Anomaly Detection and Localization via Graph Learning

Abstract

Phasor measurement units (PMUs) are being installed at an unprecedented rate on power systems, offering unique situation awareness capability. This paper presents a graph learning-based method for detecting and locating anomalies using PMU data. In this method, the graph learning technique is used to characterize the spatiotemporal relationship of distributed PMU data by constructing a spatiotemporal graph. Then, graph analysis is used to detect and locate anomalies by evaluating the global connectivity of spatiotemporal graphs at different times and the local connectivity of nodes in the relevant spatiotemporal graphs. The proposed method was verified using the IEEE-39 bus system and realistic PMU data. The method accurately identifies anomalies with an accuracy of 97% with a precision and recall of 80% and 100%, respectively. The results show the superiority and robustness of the proposed method as a powerful tool for detecting and locating anomalies using PMU data.

1. Introduction

The recent advancements in sensor technology and the availability of many sensors have unprecedentedly increased the situational awareness of power systems [1]. In particular, the phasor measurement unit (PMU) has been beneficial in capturing the rapidly changing power systems states in real time with high data rates. The PMU device collects time-synchronized phasor, frequency, and rate of change in frequency estimates measured at different spatial locations, which are then communicated to the phasor data collector [2]. Data reporting rates are typically 30 to 60 records per second and may be higher. In contrast, current supervisory control and data acquisition (SCADA) systems often report data every four to six seconds—over a hundred times slower than PMUs [3]. Hence, these high-resolution data are vital to assessing the health of the power system and can provide insights not provided by the supervisory control and data acquisition (SCADA) data. The installation of phasor measurement units (PMUs) is rapidly expanding across the United States, leading to a significant increase in the volume of the collected synchrophasor measurement data [4,5]. As a result, detecting and locating anomalies by identifying unusual samples or data streams inconsistent with the rest of the PMU data can be particularly challenging. For system-level anomaly detection and localization, the availability of real-time, spatially distributed system operation data of high accuracy is vital, leading to enhancement in situational awareness, early detection of faults and abnormalities in the power system, and improvement in the power system resilience.

By leveraging these PMU data, anomaly detection and localization become important as the anomalies in various data could be transformed into important actionable information across multiple application domains [6]. The complexity of modeling the spatial and temporal dependencies within the PMU data for anomaly detection and localization in high-resolution PMU data can be a challenging task. Additionally, many electric utilities do not provide spatial information on the PMUs, further complicating the anomaly detection and localization process. From a data structure perspective, spatial (location) and temporal (time) correlations must be considered when analyzing the system states that the PMUs provide. This raises several open questions like what the spatiotemporal relationships within the data are, how can these spatiotemporal relationships be quantified or measured to detect and locate anomalies, and what is the relationship between spatiotemporal correlations and the anomaly detected at different substations with different voltage levels. Traditional model-based methods face challenges in modeling such complex systems, making it difficult to address these questions effectively with high accuracy [7].

Recent works have focused primarily on statistical, physics-based, or data-driven anomaly detection and localization approaches. However, specific distributional assumptions often limit these methods, requiring predefined thresholds and topological information to effectively distinguish anomalies from normal operational conditions [8,9,10,11,12]. Furthermore, these methods rely largely on labeled datasets for anomaly detection tasks. In [8], the authors proposed an ensemble learning algorithm combining three unsupervised methods, namely Isolation Forest, Kmeans, and Local outlier probability (LoOP) for anomaly detection and classification. The authors in [9] utilized realistic synchrophasor data along with the topology and component location information for event detection, classification, and location by combining statistic, clustering, and Maximum Likelihood Criterion (MLE)-based anomaly detection, density-based spatial clustering of applications with noise (DBSCAN) for event detection and physics-based rule for event classification. A study in [10] proposed a hierarchical architecture for monitoring the grid and establishing a set of rules that are proposed for the analysis and fusion of microphasor measurement unit (μPMU) sensor measurements. In [11], the authors proposed a data-driven event detection method, namely the Hidden Structure Semi-Supervised Machine (HS3M), for the purpose of event type identification by incorporating information from partly labeled data and unlabeled data and conducting multiple kernel clustering to increase detection performance. In [12], statistical and clustering-based anomaly detectors were proposed and validated using the real event datasets from distribution PMUs connected with the simulated Bronzeville Community Microgrid (BCM) network. In [13], a graph learning-based method was proposed for anomaly detection by using individual PMU data in the temporal domain. Analyzing the spatiotemporal relationship between PMU data is crucial for detecting anomalies [14]. However, these existing methods do not consider the spatiotemporal interdependence across distributed PMU data since they assume that independent data samples of the measurement devices, which may not be valid in realistic power systems.

To consider spatiotemporal interdependence across multiple PMUs, we propose a method for detecting and locating anomalies using PMU-based spatiotemporal analysis based on graph learning. The major contributions of this paper can be summarized as follows:

• A graph learning algorithm is used to capture the spatiotemporal relationship of streaming PMU data via spatiotemporal graphs.
• Graph-based metrics are proposed for anomaly detection and localization via spatiotemporal graph analysis from two levels: from the global level, the global connectivity of spatiotemporal graphs is evaluated for detecting whether there exists an anomaly in a power system; from the local level, the local connectivity of nodes in the relevant spatiotemporal graph is evaluated for anomaly localization.
• A spatiotemporal, graph-based framework is proposed for efficiently detecting and locating anomaly by considering spatiotemporal interdependence across multiple PMUs to support the decision-making of grid operators.

The rest of the paper is organized as follows: Section 2 presents the methodology of this proposed method. Section 3 presents the case studies on the IEEE 39-bus system and realistic PMU data. Section 4 draws conclusions.

2. Materials and Methods

This paper presents a method for detecting and locating anomalies by leveraging graph learning to analyze the spatiotemporal relationship of distributed phasor measurement unit (PMU) data. As illustrated in Figure 1, the spatiotemporal graph of distributed PMU data will be generated by graph learning technique to reflect the underlying spatiotemporal relationship in a power system. Then, the global connectivity of different spatiotemporal graphs will be compared to identify the relevant spatiotemporal graph and detect the anomalies in the power system. Next, the locations of these anomalies are further identified by comparing the local connectivity of nodes in the relevant spatiotemporal graph.

2.1. Graph Learning

Emerging graph learning techniques enable effective anomaly detection and localization in high-resolution streaming PMU data. Here, graph learning is used to construct the spatiotemporal graph to characterize the spatiotemporal correlation of the voltage data from PMUs. It is assumed that each bus in a power system is equipped with a PMU, voltage magnitude at each bus can be obtained at a given time. We will use distributed PMU data and the graph learning technique to generate a weighted graph that can characterize the similarity in voltage between each pair of buses in a power system at a given time instant. In this weighted graph, each node represents a bus, and the weight on the edge connecting a pair of buses represents how similar it is between a pair of buses in terms of their voltages. That is, a pair of buses have similar voltages if they are close to each other; otherwise, they have different voltages. The similarity is the correlation of voltage data. To this end, graph learning is used to estimate the generalized graph Laplacian matrix from PMU data. The following optimization problem can be formulated by minimizing the Lagrangian function for the PMU data, i.e., solving the parameters of a multivariate Gaussian model that best approximates the data. A set of Lagrange multipliers and a Lagrangian function to achieve optimality conditions can be represented [15]:

$$\underset{\mathsf{\Theta }}{\mathrm{m}\mathrm{i}\mathrm{n}\mathrm{i}\mathrm{m}\mathrm{i}\mathrm{z}\mathrm{e}}\mathbf{T}\mathbf{r}\left(\mathsf{\Theta }\mathbf{K}\right)-\mathrm{l}\mathrm{o}\mathrm{d}\mathrm{g}\mathrm{e}\mathrm{t}\left(\mathsf{\Theta }\right)+\mathbf{T}\mathbf{r}\left(\mathsf{\Theta }\mathrm{M}\right)$$

(1)

subject to

$$\mathcal{L}\left(\mathbf{A}\right)=\left\{\mathsf{\Theta }\in \mathcal{L}|\begin{array}{c}{\left(\mathsf{\Theta }\right)}_{ij}\le 0\mathrm{if}{\left(\mathbf{A}\right)}_{ij}=1\\ {\left(\mathsf{\Theta }\right)}_{ij}=0\mathrm{if}{\left(\mathbf{A}\right)}_{ij}=0\end{array}\mathrm{f}\mathrm{o}\mathrm{r}i\ne j\right\}$$

(2)

where K = S + H, S is the data statistics obtained from the signal data, H is the regularization matrix, M is the matrix of Lagrange multipliers associated with the constraints, logdet(·) means the natural logarithm of a determinant, Tr (·) is the trace operator, and A is the connectivity matrix. The rows/columns of $\mathsf{\Theta }$ and its inverse $\mathbf{C}$ = ${\mathsf{\Theta }}^{-1}$ are updated repeatedly until convergence is achieved by using the matrix inversion lemma as follows:

$${\left({\mathrm{P}}^{\mathrm{T}}\mathsf{\Theta }\mathrm{P}\right)}^{-1}={\left[\begin{array}{cc}{\mathsf{\Theta }}_u& {\mathit{\theta }}_u\\ {\mathit{\theta }}_u^{\mathrm{T}}& {\theta }_u\end{array}\right]}^{-1}={\mathrm{P}}^{\mathrm{T}}\mathbf{C}\mathrm{P}=\left[\begin{array}{cc}{\mathbf{C}}_u& {\mathbf{c}}_u\\ {\mathbf{c}}_u^{\mathrm{T}}& c_u\end{array}\right]=\left[\begin{array}{cc}{\left({\mathsf{\Theta }}_u-{\displaystyle \frac{{\mathit{\theta }}_u{\mathit{\theta }}_u^{\mathrm{T}}}{{\theta }_u}}\right)}^{-1}& {-\mathbf{C}}_u{\displaystyle \frac{{\mathit{\theta }}_u}{{\theta }_u}}\\ -{\displaystyle \frac{{\mathit{\theta }}_u^{\mathrm{T}}}{{\theta }_u}}{\mathbf{C}}_u^{\mathrm{T}}& {\displaystyle \frac{1}{{\theta }_u}}-{\displaystyle \frac{{\mathit{\theta }}_u^{\mathrm{T}}{\mathbf{C}}_u{\mathit{\theta }}_u}{{\theta }_u^2}}\end{array}\right]$$

(3)

where P is the permutation matrix used to arrange updated and fixed elements in block partitions. The submatrix ${\mathsf{\Theta }}_u$ represents the unchanged elements, while vector ${\mathit{\theta }}_u$ and scalar ${\theta }_u$ (i.e., ${\theta }_u$ = ${\left(\mathsf{\Theta }\right)}_{uu}$) are the u-th row/columns of $\mathsf{\Theta }$, representing the updated elements, and ${\mathsf{\Theta }}_u^{-1}$ is solved from partitions of updated $\mathbf{C}$ as follows:

$${\mathsf{\Theta }}_u^{-1}={\mathbf{C}}_u-{\displaystyle \frac{{\mathbf{c}}_u{\mathbf{c}}_u^{\mathrm{T}}}{{\mathrm{c}}_u}}$$

(4)

To update the diagonal elements of $\mathsf{\Theta }$, a scalar value v is added to the ${\left(\mathsf{\Theta }\right)}_{ii}$, and C is updated as follows:

$$Ĉ={\widehat{\mathsf{\Theta }}}^{-1}={\left(\mathsf{\Theta }+v{\mathit{\delta }}_i{\mathit{\delta }}_i^{\mathrm{T}}\right)}^{-1}=\mathbf{C}-{\displaystyle \frac{v{\mathbf{C}\mathit{\delta }}_i{\mathit{\delta }}_i^{\mathrm{T}}\mathbf{C}}{1+v{\mathit{\delta }}_i^{\mathrm{T}}\mathbf{C}{\mathit{\delta }}_i}}$$

(5)

where ${\mathit{\delta }}_i$ is the vector with entries that are zero and one for its i-th entry. Taking the derivative of (1) with respect to $\mathsf{\Theta }$ and equating it to zero, and solving instances of the subproblem based on the optimality conditions, the u-th row/column of $\mathsf{\Theta }$ (i.e., ${\mathit{\theta }}_u$) can be rewritten as follows:

$$\begin{gathered} {\mathsf{\Theta }}_u^{-1}{\mathit{\theta }}_u{c}_u+{\mathbf{k}}_u+{\mathbf{m}}_u=0 \\ {\left({\mathit{\theta }}_u\right)}_i\le 0\mathrm{i}\mathrm{f}{\left({\mathbf{a}}_u\right)}_i=1 \\ {\left({\mathit{\theta }}_u\right)}_i=0\mathrm{i}\mathrm{f}{\left({\mathbf{a}}_u\right)}_i=0 \end{gathered}$$

(6)

where vectors, ${\mathbf{c}}_u$, ${\mathbf{k}}_u$, and ${\mathbf{m}}_u$, and scalars, $c_u$, $k_u$, and $m_u$, are obtained by partitioning $\mathbf{C}$, K, and M such that $c_u={\left(\mathbf{C}\right)}_{uu}$, $k_u={\left(\mathbf{K}\right)}_{uu}$, and $m_u={\left(\mathbf{M}\right)}_{uu}$ = 0. The optimal update for the u-th row/column of $\mathsf{\Theta }$ (i.e., ${\mathit{\theta }}_u$) corresponds to the solution of the following quadratic program:

$$\begin{gathered} \underset{{\theta }_u}{\mathrm{minimize}}{\displaystyle \frac{1}{2}}{k}_u^2{\theta }_u^{\mathrm{T}}{\mathsf{\Theta }}_u^{-1}{\theta }_u+k_u{\theta }_u^{\mathrm{T}}{\theta }_u \\ \mathrm{s}\mathrm{u}\mathrm{b}\mathrm{j}\mathrm{e}\mathrm{c}\mathrm{t}\mathrm{t}\mathrm{o}{\left({\mathit{\theta }}_u\right)}_i\le 0\mathrm{i}\mathrm{f}{\left({\mathbf{a}}_u\right)}_i=1 \\ {\left({\mathit{\theta }}_u\right)}_i=0\mathrm{i}\mathrm{f}{\left({\mathbf{a}}_u\right)}_i=0 \end{gathered}$$

(7)

The optimization problem (7) can be simplified by eliminating its equality constraints determined by A (i.e., a_u) as follows:

$$\begin{gathered} \underset{\beta }{\mathrm{minimize}}{\displaystyle \frac{1}{2}}{\mathit{\beta }}_u^{\mathrm{T}}\mathit{Q}\mathit{\beta }+{\mathit{\beta }}^{\mathrm{T}}\mathbf{p} \\ \mathrm{S}\mathrm{u}\mathrm{b}\mathrm{j}\mathrm{e}\mathrm{c}\mathrm{t}\mathrm{t}\mathrm{o}\mathit{\beta }\ge 0 \end{gathered}$$

(8)

where

$$\begin{gathered} \mathit{\beta }=-{\left({\mathit{\theta }}_u\right)}_s\mathbf{p}={\left({\mathbf{k}}_u/k_u\right)}_s\mathit{Q}={\left({\mathsf{\Theta }}_u^{-1}\right)}_{ss} \\ S=\left\{i|{\left({\mathbf{a}}_u\right)}_i=1\right\} \end{gathered}$$

(9)

so that $\mathit{\beta }$ is the vector with elements that are selected from the original variable vector ${\theta }_u$ based on the index set S [15]. The complete and detailed derivation can be found in Appendix A.

The pseudocode in Algorithm 1 is shown to solve the desired generalized graph Laplacian matrix. It iteratively updates each row/column of the estimated generalized graph Laplacian matrix $\widehat{\mathsf{\Theta }}$ and its estimated inverse matrix $\widehat{\mathbf{C}}$ by solving the optimization problem in (8).

Algorithm 1:  Graph Laplacian Estimation
Input: Sample statistic S, connectivity matrix A, regularization matrix H, target Laplacian set $\mathcal{L}$ and tolerance ε Output: $\mathit{\Theta }$ and $\mathit{C}$
1:	Set K = S + H
2:	Initialize $\widehat{\mathit{C}}=ddiag\left(\mathit{K}\right)and\widehat{\mathit{\Theta }}={\widehat{\mathit{C}}}^{-1}$
3:	repeat
4:		Set ${\widehat{\mathit{\Theta }}}_{pre}=\widehat{\mathit{\Theta }}$
5:		for u = 1 to n do
6:			Partition $\widehat{\mathit{\Theta }}$, $\widehat{\mathit{C}}$, $\mathit{K}$ and A as in (3) for u
7:			Update ${\widehat{\mathsf{\Theta }}}_u^{-1}={\widehat{\mathbf{C}}}_u-{\displaystyle \frac{{\widehat{\mathbf{c}}}_u{\widehat{\mathbf{c}}}_u^{\mathrm{T}}}{{\widehat{c}}_u}}$
8:			Solve (8) for $\mathit{\beta }$ with$\mathbf{Q}$, $\mathbf{p},$ and S in (9)
9:			Update ${\widehat{\mathit{\theta }}}_u$ and ${\widehat{\theta }}_u$ using the solution $\widehat{\mathit{\beta }}$ from above:
				${\left({\widehat{\mathit{\theta }}}_u\right)}_s=-\widehat{\mathit{\beta }}$ $\left({\widehat{\mathit{\theta }}}_u\right)=0$
					${\widehat{\theta }}_u=1/k_u+{\widehat{\mathit{\beta }}}^{\mathrm{T}}\mathit{Q}\widehat{\mathit{\beta }}$
10:			Update ${\widehat{\mathbf{c}}}_u$, ${\widehat{c}}_u$ and $\widehat{\mathbf{C}}$:
			${\widehat{\mathrm{c}}}_u=1/{(\widehat{\theta }}_u-{\widehat{\mathit{\theta }}}_u^{\mathrm{T}}{\widehat{\mathsf{\Theta }}}_u^{-1}{\widehat{\mathit{\theta }}}_u)$ ${\widehat{\mathbf{c}}}_u={\widehat{\mathsf{\Theta }}}_u^{-1}{\widehat{\mathit{\theta }}}_u/{\widehat{\mathrm{c}}}_u$
					${\widehat{\mathbf{C}}}_u={\widehat{\mathsf{\Theta }}}_u^{-1}+{\displaystyle \frac{{\widehat{\mathbf{c}}}_u{\widehat{\mathbf{c}}}_u^{\mathrm{T}}}{{\widehat{\mathrm{c}}}_u}}$
11:			Rearrange $\widehat{\mathsf{\Theta }}$ and $\widehat{\mathbf{C}}$ using P for u as in (3)
12:		end for
13:	until criterion ($\widehat{\mathit{\Theta }}$, ${\widehat{\mathit{\Theta }}}_{\mathrm{p}\mathrm{r}\mathrm{e}}$) ≤ ε
14:	return $\mathsf{\Theta }=\widehat{\mathsf{\Theta }}$ and $\mathbf{C}$ = $\widehat{\mathbf{C}}$

2.2. Graph Learning-Based Spatiotemporal Analysis for Detecting and Locating Anomalies

Since the constructed spatiotemporal graph characterizes the similarity in voltage between each pair of buses in a power system at a given time, we will leverage this spatiotemporal graph to identify anomalies in a power system based on the changes in the similarity change in this graph under different times. It is assumed that the similarity in voltage between all pairs of buses changes after an anomaly occurs in a power system. This assumption will be validated in Section 3. Thus, we identify the potential anomalies in a power system in two steps: first, we will detect if there are anomalies in a power system; if so, then we will locate the anomalies in the system. For anomaly detection, we will evaluate the overall changes in voltage similarity among all buses in the spatiotemporal graph at different times; for locating anomalies, we will evaluate the local similarity change in voltage at individual buses. In particular, by using distributed PMU data and the graph learning technique, the spatial relationship between different nodes at a given time can be represented by a weighted, undirected graph G = {V, E, W}, where V (dim{V} = N_V) is the set of vertices (or nodes) and each vertex can be identified by index i; E (dim{E} = N_E) is the set of edges (or links); an edge denoted by l_ij represents a connection between vertices i and j; and W is the set of weight w_ij on an edge between vertices i and j. Voltage magnitude |V_i|, i = 1,…, N_V, at each bus can be obtained at a given time. The spatial graph will change with time t, so the spatiotemporal graph can be constructed by time-varying magnitude |V_i(t)|, i = 1,…, N_v and t = 1,…T.

The spatiotemporal graphs at different times can be used to detect and locate the anomalies in the power system. To detect whether or not a power system has anomalies, we compare the global connectivity (i.e., the overall similarity of bus voltages) of the spatiotemporal graphs at different times. The global connectivity of a spatial graph can be quantified by the Fiedler value (i.e., the second smallest eigenvalue λ₂) of the generalized graph Laplacian matrix [16,17,18]. A larger λ₂ indicates that the entire graph has strong connectivity as all nodes are well-connected. Conversely, a smaller λ₂ means that the entire graph has weak connectivity, as there may be weakly connected nodes due to the occurrence of anomalies. λ₂ can be evaluated based on the estimated graph Laplacian matrix $\widehat{\mathsf{\Theta }}$ as

$${\mathbf{x}}^T\widehat{\mathsf{\Theta }}\mathbf{x}={\mathsf{\lambda }}_j{\mathbf{x}}^T\mathbf{x}$$

(10)

where λ_j, j = 1,..., N_V, is a nonnegative eigenvalue and has a boundary between 0 and n, i.e., 0 ≤ λ_j≤ n [17]; x is a set of eigenvectors.

After the anomalies are detected in the system, the locations of these anomalies can be identified by comparing the local connectivity of each node (i.e., the local similarity of bus voltages) in the relevant spatiotemporal graph. The local connectivity of each node can be quantified by the weighted degree of a node. A node i with a higher degree k_i indicates that node i has strong connectivity. On the other hand, a node i with a lower degree k_i means that node i has weak connectivity as there may be weak connections to the other nodes due to the occurrence of anomalies. The weighted degree k_i of node i is the sum of weights w_ij on the edges connected to the following node:

$$k_i={\sum }_{i=1}^{N_v}{w}_{ij}$$

(11)

The weighted degree k_i of node i can be evaluated based on the estimated graph Laplacian matrix $\widehat{\mathsf{\Theta }}.$ Since diagonal element ${\widehat{\mathsf{\Theta }}}_{ii}$ of this matrix represents the sum of weights on each edge connected to node i in a spatial graph at a given time. The weighted degree k_i can be calculated by ${\widehat{\mathsf{\Theta }}}_{ii}$ (i.e., $k_i{=\widehat{\mathsf{\Theta }}}_{ii}).$

3. Results

In this section, the proposed method is first demonstrated on the IEEE 39-bus system and then validated using realistic PMU data.

3.1. IEEE 39-Bus System

The performance of our developed method is shown in the IEEE 39-bus, 10-machine New England system, as shown in Figure 2. Detailed modeling parameters for the test system can be obtained from [19]. Figure 3a shows the time-domain trajectories of voltage magnitudes at 39 buses in this system with an anomaly event, which is simulated by applying a three-phase fault at Bus 19 at time t = 1 s and then clearing it at t = 1.05 s. The time-domain trajectories known as power-system features are used for creating spatiotemporal graphs by the graph learning technique, as described in Section 2.1. Figure 3b,c,d show the spatiotemporal graphs created at three time segments: Segment 1 is related to the one before the occurrence of this anomaly event, Segment 2 is related to the one during the occurrence of this anomaly event, and Segment 3 is related to the one after the clearing of this anomaly event. Each time segment spans approximately 0.1 s.

The global connectivity of each spatiotemporal graph is evaluated using the Fiedler value (i.e., λ₂) in (10). The evaluation results are shown in

Table 1. Fiedler values of spatiotemporal graphs under Segments 1, 2, and 3.

Segment	λ2
1	0.5521
2	0.0020
3	0.4051

.

After the anomaly is detected from the spatiotemporal graph under Segment 2, this anomaly can be further located by comparing the local connectivity of each node in this spatiotemporal graph. The local connectivity of each node is quantified by the weighted degree k_i of a node in (11).

Table 2. Weighted degree of all nodes in the spatiotemporal graph under Segment 2.

Buses	ki
Bus 19	0.2884
Bus 20	0.7970
Bus 33	0.8221
Bus 24	1.2194
Bus 16	1.4093
Bus 15	1.6170
Bus 34	1.9604
Bus 17	1.9951
Bus 27	2.0376
Bus 21	2.0547
Bus 18	2.0703
Bus 23	2.3075
Bus 22	2.3112
Bus 14	2.3491
Bus 3	2.3825
Bus 26	2.3832
Bus 4	2.4880
Bus 13	2.5328
Bus 12	2.5857
Bus 10	2.5898
Bus 8	2.6245
Bus 11	2.6261
Bus 28	2.6283
Bus 7	2.6365
Bus 25	2.6373
Bus 29	2.6428
Bus 35	2.6527
Bus 36	2.6539
Bus 5	2.6626
Bus 38	2.6684
Bus 6	2.6712
Bus 2	2.6921
Bus 39	2.7216
Bus 9	2.7342
Bus 32	2.7862
Bus 1	2.7917
Bus 37	2.7957
Bus 31	2.7970
Bus 30	2.8065

presents the k_i of all nodes ranked in ascending order.

3.2. Performance of the Proposed Method

The proposed method is compared with another method for anomaly detection and locating based on graph learning in [13], where the anomaly is detected and located by using individual PMU data in the temporal domain without considering the spatiotemporal interdependence among multiple distributed PMUs. Based on the empirical three-sigma rule [20], the 1.5 sigma rule was used to obtain thresholds for both methods. Anomalies are detected if the weighted degree k_i metric and the anomaly scores are less than the threshold.

Table 3. Performance metrics of the proposed Method.

Methods	Accuracy	Precision	Recall
Approach in [13]	92%	60%	75%
Proposed method	97%	80%	100%

presents the comparison results of these two methods in terms of accuracy, recall, and precision. The accuracy measures the performance of the methods to correctly classify anomalies and normal voltage data. The precision measures how well the methods detect anomalies that are actual anomalies, and the recall measures the performance of the methods to correctly identify all actual anomalies without missing any. Larger accuracy, recall, or precision mean a better performance of the detection method. It can be observed from Table 3 that the proposed method has much better accuracy, recall, and precision than the one in [13]. This observation verifies that the proposed method is more accurate for anomaly detection and locating using PMU data.

3.3. Realistic PMU Data

The efficacy of our developed method is validated using realistic PMU data from a transmission system where the distributed PMU devices collect the synchrophasor voltage data with a 30 Hz sampling rate. In this paper, each PMU data point spans approximately 10 s for each time segment, with a total of 160 s being analyzed. The proposed method is used to detect and locate different anomaly events that occur at different transmission substation locations. Figure 4a, Figure 5a, and Figure 6a show the global connectivity quantified by Fiedler values (i.e., λ₂) for the spatiotemporal graphs under each time segment in the system based on the different voltage levels. These spatiotemporal graphs are created using the graph learning technique as described in Section 2.1 and the time-domain trajectories of voltage magnitudes at 30 buses in the system. Figure 4b, Figure 5b, and Figure 6b show the local connectivity losses of each bus quantified by using the normalized weighted node degree ${\widehat{k}}_i$ in (14) for each spatiotemporal graph under the given time segment in the system.

$${\widehat{k}}_i={\displaystyle \frac{k_i-\min \left(k_i\right)}{max\left(k_i\right)-\mathrm{m}\mathrm{i}\mathrm{n}\left(k_i\right)}},i=1,\dots N_v,$$

(12)

A node i with a lower degree ${\widehat{k}}_i$ indicates that node i loses much more connectivity with other nodes and is much more severely impacted due to the occurrence of an anomaly event. In Figure 4b, Figure 5b, and Figure 6b, a node with a deep red color and large bubble size indicates that this node loses much more connectivity to the remaining nodes in the system due to the occurrence of an anomaly event; on the other hand, a node with blue color and a small bubble size indicates that this node has strong connectivity to the other nodes in the system.

4. Discussion

It can be observed from Figure 3 that the global connectivity of the spatiotemporal graph under Segment 2 is significantly different from those of spatiotemporal graphs under Segments 1 and 3 due to the occurrence of the anomaly. It can be seen from Table 1 that the spatiotemporal graph under Segment 2 has the lowest value of λ₂ among these three spatiotemporal graphs. Thus, the accuracy of detecting anomalies using the proposed method can be validated. It can also be seen from Table 2 that bus 19 has the lowest k_i among all buses. Thus, the location of this anomaly occurs at bus 19. The results verify that the proposed method for locating anomaly is accurate. Table 3 illustrates the quantitative performance of the proposed method, where each metric offers a unique evaluation of the effectiveness of the proposed method. The accuracy measures the degree to which the model distinguishes between anomalies and normal signals. Precision quantifies the proportion of the detected anomalies that are actually anomalies, minimizing false positives, and the recall measures how well the model detects actual anomalies without missing any. Ultimately, Table 3 shows that the proposed method outperforms the previous method in accuracy, precision, and recall.

The results of Figure 4, Figure 5 and Figure 6 verify the robustness of the proposed method with realistic PMU data at three voltage levels. For example, Figure 4a shows the global connectivity losses of voltage magnitudes with faults at different PMU locations at 161 kV voltage level. It can be observed from this figure that the global connectivity of the spatiotemporal graph under segments T9, T10, or T13 is significantly different from those under other time segments. This indicates there are disturbances in the system under segments T9, T10, and T13. As seen in Figure 4b, PMU 16 during time segments T9 and T10 and PMU 2 during time segment T13 has a deeper red color and larger bubble size than other PMU locations, so the local connectivity losses of voltage magnitudes of PMU 16 during time segments T9 and T10 and PMU 2 during time segment T13 are much higher than others at the remaining PMU locations. Thus, there are disturbances in the system at PMU 16 during time segments T9 and T10 and PMU 2 during time segment T13. Similar results can be observed from realistic PMU data at 138 kV and 69 kV voltage levels, which are shown in Figure 5 and Figure 6. These results validate that the proposed method accurately detects and locates anomaly events in realistic PMU data.

5. Conclusions

This paper presents a novel method for anomaly detection and localization using graph learning for the spatiotemporal analysis of distributed PMU data. The graph learning was used to estimate the generalized graph Laplacian (GGL) matrix characterizing the spatiotemporal relationship of distributed PMU data. The global connectivity of different spatiotemporal graphs was first compared to identify the anomalies in the relevant spatiotemporal graph, and then the local connectivity of nodes in the spatiotemporal graph was compared to locate the anomalies in a power system. The efficacy of the proposed method was validated on the IEEE 39-bus system. It showed that the proposed method outperforms with an accuracy of 97% and a precision and recall of 80% and 100%, respectively. Furthermore, the proposed method was verified on realistic PMU data obtained from a 161 kV transmission substation and across other voltage level substations. To validate the robustness of the proposed method, it was observed that at the 161 kV substation, anomalies are located at two PMU locations (PMUs 16 and 2) with high local connectivity losses. Also, anomalies were detected and located under different time segments in the 138 KV and 69 KV substations. This method can help grid operators visualize the spatiotemporal relationship of distributed PMU data to support decision-making. Further studies can include an investigation of the proposed method to detect anomalies caused by dynamic system events such as oscillation, renewable energy integration, and cyber-attacks.