures that all features have the same importance in the analysis, and avoids the biases caused by different units of measurement:

$$X_c=X-X{1}_K-1_{K}X+1_{K}X{1}_K$$

(11)

In the formula, $X_c$ is the matrix after data $X$ centering, and $1_K$ is the $K\times K$ matrix.

3. Data Anomaly Detection Model Based on IF

Isolation forest is a forest path technique used for detecting outlier data [37]. Its main method of anomaly detection is through the path distance between the root node and the leaf nodes in the forest architecture, meaning that it can assign a more significant root-node to leaf-node distance to outlier collection data that is farther away from the range of normal data and separate it (isolate) by a sparse data-split range [38]. By eventually calculating the average length of the root-leaf node set path for each group of data, the model can detect more conspicuous collection data in the dataset, i.e., outlier data. The overall construction approach of the isolation forest model can be displayed in Figure 3 below.

We assume that $S_j=\{z_1\dots ,z_j\}$ is a training dataset containing $j$ independent variables, and $Z=\{Z^{\left(1\right)},\dots ,Z^{\left(c\right)}\}$ represents the corresponding variable values $\alpha$ in finite-dimensional Euclidean space. We suppose that an isolation tree (IT) $\epsilon$ in an IF can be viewed as a binary tree that characterizes a nested sequence of data point split sets in feature space by a data depth of $M\ge 1$. Its root node corresponds to the entire detection space $C_{\mathrm{0,0}}\subset \alpha$. We assume that other IT nodes are identified in pairs $\left(m,n\right)$ of sets, where $m$ ($(0\le m<M)$) denotes the data depth of that node, and $n$ ($\left(0\le m\le 2^m-1\right)$) denotes the corresponding detection space subset $C_{m,n}\subset \alpha$ for the respective node. A node $\left(m,n\right)$ that is not a terminal has two child nodes, corresponding to two detection space subsets $C_{m,n}=C_{m+\mathrm{1,2}n}\cup C_{m+\mathrm{1,2}n+1}$ that do not intersect. If a node does not have any child nodes, it is referred to as a terminal node.

IF can be constructed by iteratively filtering subsets of the training data set [39]. First, we set the initial node $\left(m,n\right)$, then the corresponding data subset can be written as $S_{m,n}$.

During the growth stage of the IT in the $m+2n$ iteration process, an arbitrary growth direction $v$ is chosen, corresponding to a separation variable $Z^{\left(v\right)}$; at the same time, a separation parameter $u$ is set to correspond to the projection range of the data point in $S_{m,n}$ on the coordinate axis in the $v$ direction, which can be written as:

$$u\in \left[Mi{n}_{z\in S_{m,n}}{z}^{\left(v\right)},Ma{x}_{z\in S_{m,n}}{z}^{\left(v\right)}\right]$$

(12)

The generated subset can be written as:

$$C_{m+\mathrm{1,2}n}=C_{m,n}\cap \left\{z\in \alpha :z^{\left(v\right)}\le u\right\}$$

(13)

$$C_{m+\mathrm{1,2}n+1}=C_{m,n}\cap \left\{z\in \alpha :z^{\left(v\right)}>u\right\}$$

(14)

Then, the corresponding training data subset can be written as:

$$S_{m+\mathrm{1,2}n}=C_{m+\mathrm{1,2}n}\cap S_{m,n}$$

(15)

$$S_{m+\mathrm{1,2}n+1}=C_{m+\mathrm{1,2}n+1}\cap S_{m,n}$$

(16)

In the above formula, $S$ is the training dataset, and C is the subset generated by the separation parameter $u$, which corresponds to the projection range of the data points in $S$ on the coordinate axis in the $v$ direction.

We repeat the above iteration until all training data set points are separated, or the data depth $M$ is reached. When the observed score is close to $M$, the path length is very short, so the data point can easily be isolated, that is, in an abnormal state, and the growth of the IF node stops.

Since the end nodes on the completed IT can correspond to a subset of the feature space, a piecewise constant function $f_{\epsilon }:\alpha \to N$ can be defined, based on the detection space.

$$f_{\epsilon }\left(z\right)=m$$

(17)

In the above equation, $z\in C_{m,n}$ and $\left(m,n\right)$ are end nodes.

The random path length shown in Equation (17) represents the degree of anomaly for the corresponding variable; that is, the higher the degree of $z$ anomaly, the greater the probability that the data $f_{\epsilon }\left(z\right)$ value is smaller.

Therefore, by repeating the aforementioned steps, a series of ITs can be generated to form a complete IF model. The anomaly score function for the variable $z$ is defined as shown in the following equation:

$$S_j\left(z\right)=2^{-\frac{1}{Ja\left(\delta \right)}{\sum }_{k=1}^J{f}_{\epsilon }\left(z\right)}$$

(18)

In the equation, $a\left(\delta \right)$ represents the average length of a bifurcated road IT path constructed by $\delta$ variable points, which is expressed as follows:

$$a\left(\delta \right)=\left\{\begin{array}{cc}0& ,\delta <2\\ 1& ,\delta =2\\ \frac{2F\left(\delta -1\right)-2\left(\delta -1\right)}{j}& ,\delta >2\end{array}\right.$$

(19)

$$F\left(n\right)=ln\left(n\right)+\xi$$

(20)

In the formula, $\xi$ represents Euler’s constant.

According to Equation (18), $S_j\left(z\right)$ can be concluded to show that the score range is [0,1], indicating that the possibility of the data variable being an outlier increases from small to large. Values closer to 1 indicate a higher likelihood of these being outliers, while values closer to 0 indicate a higher likelihood of these being normal.

4. Case Study

This paper conducts a simulation example based on the relay protection system of a 10 kV distribution network located in a certain province in the central part of the country, aiming at the detection of operational disturbances and abnormal conditions. The 10 kV distribution network is shown in Figure 4 below.

The following are the relevant parameters of this relay protection device.

(1)

Electrical parameters

The alternating current parameters is shown in

Table 1. Electrical parameters: alternating current.

Phase Sequence	ABC
Rated frequency	50 Hz
application	protect		measure
Rated current (In)	1 A	5 A	1 A	5 A
linearity range	0.05 In~30 In	0.05 In~30 In	0.05 In~2 In	0.05 In~2 In
Continuous overload capacity	3 In	3 In	2 In	2 In
10 s overload capacity	30 In	30 In	10 In	10 In
1 s overload capacity	100 In	100 In	30 In	30 In
Dynamic-stable current (half-wave value)	250 In	250 In	75 In	75 In
Power consumption at rated current (@In)	<0.15 VA/phase	<0.25 VA/phase	<0.2 VA/phase	<0.4 VA/phase

below.

The alternating voltage parameters is shown in

Table 2. Electrical parameters: alternating voltage.

Phase Sequence	ABC
Rated frequency	50 Hz
Rated voltage (phase, Un)	100~130 V
linearity range	1~130 V
Continuous overload capacity	130 V
10 s overload capacity	200 V
1 s overload capacity	250 V
Power consumption at the rated voltage	<0.1 VA/phase

below.

The direct current main parameters is shown in

Table 3. Electrical parameters: direct current main.

Adopt the Standard	GB/T 8367-1987 (idt IEC 60255-11:2008) [40]
rated voltage	110 Vdc, 220 Vdc
input range	80%~120% of the rated voltage
ripple wave	and 15% of the rated voltage
quiescent dissipation	<15 W (conventional station), <20 W (digital station)
power consumption during action	<20 W (conventional station), <25 W (digital station)
DC power supply polarity back-connection	The device works normally

below.

The alternating current power supply parameters is shown in

Table 4. Electrical parameters: alternating current power supply.

rated voltage	110/220 Vac
input range	80%~120% of the rated voltage
quiescent dissipation	<15 W (conventional station), <20 W (digital station)
power consumption during action	<20 W (conventional station), <25 W (digital station)

below.

The on-off input parameters is shown in

Table 5. Electrical parameters: on-off input.

Adopt the Standard	IEC 60255-1:2009 [41]
Rated voltage	110 Vdc	220 Vdc
Starting voltage	60.5 V~77 V	121 V~154 V
Rated current	1.1 mA	2.2 mA
Return voltage	50% rated voltage
Maximum allowable voltage	300 Vdc
Pressure resistance level	2000 Vac, 2800 Vdc

below.

The switch output parameters is shown in

Table 6. Electrical parameters: switch output.

Output Junction Classification	Trip, Signal
Output form	Passive contact point
Maximum operating voltage	380 Vac 250 Vdc
Open contact pressure resistance	1000 V RMS, 1 Minutes
Continuous flow carrying capacity	5 A@380 Vac 5 A@250 Vdc
Impact over current ability	6 A@3 s 15 [email protected] s 30 [email protected] s
Actuation time	<8 ms
Return time	<5 ms
Arc-breaking capability (L/R = 40 ms)	0.65 A@48 Vdc 0.30 A@110 Vdc 0.15 A@220 Vdc
Electrical life	10,000 times

below.

The parameters of the environmental conditions is shown in

Table 7. Parameters of the environmental conditions.

Adopt the Standard	GB/T 14047-1993, idt IEC 60225-1:2009) [41,42]
operating temperature range	−20~+55 °C
Storage and transportation temperature range	−40~+70 °C
Relative humidity	At 5~95%, the equipment is not condensation, not ice

below.

The environmental test parameters is shown in

Table 8. The environmental test.

cold test	16 h at low temperature −25 °C (GB/T 2423.1-2008 [43])
hot test	16 h at high temperature +55 °C (GB/T 2423.2-2008 [44])
cyclic damp heat test	high temperature 55 °C, low temperature 25 °C, relative humidity 95%, two cycles of test time (12 h + 12 h) (GB/T 2423.4-2008 [45])

below.

(2)

The SV and the GOOSE functions

The B02 plug-in of the device can receive current and voltage SV point-to-point or through a network. The B02 plug-in has GOOSE functions: it supports the GOOSE input of two feeder lines and the position of the sectional switch, as well as the GOOSE input of lockout backup self-casting; it supports the input of receiving GOOSE jump sectional commands; it also supports the GOOSE output of jump trip orders and others. The MMS-GOOSE of the device supports sending coordinated-trip and overload-shedding commands.

The feature information of the relay protection equipment status can be divided into two categories: historical operation data and real-time operation data, as detailed below. The data of the case study is shown in

Table 9. Data of the case study.

Feature Type	Data Features
Historical operational data	pre-operational status, common defects, maintenance status, and correctness rate of actions
Real-time operational data	operational voltage, frequency, internal temperature, input/output status, connection status of voltage and current transformers, communication status of SV and GOOSE messages, soft pressure plate status, and CPU utilization rate

below.

Because the numerical ranges and units of each data indicator are different, to implement anomaly detection for different types of data, it is necessary to carry out a standardized data preprocessing step. For this reason, this paper normalizes different types of data state values and maps them to a numerical range between 0 and 1.

To verify the performance of the proposed reliability anomaly detection model, the anomaly detection results deviating from the normal range will be compared with the actual operation anomaly records. The confusion matrix (CM) [46] can distinguish whether the judgment results of the model are correct, and it is shown in the following

Table 10. The 2 × 2 confusion matrix.

Confusion Matrix (CM)		Record Results
		True	False
Judgment results	Positive	True Positive(TP)	False Positive(FP)
	Negative	True Negative(TN)	False Negative(FN)

.

Based on the results of Table 2, two commonly used evaluation variables can be derived: the true positive rate (TPR) and the positive predictive value (PPV). Their mathematical expressions can be represented as:

$$TPR=\frac{TP}{TP+FN}$$

(21)

$$PPV=\frac{TP}{TP+FP}$$

(22)

The precision-recall (PR) curve can depict the changing trend between PPV (also known as Precision) and TPR (also known as Recall). This curve is better suited to assess prediction results when the data in the input database have a stronger bias [47]. Since the PR curve primarily compares true positive data rather than true negative data with false positive data, it can better judge the performance of different prediction models when negative data samples predominate in the input database. Generally, the proportion of outliers in the example data indicators is small, i.e., most of the samples in the dataset are negative data samples. Therefore, using the PR curve has a better analytical effect.

This article uses the area under the PR (AUPR) curve and the ROC (AUC) curve as an evaluation indicator, with a specific diagram shown in Figure 5 below.

As can be seen from the above figure, the area under the PR curve is the geometric area between the PR and the coordinate axis. Moreover, for a perfect prediction, both the PPV and TPR values will be 1; hence, a perfect PR curve must pass through the coordinate point (1,1). Therefore, the closer the PR curve generated by the prediction model is to the top right corner, i.e., the larger the AUPR, the better the performance of the prediction model.

This case study conducts a simulation verification on two types of data. Among them, the fact of whether an anomaly occurs at the time of each group of data is used as a verification indicator and is respectively defined as “1” and “0”. To test the anomaly detection performance of the proposed KPCI-IF method, the simulation results are compared with the IF model, the density-based LOF model, and the distance-based K-means algorithm. Among them, the fitting results for internal temperature anomaly detection are shown in Figure 6 and Figure 7 below.

The comparison summary of the detection performance of the four anomaly detection models is shown in Figure 8 and Figure 9, where the y-axis represents the corresponding AUPR and AUC score values.

As can be seen from Figure 8 and Figure 9, the proposed KPCI-IF method has the highest detection performance for different scenarios, devices, and parameters in the protection system. Among all the characteristic data of the examples, the detection accuracy of the maintenance status, transformer connection status, etc., is relatively high due to the overall high safety and the presence of relatively fewer samples deviating from the normal value range. However, real-time operation data such as operating frequency and CPU utilization rate have a relatively lower detection accuracy, due to the large number of data samples and the dense time series. However, most of them cannot cause substantial faults, so for this type of data feature, a relatively higher detection threshold can be independently set later. In addition, among the three comparative anomaly detection models, the detection accuracy of the IF, LOF, and K-means methods decreases successively, proving that tree structures have corresponding advantages in terms of model construction perfection compared to density and distance structures. Finally, by comparing the detection results of KPCI-IF and ordinary IF, it can be seen that the added dimension reduction step is very significant when facing potentially high-dimensional large-capacity data.

The timeliness of the proposed method is then validated and the calculation time of the proposed KPCI-IF method is compared with that of PCI-IF and IF methods. The comparison results are shown in the following

Table 11. Comparison of efficiency between methods.

Anomaly Detection Method	Calculation Time (s)	Degree of Improvement (%)
KPCI-IF	0.7728	—
PCI-IF	1.0232	24.5
IF	1.8724	58.7

.

From the above table, it can be concluded that the proposed KPCI-IF method still has a certain advantage in terms of timeliness. Compared to the single-model IF detection method, IF combined with the data dimension reduction model can effectively reduce the complexity of data, thereby improving the response speed of anomaly detection. In addition, by incorporating kernel functions, KPCI is better adapted to high-dimensional data environments than the standard PCI and has certain advantages in terms of computational efficiency.

In addition, we further strengthen our arguments and findings via comparative analysis. In this study, we referred to the PCA anomaly detection model used in references [48,49], reviewed the LOF anomaly detection model used in references [50,51], and employed the IF anomaly detection model used in references [52,53] as a reference for comparison. After a detailed comparison, it can be concluded that the KPCI-IF method still has a significant advantage in terms of timeliness. This advantage is reflected in several aspects. First, compared with the PCA model, the KPCI-IF method has a higher computational efficiency that reduces the running time of the program, enabling users to obtain results within a short period. Secondly, compared to the LOF model, the KPCI-IF method can avoid issues caused by the presence of duplicate points where the average reachable distance is zero and the local reachable density becomes infinite, causing computational difficulties, and it even has a lower computational cost, making it more suitable for high-dimensional and large-scale data. Finally, compared to the IF model, the KPCI-IF method has a faster processing speed and can more effectively process and identify anomalies in the data due to its excellent timeliness. When dealing with large amounts of real-time data input, the KPCI-IF method can quickly find and identify anomalies in these data. Therefore, our research results show that compared to other anomaly detection models, the KPCI-IF method has a certain advantage in terms of its timeliness performance and can better meet users’ requirements for the rapid identification and processing of data anomalies.

5. Conclusions

To address the high-dimensional heterogeneous characteristics of the operational status input data of distribution network protection systems, this paper presents a data-driven multi-model anomaly detection ensemble to effectively excavate their potential operational disturbances and abnormal statuses, thereby achieving real-time abnormal monitoring and early warnings. The main works of this paper are summarized as follows:

• A KPCI dimension reduction model is constructed to map and dissect the original data and compress its dimension. This can effectively deal with high-dimensional heterogeneous input data environments and diminish the computational burden to decrease the response time.
• The IF tree-structure anomaly detection method is established, which directly identifies abnormal samples according to the corresponding normal range of operational status in each feature. It can cope with different scenarios, devices, and parameter types through an almost identical process, and, thus, can realize comprehensive and effective responses to underlying diverse anomalies.

In general, the innovation of this algorithm is that it fully utilizes the concept of being data-driven, and, through the KPCI dimension reduction model and the IF anomaly detection model, it effectively processes large-scale high-dimensional heterogeneous operational status data. In this process, the algorithm successfully excavates potential operation disturbances and state anomalies in the relay protection system of the distribution network. Due to this multi-model design, the algorithm runs rapidly and has strong capabilities to deal with large-scale data. This not only effectively meets the needs of real-time monitoring and early warnings but also provides a new solution to deal with the complex relay protection system of the distribution network. Through a large amount of empirical analysis, we found that this algorithm can effectively deal with practical problems in the operation of the power system. The experimental results also verify that this algorithm can not only effectively detect anomalies but also has a fairly high strike accuracy. Therefore, we have reason to believe that this method will play a bigger role in the future regarding power system operational safety and in the maintenance of future smart grids. However, although this algorithm has solved the high-dimensional heterogeneous data processing problem of data-driven models to some extent, there are still some deficiencies. For instance, there may be room for optimization in the pre-processing part of data preparation, and the data expression after dimension reduction may lose some information. Therefore, our future work also includes further enhancing the stability of the algorithm and its accuracy, to dig deeper into potential rules in order to make a bigger contribution to the health, safety, and stability of power system operation.