Adaptive electricity theft detection method based on load shape dictionary of customers

0 Introduction

Transmission losses in power grid contain technical losses (TLs) and non-technical losses (NTLs) [1].TLs correspond to the normal losses in the process of power transmission, including the copper and core losses of transformers.Meanwhile, NTLs correspond to the remaining losses that cannot be theoretically explained,such as electricity theft [2].In addition, electricity theft can severely impair the economic benefits of power utilities and cause potential safety hazards, such as power outages.Based on the report conducted by Northeast Group, the annual cost caused by electricity theft in the USA reached $10 billion in 2017 [3].

With the application of smart meters and establishment of advanced metering infrastructure (AMI), a large volume of electricity consumption data make data mining technology more suitable and feasible for electricity theft detection [4].However, the software and communication technology used in AMI enable external parties to tamper with smart meters and intrude into the information flow of the power grid through cyberattacks.Accordingly,China Fujian Daily [5] and the U.S.Federal Bureau of Investigation [6] reported corresponding high-tech electricity theft cases.Contrary to traditional physical attacks, cyberattacks modify data more randomly, leaving almost no physical traces, making detection more difficult.Owing to this increasingly severe situation, there is an urgent requirement for corresponding detection methods to solve the electricity theft problem in AMI.

Existing data-driven electricity theft detection methods(ETDMs) can be divided into three categories based on the type of data they use [7].Methods in the first category assume that granular power consumption data are available and consumption patterns of fraudulent users differ from those of benign users.Based on such characteristics, this type of ETDM utilizes logistic regression [8]-[9] or artificial intelligence, such as classification [10]-[13] and clustering[14]-[15], to analyze the load profiles of customers to detect electricity theft.Generally, supervised methods such as classification involve vast labeled historical electricity usage data to train the detection models.For example, Jokar et al.[10] summarized several modes of false data injection(FDI) to artificially generate fraudulent consumption data.Subsequently, a support vector machine (SVM) was trained to detect whether a new sample of load profiles is normal.Zheng et al.[11] observed that the load curves of abnormal users have poor periodicity compared with those of normal users.In addition, the conventional neural network (CNN)was trained to detect such abnormal users.Other artificial neural networks [12]-[13] have been tested in literature.In contrast, unsupervised methods including clustering focus on the information without labels.Usually, they extract the load shape dictionary (LSD) from the load profiles of users and calculate the anomaly degrees by quantifying the difference between the load profiles and LSD.For instance,Zheng et al.[15] adopted the density-based spatial clustering of applications with noise (DBSCAN) to calculate the anomaly degrees of users.

Methods in the second category assume that the network topology and parameter information are available.The methods based on system state utilize the data inconsistencies caused by data tempering of fraudulent customers to realize theft detection.The physical model of a power network indicates that the system variables should satisfy specific mathematical equations, which derives the consistency of the variables.However, the data tempering of fraudulent users will destroy this consistency and cause anomalies, such as NTLs and voltage limit violation.Under this premise, in [16]-[19], a distribution system state estimation was performed to realize the detection for electricity theft detection.Leite et al.[16] employed a state estimator to monitor the bias between the estimated and measured voltages.Upon detecting bias, the sources of NTL are located using a pathfinding procedure based on the A-Star algorithm.Another method [17] attempted to detect the bypassing users by employing a data analytical technique derived from the three-phase state estimator.However, state-estimation-based methods require precise information of network topology and parameters, which are not available at the end-user level, thereby limiting the practical applicability in this situation.

Recently, numerous hybrid methods combining the traits of power patterns and system state have been proposed.For instance, Zheng et al.[20] assumes that an observe meter is deployed in each area to monitor the aggregated consumption from a group of users.Subsequently,maximum information coefficient (MIC) and clustering by fast search and find of density peaks (CFSFDP) are adopted to identify linear FDIs and non-linear FDIs, respectively.However, the observe meter is unavailable in several districts in Europe and America.

From the brief review above, the existing data-driven ETDMs have several limitations.First, the supervised methods require vast reliable theft samples to train the detection models.However, the small proportion of theft users and the data poisoning (the false labeled samples)[21] limited their accuracies.Second, the performance of existing usage-pattern-based method could be affected,considering the anomaly submergence [22], which indicates that the usage patterns of electricity thieves may not always deviate from those of normal users.Eventually, the detection results of some unsupervised learning algorithm models are abnormal degrees, rather than a “0-1” judgment of whether electricity theft has occurred.Moreover, the difference in power consumption patterns among users will lead to deviation in the detection effect of fixed threshold values.Therefore, a fixed threshold value may not be sufficiently flexible to handle the detection for different scenes and users.

The present work is an extension of the research reported in [23] and [24].The former developed a weighted LSD extraction method based on a distinct number of days,and the latter formulated a tunable electricity theft detection method.The primary contributions of this study are as follows.

1) Based on the weighted K-means algorithm, we select monthly distribution as the weight and propose a novel LSD extraction method for single individual.

2) We observe the distribution differences of anomaly degrees of normal curves and abnormal ones by calculating the cosine distance (CD) between load curve and weighted LSD as the anomaly degree.Based on such distribution differences, we develop a novel electricity theft detection scheme that can ease the negative impact of anomaly submergence.

3) We propose a corresponding strategy for threshold adjustment.Some training samples are utilized to provide a basis for the demarcation of the threshold value, thereby optimizing the detection effect of electricity theft.

The remainder of this paper is organized as follows.In Section 1, a novel method extracting user’s LSD is proposed.Section 2 presents an adaptive electricity theft detection method based on the user’s LSD.Numerical experiments were performed, and the evaluation results are discussed in Section 3.Finally, Section 4 concludes this study.

1 Extraction of LSD

1.1 Common LSD extraction methods

In terms of simplicity and practicability, it is feasible to choose the load profile of a certain day in a month as the monthly LSD for a single user.For example, it could be the load profile of a typical working day or the load profile of monthly maximum load day.However, this method is too simple to provide information about the usage habits in other time periods.Another method to extract the monthly LSD in practice involves obtaining the average load profile in one month.Accordingly, the method considers the usage habits in different time periods.However, the procedure to obtain the average load profile may distort the load shape,thus necessitating further improvement.

1.2 LSD extraction based on weighted K-means

This study presents a monthly LSD extraction method based on weighted K-means, and the methodology is as follows.

Let us denote the set of load profiles of a user in one year as X, i.e.

where xi denotes the load profile of i-th day.X can then be reconstructed according to the month and date of the load profile, as shown in (2)

where xm, d denotes the load profile of the d-th day in month m.For example, x1, 4 is the load profile of Jan.4th.

Subsequently, the K-means is utilized to analyze X and to obtain the set of cluster centers Y, i.e.

where yk denotes the center of k-th cluster.

Subsequently, we can count the number of the load profiles in month m that belong to the k-th cluster, and denote this number as Dm, k.We can then calculate the weight factor that cluster center yk accounts for the load profiles in month m by dividing Dm, k by the number of days in month m, i.e.

where Dm denotes the number of days in month m.Further,the LSD of month m can be obtained by (5)

where denotes the LSD of month m.Moreover, the LSD of the corresponding year is composed of the of 12 months, i.e.

Apparently, the LSD of month m is the linear combination of the cluster centers and the combination coefficient is the weight factor ωm, k.The complete LSD extraction process is shown as follows.

1) Data input.We insert the smart meter reading of a user in one year as input.For each load profile, it will be vectorized as

2) Data cleaning.For each daily load vector, the missing data are recovered as follows:

where denotes the average value of vector xm, d.In addition, some conditions contain some erroneous data.Therefore, the data cleaning also recover those data using (8)according to “three-sigma rule of thumb”:

where σ(xm, d) denotes the standard deviation of vector xm, d.

3) K-means clustering.Choose the number of cluster K using the elbow method [25], and obtain the set of cluster centers Y.

4) For each cluster center and each month, calculate the weight factor ωm, k according to (4).

5) For each month, estimate the LSD using (5).

2 Electricity Theft Detection

2.1 Principle of electricity method

In this study, the cosine distance between the load profile and LSD is calculated as the deviation degree from the LSD using (9).

In general, the usage patterns of electricity thieves deviate from those of normal users.However, this conclusion tends to be invalid and needs to be further studied.We calculated the CDs of the normal load vector and fraudulent load vector to validate the point.Fig.1 illustrates the scatter plot of the CDs of two customers.User A is a customer with a rather fixed usage habit, whereas user B has a more random usage habit.The blue and red points denote the normal and fraudulent samples, respectively.

Fig.1 Comparison of cosine distance scatter plots of users’normal electricity consumption and electricity theft

Fig.1(a) shows that the CDs of the normal sample of user A are distributed in a narrow range near 1, implying that the normal usage habit of user A is fixed and the cluster number of user A’s load profiles is low.Meanwhile,the CDs of fraudulent samples of user A are distributed in a wide range, and some of them are far from 1.Under this circumstance, there is a significant difference in the distribution of the CDs of normal samples and fraudulent ones, meaning that the fraudulent samples deviate from the normal ones.Thus, we can set the threshold to a higher value.Meanwhile, as shown in Fig.1(b), if a user has random usage habit, the CDs of the user’s normal samples distribute dispersedly.This implies that a certain number of normal samples are also deviated from the LSD.The threshold needs to be set to a lower value in this condition to ensure the effect.

The examples of users A and B reveal two significant clues:

1) Fraudulent samples can be distinguished from normal ones using their values of CDs;

2) To ensure the effect, the threshold θ to judge the fraudulent samples is related to the usage habit of the user.

In this study, the percentage rate (PCT), which is a relative value to measure the threshold, is employed, which is calculated using (10).

where Coutlier denotes the number of normal samples whose CDs is lower than the threshold; Cnormal denotes the total number of normal samples.The standard deviation σ of the CDs of a customer’s normal samples is calculated to measure the degree of randomness of that customer’s usage habit.The threshold, PCT, and standard deviation σ of these three factors are correlated.Owing to the complexity of modeling, this relation is unlikely to be formulated through theoretical analysis.We can obtain their relation statistically by performing numerous experiments.

2.2 Detection process

The process of electricity theft detection comprises two parts: the training procedure and the detection procedure.

2.2.1 Training procedure

In the training process, basic information regarding the normal and fraudulent samples of users must be known.The goal of the training process is to obtain the scatter plot of PCT-σ.Suppose that there are n different users.We must obtain the corresponding PCT and σ to analyze the relation between PCT and σi.Considering a user i, the procedure to obtain PCTi and σ is as follows:

1) For user i, the corresponding scatter plot must be drawn based on the plots for users A and B presented in Section 2.1;

2) Calculate the standard deviation σi of user i;

3) The K-means (K=2) is adopted to classy normal samples of user i into two cluster (one is outlier, and the other is non-outlier) according to their CDs;

4) The boundary of these two clusters is set as the threshold θi of user i;

5) According to θi, the PCTi of user i can be calculated using (10).

For each user, we can obtain a pair of PCT and σ.We conducted the above procedure for 200 different users, and obtained 200 pairs of PCT and σ.The result is shown in Fig.3.It can be concluded that with ascending of σ, the value of PCT also increases.However, their relation is neither linear nor monophonic.If the σ of a user is known,the PCT can be easily obtained from the scatter plot of PCT-σ, and its threshold can be derived using (10).

2.2.2 Detection procedure

The detection process aims to obtain the threshold θ of the detected users.The procedure is listed as follows:

1) For the user j to be detected, its scatter plot should be drawn similar to the scatter plots of users A and B (Section 2.1);

2) Calculate the standard deviation σj of user j, and the PCTj can be derived from the value of σj and plot of PCT-σ;

3) According to PCTj, the threshold θj of user j can be calculated using (10).

After obtaining θj, the fraudulent samples can be judged by comparing its CDs with θj: if can be considered a fraudulent sample; otherwise, xm,d is a normal sample.

3 Numerical experiments

3.1 Detection evaluation index

The detection of electricity theft involves a two-class model.In this study, the positive category corresponds to the user’s electricity theft data while the negative category corresponds to the user’s normal electricity consumption data.The effect of the model is evaluated by a confusion matrix, as presented in Table 1.

Table 1 Confusion matrix

Actual class Positive Negative Predicted class Positive True Positive (TP) False Positive (FP)Negative False Negative (FN) True Negative (TN)

We utilize the following performance metrics to evaluate the results of detection: Accuracy (ACC), Precision(Pre), Recall (Rec), and False positive rate (FPR).ACC and FPR are the primary evaluation indexes.In electricity theft detection, when an electricity theft user is detected, the power supply company needs to assign employees to verify in field, and if the FPR is too high, it can waste manpowerand material resources of the company.Therefore, the false positive rate is a critical indicator in evaluating the detection model.The metrics are calculated using (11)-(14).

Pearson correlation coefficient can describe the correlation of two sets of data, and the correlation coefficient can be calculated using (15).

where r denotes the correlation coefficient; X, Y denote 2 arrays; m denotes the number of elements in the array.Noticeably, the positive correlation between the two sets of data is stronger when r ＞ 0, and the coefficient is larger.The correlation strength of the sets is judged by the following value range: 0.8-1.0 indicates very strong correlation; 0.6-0.8 indicates strong correlation; 0.4-0.6 indicates moderate correlation; 0.2-0.4 indicates weak correlation; 0.0-0.2 indicates extremely weak correlation [26].

3.2 Experiment No.1

A control experiment of LSD extraction was performed to demonstrate the shape characterization effect of the LSD proposed in this study, and the data were sourced from 10 industrial and commercial industry users.Fig.2 illustrates the procedure and the result of the presented LSD extraction method for a single user.

Fig.2 Schematic of LSD extracted by weighted K-means

The average cosine distance between LSD and the user’s load curve is calculated.The values of the LSD extracted by weighted K-means method and the maximum load method are 0.84 and 0.55, respectively;and the average LSD is 0.78.In terms of the selection process, the method proposed in this study takes cosine clustering as the clustering index, so the extracted LSD can better represent the monthly shape level.The maximum load method only selects one day in a month as LSD, which is not as effective as the average LSD.

3.3 Experiment No.2

The data source is the Irish Smart Energy Trial [27]and was released by Electric Ireland and Sustainable Energy Authority of Ireland (SEAI) in 2012.As each user participated in the experiment voluntarily, each participant is considered to be a normal consumption user.Some of the commercial users were selected for experiment, and the electricity theft data were modified from the normal electricity consumption data, based on Table 2 [20]:

Table 2 Six typical ways of electricity theft

Type Theft method type 1 1 1 2() ,0.2 0.8,t t fx x t t t γ γ= ＜ ＜ ＜ ＜type 2 2() ,, max()t t t t x x fx x x≤γγ γ γ■,≤=■ ＞■type 3 3() max{ ,0}, max()t t fx x x γ γ= - ＜type 4 1 2 4 1,() , 0,otherwise t t t t t fx xβ β ＜ ＜■= =■■type 5 5 t t() ,0.2 0.8 t t fx αx α= ＜ ＜type 6 6 t t() ,0.2 0.8 t fx αx α= ＜ ＜

In experiment No.1, 200 groups of training users were utilized, and each group contained 535 days of normal data and 480 days of abnormal data (6 types of electricity theft for 80 days each).Accordingly, 80 users are utilized for electricity detection, and data from 300 days of each user are assumed with normal line loss.The remaining 235 days of normal electricity consumption and 240 days of abnormal electricity consumption (6 types of electricity theft for 40 days each) were utilized as the actual test samples, a total of 80×475=38000 data.

Fig.3 shows the pct standard deviation scatter plot obtained by the training user.

Fig.3 PCT standard deviation scatter diagram

The standard deviation and the proportional PCT value are two sequences.Accordingly, the correlation can be described by the Pearson correlation coefficient of the two sequences.The correlation coefficient calculated using(15) is 0.74138, which is classified as a strong correlation according to the correlation level.Specifically, a correlation exists between the delimitation of the threshold and the user’s electricity consumption habits.The results of electricity theft detection are listed in Table 3.

Table 3 Detection results of various types of electricity theft

Accuracy Precision Recall FPR Mixed 0.739 0.635 0.542 0.060 Type 1 0.501 0.260 0.039 0.075 Type 2 0.618 0.439 0.276 0.060 Type 3 0.845 0.917 0.728 0.066 Type 4 0.926 0.935 0.89 0.059 Type 5 0.853 0.929 0.746 0.053 Type 6 0.837 0.605 0.573 0.051

As indicated in Table 3, the overall results of proposed method are evident.Furthermore, the performance of the proposed method differs from type to type.Therefore,the theft type that may affect the overall performance significantly must be determined.In the detection of types 1 and 2, the ACCs of the proposed method are 50.1% and 61.8%, and the false detection rates are 7.5% and 6%,respectively.The detection effect is poor, and the accuracy rate is low.For theft type 3, the accuracy rate can reach 84.5%, and the false positive rate is 6.6%.Type 4 exhibits the best effect, with an accuracy rate of 92.6% and a false positive rate of 5.9%.The ACCs of types 5 and 6 are 85.3% and 83.7%, and their FPRs are 5.3% and 5.1%,respectively.

Table 4 lists the results of several typical users in the experiment, from the perspective of users’ electricity consumption habits.

Table 4 Typical users test result

User ID Standard deviation Accuracy Precision Recall FPR 1 0.015 0.902 0.985 0.819 0.013 2 0.025 0.884 0.956 0.808 0.038 3 0.037 0.883 0.953 0.808 0.040 4 0.063 0.648 0.761 0.444 0.143 5 0.075 0.717 0.776 0.621 0.182 6 0.083 0.594 0.673 0.381 0.189

It is evident from Table 4 that the detection effect is related to the user’s electricity consumption habits.Therefore, the detection effect of electricity theft is better,the accuracy rate is higher, and the false detection rate is also guaranteed to be at a low value for users with a small standard deviation, that is, users with relatively regular electricity consumption habits, such as users 1 and 2.Meanwhile, for users with a large standard deviation, that is, users with irregular electricity consumption habits, the accuracy of the proposed method may be significantly affected.

3.4 Experiment No.3

This study also utilized the traditional typical LSD acquisition method, namely, the average LSD, the maximum load method, and LSD extracted by weighted K-means method mentioned in this study to conduct electricity theft detection effect comparison experiment.The data source of the experiment is identical to experiment No.2 and the comparison results of detection are shown in Fig.4.

Fig.4 Comparison of three LSD methods for electricity theft detection

The experimental results in Fig.4 indicate that in terms of the main evaluation index (ACC and FPR), the LSD extracted by the maximum load is inferior to the other two methods.The reason is inferred that selecting the maximum load cannot well represent other electricity consumption behaviors in the month.Admittedly, the K-means method mentioned in this study is not as accurate as the average LSD for the detection of type 6, and the detection effect of the other 5 methods of electricity theft is better than the average LSD, and as a whole, the FPR is lower than the average LSD.Generally, the experiment reflects the efficacy of the typical load extracted by weighted K-means proposed in this study.

As an innovative part of the method is to delineate different detection thresholds for each user, we use two other electricity theft detection methods with fixed thresholds for comparison.Control experiments include the detection method based on the local outlier factor (LOF)algorithm [28] and the CFSFDP algorithm [15].The data source of the experiment is identical to experiment No.2,and the detection results are illustrated in Fig.5.

Fig.5 Comparison of the detection effects of the three methods

It is evident that compared with other methods, the proposed method exhibits the highest accuracy rate and the lowest false detection rate in the detection results of six different types of electricity theft.In each index, the detection effect of types 3, 4, and 5 is more prominent than the two methods, reflecting the feasibility of the proposed method.

4 Conclusion

This study proposes a novel adaptive electricity theft detection method based on the LSD with a tunable threshold.Accordingly, the abnormal degree of user is calculated according to CDs between the daily load curve and LSD of users.Corresponding numerical experiments and comparisons with other methods are conducted to demonstrate the effectiveness of the LSD extraction and electricity theft detection.Results show that based on the proposed LSD method, the electricity detection procedure can detect some kinds of electricity theft behaviors.However, constrained by the CDs, the method does not specialize in detecting types 1 and 2.Therefore, it is worthwhile for us to study how to detect these types and add some machine learning algorithms to optimize the detection effect in next step.

Acknowledgements

This work was supported by the National Natural Science Foundation of China (U1766210).

Declaration of Competing Interest

We declare that we have no conflict of interest.