TGCformer: A Transformer-Based Dual-Channel Fusion Framework for Power Load Anomaly Detection

Abstract

Existing methods for power load anomaly detection suffer from several limitations, including insufficient extraction of multi-scale temporal features, difficulty in capturing long-range dependencies, and inefficient fusion of heterogeneous Time-Graph information. To address these issues, this study proposes the TGCformer, an enhanced framework for Time-Graph feature fusion. First, a dual-channel feature extraction module is constructed. The temporal path utilizes Time Series Feature Extraction based on Scalable Hypothesis Tests (TSFresh) to enhance the explicit pattern representation of the load sequences, while the graph-learning path employs a Sparse Unified Graph Attention Network v2 (Sparse Unified GATv2) to model global semantic correlations among time steps. Together, these two paths provide more interpretable and structured inputs for the subsequent fusion module. Subsequently, a multi-head cross-attention mechanism is designed, where temporal features serve as the Query and graph-level embeddings as the Key and Value to guide the feature fusion process. This design ensures the effective integration of complementary information while suppressing noise. Experimental results on the public Irish CER Smart Meter Dataset demonstrate the effectiveness of the proposed model. Specifically, TGCformer consistently outperforms four classic deep learning baselines (XceptionTime, InceptionTime, FormerTime, and LSTM-GNN), demonstrating competitive detection accuracy and robustness.

1. Introduction

With the continuous growth in electricity demand, the issue of Non-Technical Losses (NTL) caused by abnormal electricity consumption behavior has become increasingly prominent, threatening the secure operation of distribution networks and causing significant economic losses [1,2]. As a crucial technique for identifying such anomalies and ensuring the stable operation of power grids, power load anomaly detection has attracted increasing research attention in recent years [3,4,5]. Existing approaches can be broadly categorized into three groups: traditional methods, machine learning methods, and deep learning methods.

Traditional anomaly detection methods primarily include strategies based on statistical analysis, signal processing, density estimation, and clustering. While statistical and signal processing methods offer fundamental modeling of load data, they are often inadequate for handling non-stationary, high-dimensional, and highly nonlinear sequences [6]. Density-based and clustering methods can identify potential anomalies in an unsupervised manner; however, they are inherently limited in explicitly modeling long-term temporal dynamics and complex sequential dependencies [7,8,9]. Although hybrid forecasting-based methods and residual analysis techniques have improved detection accuracy to some extent [10], traditional approaches overall struggle to capture the complex temporal dependencies and latent structural correlations inherent in power load data, limiting their performance in practical applications.

Machine learning methods enhance the modeling of complex features and improve generalization through supervised or semi-supervised mechanisms. Support Vector Machines (SVM) have demonstrated good performance in handling nonlinear features and imbalanced datasets [11,12]. Ensemble learning algorithms, such as Random Forest (RF), Extreme Gradient Boosting (XGBoost), and Gradient Boosting Machines (GBM), significantly boost detection robustness and accuracy through multi-model fusion [13,14,15]. However, these methods typically depend on manually engineered features, making it difficult to fully exploit the dynamic temporal patterns and latent value-based dependencies within load data.

Deep learning methods offer substantial advantages in time series modeling and high-dimensional feature representation. Architectures like Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM), Gated Recurrent Units (GRU), and Convolutional Neural Networks (CNNs) can effectively capture nonlinear relationships and long-term dependencies [16,17]. Recently, the Transformer architecture, with its self-attention mechanism, has shown exceptional performance in long-sequence modeling and has been widely applied to power load forecasting and anomaly detection [18]. Studies indicate that combining Transformer with techniques like clustering, residual analysis, or Generative Adversarial Networks (GANs) can significantly enhance detection performance [19]. Furthermore, improved Transformer variants designed for multivariate and multi-scale time series exhibit greater stability and generalization in complex scenarios [20]. However, these methods still primarily rely on sequential self-attention and implicitly assume that temporal proximity dominates dependency modeling. As a result, they often overlook latent topological dependencies across distant but semantically similar time steps. In addition, when heterogeneous features from different modeling paradigms are involved, existing approaches typically adopt simple concatenation or late fusion strategies, lacking effective mechanisms for deep and adaptive feature interaction. Consequently, the joint modeling and dynamic fusion of temporal patterns and graph-level dependencies remain insufficiently explored.

To address the aforementioned limitations, this paper proposes an anomaly detection framework named TGCformer, based on the dynamic fusion of multi-scale temporal features and graph-level features. The framework aims to achieve joint Time-Graph modeling and multi-source feature fusion for power load data, thereby improving detection accuracy and model interpretability. The main contributions of this paper are as follows:

(1)

Multi-scale Temporal Feature Extraction: We employ the Time Series Feature extraction based on Scalable Hypothesis tests (TSFresh) to mine statistical, time-domain, and frequency-domain features from load sequences, constructing a rich multi-scale temporal representation.

(2)

Graph-level Embedding Feature Extraction: We utilize a Sparse Unified GATv2 module to model value-aware dependencies among historical states. By enhancing the input embedding with multi-scale contexts and constructing a sparse KNN graph, the method achieves unified modeling of local variations and global recurrences, thereby improving the expressiveness and robustness of graph-level features.

(3)

Cross-attention-based Dynamic Feature Fusion Mechanism: We design a cross-attention interaction module to enable deep coupling and dynamic weighting between multi-scale temporal features and graph-level features. This allows the model to adaptively focus on critical feature channels while suppressing redundancy from irrelevant information, significantly enhancing the accuracy and stability of anomaly detection.

This study achieves deep feature fusion of power load data by leveraging the synergistic modeling of TSFresh and Sparse GATv2 networks, combined with a cross-attention mechanism. Distinct from traditional unsupervised methods that rely solely on reconstruction errors of normal data, this work explicitly formulates electricity theft detection as a supervised binary classification task by introducing labeled synthetic anomalous samples. The proposed TGCformer framework, through end-to-end learning, explicitly discriminates between normal consumption patterns and theft behaviors and directly outputs anomaly scores, thereby providing an efficient, scalable, and interpretable solution for complex power systems.

2. TGCformer

2.1. Overall Framework

To address the limitations regarding the insufficient representation of multi-scale temporal patterns and the difficulty in effectively modeling dynamic value-based dependencies in power load data, this paper proposes a Time-Graph Fusion anomaly detection framework named TGCformer. This framework significantly improves anomaly detection performance by jointly modeling multi-scale temporal statistical features and dynamic graph-level features. Figure 1 illustrates the overall architecture of the TGCformer framework, which consists of four integrated modules: multi-scale temporal feature extraction, graph-level embedding extraction, cross-attention-based Time-Graph feature fusion, and anomaly classification.

(1)

Temporal Feature Extraction Branch: As shown in Module 1 of Figure 1, the raw power load time series is first processed by the TSFresh module to extract a comprehensive set of multi-scale temporal features, including time-domain statistics, frequency-domain descriptors, and non-linear features. These features explicitly encode the volatility, periodicity, and distributional properties of the load sequences. To reduce redundancy and enhance robustness, statistical significance testing and feature selection processes are applied (as indicated by the filtering module in the figure). This branch outputs a refined temporal feature vector containing 783 significant features, serving as the temporal semantic representation for subsequent fusion.

(2)

Graph-level Embedding Extraction: In parallel with temporal modeling, Module 2 of Figure 1 depicts the global dependency modeling process. The time series is transformed into a latent value graph structure by constructing a sparse adjacency matrix using the K-Nearest Neighbors (KNN) algorithm, where each node represents a time point, and edges encode semantic proximity based on signal magnitude (rather than temporal distance). The resulting sparse graph is then fed into stacked Sparse Unified GATv2 layers. Incorporating a unified feature embedding (comprising multi-scale statistics and positional encodings), this layer achieves adaptive attention-based aggregation of recurrent pattern information. A mean pooling operation is subsequently applied to aggregate node-level embeddings into a global graph-level representation with a dimension of 64, preserving both value-based topological relations and global dependency patterns.

(3)

Dual-Channel Fusion based on Cross-Attention: Module 3 of Figure 1 corresponds to the proposed multi-head cross-attention mechanism. In this module, the refined temporal features from the upper branch are projected via a linear layer into a unified 512-dimensional embedding space as Query vectors, while the graph-level embeddings from the lower branch are similarly mapped to the same dimension to serve as Key and Value vectors. Through cross-attention, the model explicitly aligns local temporal patterns with global structure-related graph information, allowing temporal semantics to dynamically guide the weighting of graph-structural dependencies. The multi-head design, as illustrated by the parallel attention heads in the figure, enables the learning of complementary heterogeneous feature interactions across different subspaces. Additionally, residual connections and normalization layers are employed to ensure stable training and effective deep feature encoding.

(4)

Anomaly Classification Head: As shown in Module 4 of Figure 1, the fused dual-channel joint representation is passed to a Multilayer Perceptron (MLP) classifier. The MLP further refines features through stacked linear layers and non-linear activation functions, transforming high-dimensional Time-Graph dependencies into discriminative semantics. Finally, the output layer employs a Sigmoid activation function to map the latent features to a probability score within the interval [0, 1], functioning as a binary classifier to determine whether a given sample belongs to the normal or anomalous class, thereby achieving robust power load anomaly detection.

2.2. Dual-Channel Structural Feature Extraction and Encoding

2.2.1. Multi-Scale Time Series Statistical Feature Extraction

In the temporal dimension, the proposed TGCformer framework employs the TSFresh library [21] to systematically extract a comprehensive set of multi-scale features. This process automatically mines statistical, time-domain, and frequency-domain characteristics, thereby enabling an explicit and robust characterization of the sequential and evolutionary patterns inherent in time series data. Figure 2 provides a visualization of example features extracted by TSFresh. To provide a rigorous mathematical grounding,

Table 1. Mathematical Definitions of Representative Time Series Features.

No.	Feature & Description	Mathematical Formula
1	Absolute Energy: Reflects the overall amplitude or intensity of the signal	$E={\displaystyle \sum _{i=1}^n} x_i^2$
2	Mean Change: Indicates the overall trend of the time series	$MC={\displaystyle \frac{1}{n}}{\displaystyle \sum _{i=1,\dots ,n-1}} (x_{i+1}-x_i)$
3	Absolute Sum of Changes: Quantifies the total volatility of the sequence.	$ASOC={\displaystyle \sum _{m=0}^{n-1}} \left|x_{i+1}-x_i\right|$
4	FFT Coefficient: Captures periodicity and frequency characteristics.	$A_k={\displaystyle \sum _{m=0}^{n-1}} a_m\mathrm{e}\mathrm{x}\mathrm{p}\left(-2\pi i{\displaystyle \frac{mk}{n}}\right)$
5	${\mathrm{C}}_3$ Parameter: Characterizes self-similarity and nonlinearity.	${\mathrm{C}}_3={\displaystyle \frac{1}{n-2\mathrm{lag}}}{\displaystyle \sum _{i=0}^{n-2\mathrm{lag}}} x_{i+2\mathrm{lag}}^2{x}_{i+2\mathrm{lag}}{x}_i$

details the definitions and formulations of representative features used to capture properties such as central tendency, volatility, periodicity, and nonlinearity.

As shown in Module 1 of Figure 1, after TSFresh extracts multi-scale features, feature selection is required. Univariate linear regression F-test [22] is used to screen significant features:

$$SSR=\sum _{j=1}^n {\left({\widehat{y}}_j-\overline{y}\right)}^2,SSE=\sum _{j=1}^n {\left(y_j-{\widehat{y}}_j\right)}^2$$

(1)

$$F={\displaystyle \frac{SSR/1}{SSE/(N-2)}}$$

(2)

$$p=P(F_{1,N-2}\ge F_{obs})$$

(3)

Subsequently, the Benjamini–Yekutieli (BY) procedure [23] is applied to control the false discovery rate:

$$p_{\left(i\right)}^{BY}S=\mathrm{m}\mathrm{i}\mathrm{n}\left({\displaystyle \frac{g·p\left(i\right)}{i}}c(e),1\right),c(g)=\sum _{j=1}^n {\displaystyle \frac{1}{j}}$$

(4)

If the corrected $p_{\left(i\right)}^{BY}<0.05$, the feature is considered significant and retained.

2.2.2. Graph-Level Embedding Feature Extraction Based on Sparse Unified GATv2

To characterize the long-range recurrent patterns of load sequences, we design a dynamic graph feature extraction module based on Sparse Unified GATv2 (Module 2 in Figure 1). Unlike traditional approaches that rely on predefined physical grid topology (which is often unavailable), we define the “spatial” structure in the latent feature space. This allows the model to capture global semantic correlations by connecting time steps that exhibit similar behaviors, regardless of their temporal distance.

• Sparse Neighbor Graph Construction based on Value Similarity

We treat the univariate time series as graph-structured data, where each time point constitutes a node. To capture long-term dependencies effectively, we propose a graph construction strategy based on magnitude similarity rather than temporal proximity. Specifically, we use the K-Nearest Neighbors (KNN) algorithm to construct a sparse adjacency matrix: for time point $\mathrm{i}$, the $\mathrm{k}$ nodes with the smallest absolute value difference (i.e., $|{\mathrm{x}}_{\mathrm{i}}-{\mathrm{x}}_{\mathrm{j}}|$) are selected as neighbors, forming a sparse graph $\mathrm{G}=(\mathrm{V},\mathrm{E})$. This structure explicitly links historically similar states, enabling the network to learn from recurrent anomalies [24,25].

To provide rich semantic context for the attention mechanism, we construct a “Unified Node Embedding” as the input. The initial features of each node consist of three parts: (1) the original load value ${\mathrm{x}}_{\mathrm{i}}$; (2) multi-scale statistical features (mean ${\mathsf{\mu }}_{\mathrm{i}}^{\left(\mathrm{s}\right)}$ and standard deviation ${\mathsf{\sigma }}_{\mathrm{i}}^{\left(\mathrm{s}\right)}$) to capture local temporal context; and (3) sinusoidal positional encoding $\mathrm{P}\mathrm{E}\left(\mathrm{i}\right)$ to explicitly inject sequential order information into the non-sequential graph topology [26]. The unified embedding formulas are as follows:

$${\mu }_i^{\left(s\right)}={\displaystyle \frac{1}{s}}\sum _{t=i-⌊{\displaystyle \frac{s}{2}}⌋}^{i+⌊{\displaystyle \frac{s}{2}}⌋} x_t, {\sigma }_i^{\left(s\right)}=\sqrt{{\displaystyle \frac{1}{s}}\sum _{t=i-⌊{\displaystyle \frac{s}{2}}⌋}^{i+⌊{\displaystyle \frac{s}{2}}⌋} x_t^2-{\left({\mu }_i^{\left(s\right)}\right)}^2}$$

(5)

$${PE\left(i\right)}_{2p}=\mathrm{s}\mathrm{i}\mathrm{n}\left({\displaystyle \frac{i}{{\mathrm{10,000}}^{\frac{2p}{d_{model}}}}}\right),\hspace{1em}{PE\left(i\right)}_{2p+1}=\mathrm{c}\mathrm{o}\mathrm{s}\left({\displaystyle \frac{i}{{\mathrm{10,000}}^{\frac{2p}{d_{model}}}}}\right)$$

(6)

2.

Dynamic Graph Attention Modeling

Based on the constructed sparse value-graph and unified embeddings, we employ the GATv2 mechanism [27] to dynamically update node representations. GATv2 incorporates a nonlinear mapping before computing attention weights, allowing it to fix the static attention problem of standard GAT. In our Sparse Unified framework, this mechanism focuses on aggregating information from “semantic neighbors” (nodes with similar values) rather than just temporal neighbors.

For node $i$ at layer $l$, its unified feature $h_i$ and the feature $h_j$ of neighbor node $j$ (where $j$ is determined by the value-based KNN) are linearly transformed and concatenated, then input into a $LeakyReLU$ function, followed by a nonlinear mapping to obtain the attention score (as shown in Figure 3):

$$q_{ij}=a^{T}LeakyReLU\left(\left[W{h}_i\left|\right|W{h}_j\right]\right), j\in N_i$$

(7)

where $q_{ij}$ reflects the importance of neighbor node $j$ to node $i$.

The $\mathrm{S}\mathrm{o}\mathrm{f}\mathrm{t}\mathrm{m}\mathrm{a}\mathrm{x}$ function is used for normalization within the neighbor set to compute attention weights:

$${\alpha }_{ij}={\displaystyle \frac{\mathrm{e}\mathrm{x}\mathrm{p}{(q}_{ij})}{{\sum }_{k\mathsf{ϵ}{N}_i} \mathrm{e}\mathrm{x}\mathrm{p}{(q}_{ik})}}$$

(8)

where $N_i$ denotes the set of neighbors for node $i$.

GATv2 employs a multi-head attention mechanism to enhance feature representation capability:

$$h_i^{(l+1)}={\left|\right|}_{k=1}^K\sigma \left({\sum }_{jϵN_i} {\alpha }_{ij}^k{W}^k{h}_j^{\left(l\right)}\right),k\in (\mathrm{0,1},2,\cdots ,\mathrm{K})$$

(9)

The multi-head mechanism yields richer and more robust node feature representations. Residual connections and layer normalization are applied after each GATv2 layer to improve training stability and convergence. After multiple stacked layers, the final node graph embedding representation is obtained.

3.

Graph-level Feature Aggregation

To obtain global dynamic graph features for the entire time series, an average pooling operation is introduced after the sparse GATv2 layers, aggregating the embedding features of all nodes into a graph-level representation vector:

$${Avepool(h}_G)={\displaystyle \frac{1}{N}}\sum _{i=1}^N h_i^{\left(L\right)}$$

(10)

The resulting graph-level feature vector $h_G$ comprehensively characterizes the dynamic dependency structure of the load sequence, providing a dynamic graph semantic representation foundation for subsequent cross-attention fusion.

2.3. Dual-Channel Feature Fusion and Encoding Based on Multi-Head Cross-Attention

In power load anomaly detection, sequential features and graph-based topological features are heterogeneous, exhibiting significant differences in semantic expression and statistical distribution. While the self-attention mechanism of the standard Transformer can effectively capture global dependencies within time series, its cross-modal information interaction capability is limited. It can only model dependencies within a single modality, making it difficult to explicitly model the relationship between the local temporal context and global graph structure, leading to insufficient multi-view information fusion. To address this, this paper proposes the introduction of a cross-attention mechanism [28,29] based on the standard Transformer framework, aiming to achieve deep interactive fusion of multi-scale temporal features and graph embedding features (as shown in Module 3 of Figure 1).

Specifically, TGCformer takes the multi-scale time series features $Y_{tsf}$ extracted by TSFresh and the graph embedding features $Y_{gat}$ generated by the sparse GATv2 network as dual-channel inputs. The cross-attention mechanism enables explicit relational modeling between these heterogeneous features. As shown in Figure 4, $Y_{tsf}$ serves as the Query vector, and $Y_{gat}$ serves as the Key and Value vectors, obtained via linear projection:

$$Q_{tsf}=Y_{tsf}{W}^Q,K_{gat}=Y_{gat}{W}^K,V_{gat}=Y_{gat}{W}^V$$

(11)

Cross-attention generates fused features by computing the similarity between Query and Key and performing a weighted sum over Value:

$$Attention\left(Q_{tsf},K_{gat},V_{gat}\right)=\mathit{softmax}\left({\displaystyle \frac{Q_{tsf}{K_{gat}}^T}{\sqrt{d_k}}}\right)V_{gat}$$

(12)

Compared to self-attention, which focuses only on dependencies within the same source, cross-attention achieves directed interaction between features from the temporal and graph domains. It can adaptively aggregate graph structure information most relevant to the temporal features, achieving cross-modal feature alignment. Furthermore, to enhance multi-semantic relational modeling capability for dual-channel features, a Multi-Head Cross-Attention mechanism is introduced to learn complementary relationships in parallel across different subspaces:

$$H^{\left(f\right)}=MultiHead\left(Q_{tsf},K_{gat},V_{gat}\right)=Concat({head}_1,{head}_2,\cdots {head}_n)W^O$$

(13)

where $W^O$ is a learnable linear projection matrix.

The multi-head mechanism learns in parallel across different feature subspaces, thereby capturing complementary semantic relationships between temporal and graph structural features, significantly enhancing dual-channel dependency modeling capability and feature expression richness.

To improve deep encoding stability, TGCformer retains the Transformer’s residual connection and layer normalization structure, ensuring stable gradient propagation and enhancing feature representation efficiency. The inter-layer computation is as follows:

$$X^{\prime }=LayerNorm\left(X_{input}+MultiHead\left(Q_{tsf},K_{gat},V_{gat}\right)\right)$$

(14)

$$Z=LayerNorm\left(X^{\prime }+FFN\left(X^{\prime }\right)\right)$$

(15)

The Feed-Forward Network (FFN) adopts a standard two-layer linear transformation structure with GELU activation and Dropout to prevent overfitting:

$$FFN\left(x\right)=Dropout\left({Linear}_2\left(GELU\left({Linear}_1\left(x\right)\right)\right)\right)$$

(16)

where ${\mathrm{L}\mathrm{i}\mathrm{n}\mathrm{e}\mathrm{a}\mathrm{r}}_1\in {\mathrm{R}}^{{\mathrm{d}}_{\mathrm{m}\mathrm{o}\mathrm{d}\mathrm{e}\mathrm{l}}\times {\mathrm{d}}_{\mathrm{f}\mathrm{f}}}$,${\mathrm{L}\mathrm{i}\mathrm{n}\mathrm{e}\mathrm{a}\mathrm{r}}_2\in {\mathrm{R}}^{{\mathrm{d}}_{\mathrm{f}\mathrm{f}}\times {\mathrm{d}}_{\mathrm{m}\mathrm{o}\mathrm{d}\mathrm{e}\mathrm{l}}}$, and ${\mathrm{d}}_{\mathrm{f}\mathrm{f}}\gg {\mathrm{d}}_{\mathrm{m}\mathrm{o}\mathrm{d}\mathrm{e}\mathrm{l}}$ to enhance nonlinear representation capability.

The fused feature vector $H_{fused}$ obtained after stacking multiple cross-attention layers is input into a Multilayer Perceptron (MLP) for anomaly detection (as shown in Module 4 of Figure 1). The designed MLP has four hidden layers, each containing linear projection, batch normalization, GELU activation function, and Dropout to enhance nonlinear representation capability and reduce overfitting risk [30]. The forward pass can be represented as:

$$h^{\left(l\right)}=Dropout\left(GELU\left(BN\left(W^{\left(l\right)}{h}^{(l-1)}+b^{\left(l\right)}\right)\right)\right), l=\mathrm{1,2},\mathrm{3,4}$$

(17)

$$GELU(x)=x·\mathsf{\Phi }(x)=x·{\displaystyle \frac{1}{2}}\left[1+erf\left({\displaystyle \frac{x}{\sqrt{2}}}\right)\right]$$

(18)

The output layer maps the last hidden layer features to a single neuron and generates the probability of a sample belonging to the anomalous class via the Sigmoid activation function:

$$z=\left(W^{\left(0\right)}{h}^{\left(4\right)}+b^{\left(0\right)}\right)$$

(19)

$$\widehat{\mathrm{y}}=\sigma (z)={\displaystyle \frac{1}{1+e^{-z}}}$$

(20)

During training, the network uses Focal Loss to optimize the anomaly detection task:

$${\mathcal{L}}_{focal}=-\mathsf{\alpha }\mathrm{y}(1-\widehat{\mathrm{y}}{)}^{\mathsf{\gamma }}\mathrm{l}\mathrm{o}\mathrm{g}(\widehat{\mathrm{y}})-(1-\mathsf{\alpha })(1-\mathrm{y}){\widehat{\mathrm{y}}}^{\mathsf{\gamma }}\mathrm{l}\mathrm{o}\mathrm{g}(1-\widehat{\mathrm{y}})$$

(21)

where $\alpha$ and $\gamma$ are tuning factors to mitigate training bias caused by class imbalance.

3. Experiments and Validation

3.1. Data Description

This study employs the smart meter measurement dataset published by the Irish Electricity Research Center (Irish CER Smart Meter Dataset) [31] as the foundation for experimentation. The dataset comprises electricity consumption records from 5633 residential and commercial users, with a sampling interval of 1 h, yielding a total of 12,002 time series. Given that the data originates from compliant participants, it is reasonable to consider the original data as a reliable baseline representing normal electricity consumption behavior.

To effectively evaluate electricity theft detection, it is essential to construct anomalous samples that accurately simulate real-world attacks. Drawing on references [32,33,34] and typical Advanced Metering Infrastructure (AMI) attack modes, including physical, firmware, and communication network attacks [35], this paper proposes six strategies for generating electricity theft data. These strategies focus on distinct scenarios such as consumption reduction, zero-setting, and random perturbation, which correspond to various non-technical loss patterns. The specific mathematical formulations and descriptions are detailed in

Table 2. Methods for Constructing Anomalous Electricity Consumption Data.

No.	Method Description	Mathematical Formula
1	Proportional Reduction: Randomly select consecutive daily data and scale it down uniformly.	${\tilde{x}}_t=\alpha x_t,\alpha ~\mathrm{U}\left(\mathrm{0,1}\right)$
2	Threshold-based Perturbation: Randomly reduce only the data points exceeding a high percentile threshold.	${\tilde{x}}_t=\left\{\begin{array}{c}{x}_t,\hspace{1em}\hspace{1em}{x}_t\le c\hfill \\ {{\alpha }_{t}x}_t,\hspace{1em}\hspace{1em}{x}_t>c\hfill \end{array},\right.{\alpha }_t~\mathrm{U}\left(\mathrm{0,1}\right)$
3	Constant Truncation: Subtract a constant from all values, setting results below zero to zero.	${\tilde{x}}_t=\max \left(x_t-c,0\right)$
4	Time-interval Zero-setting: Set data within random 8-h intervals on selected days to zero.	${\tilde{x}}_t=\beta x_t,\beta =\left\{\begin{array}{c}0,{ t\in [t}_i,t_j]\\ 1, otherwise\end{array}\right.$
5	Daily Random Perturbation: Scale each day’s data independently by a daily random factor.	${\tilde{x}}_t={{\alpha }_{t}x}_t,{\alpha }_t~\mathrm{U}\left(\mathrm{0,1}\right)$
6	Monthly mean Propagation: Scale each month’s data using the previous month’s average as a coefficient.	${\tilde{x}}_t=x_{t}mean\left(x_{t-1}^{\mathrm{m}\mathrm{o}\mathrm{n}\mathrm{t}\mathrm{h}}\right)$

.

Subsequently, the synthesized anomalous samples are integrated into the original normal data at specified proportions, yielding three distinct anomalous datasets with anomaly injection ratios of 5%, 10%, and 15%, respectively. These datasets are designed for comprehensive model evaluation and robustness validation across multiple scenarios.

Figure 5 illustrates the hourly electricity consumption distribution comparison between normal samples and the six types of anomalous samples. It is evident that normal samples exhibit a broader distribution range, with both median and extreme values notably surpassing those of the anomalous samples. In contrast, all anomalous samples demonstrate an overall downward shift and a distributional contraction, with the degree of variability determined by the specific theft method applied. This indicates that the anomalous samples generated in this study are statistically distinct from normal behaviors and can effectively simulate various real-world theft patterns, thereby providing a robust evaluation basis for subsequent anomaly detection models.

3.2. Experimental Setup and Evaluation Metrics

To guarantee the reproducibility and transparency of the experiments, the detailed experimental environment and key model configurations are summarized in

Table 3. Experimental Environment and Key Configurations.

Category	Configuration/Value	Category	Configuration/Value
Processor	AMD EPYC 9354	Batch Size	512
GPU	NVIDIA RTX 4090	Learning Rate	1 × 10−4
Python Version	3.11.8	Total Training Epochs	20
PyTorch Version	2.2.2	Weight Decay	1 × 10−4
Data Split Ratio	8:1:1 (Train:Val:Test)	Dropout Rate	0.1
Optimizer	AdamW	KNN (K)	8
Loss Function	Focal Loss $(\mathsf{\alpha }=1,\mathsf{\gamma }=2)$	GATv2 layers	4
Random Seed	[123, 199, 1998, 2178, 3047]	Number of Cross-Source Attention Layers	8
Multi-scale window sizes	{4, 8, 16, 32, 64}	Number of Attention Heads	8

. All experiments were performed on a high-performance cloud computing instance running on a Linux operating system. The model was implemented using Python 3.11.8 and the PyTorch 2.2.2 deep learning framework. Specifically, for the multi-scale statistical feature extraction, we employed window sizes of $s\in \{4,8,16,32,64\}$; boundary effects were managed by clamping the window indices to the valid time range [0, T], effectively using dynamically reduced windows at the sequence edges without zero-padding. For model optimization, we employed the AdamW optimizer. To effectively mitigate class imbalance, Focal Loss was utilized as the objective function, with its hyperparameters $\mathsf{\alpha }$ and $\mathsf{\gamma }$ set to 1 and 2, respectively. The dataset was randomly partitioned into training, validation, and test sets following an 8:1:1 ratio. To prevent data leakage, each sample in the dataset encapsulates the complete electricity consumption record of a single user. These subsets were utilized exclusively for model parameter learning, hyperparameter tuning, and final performance evaluation, respectively. Furthermore, to demonstrate the robustness of our approach, experiments were conducted using five distinct random seeds. Consequently, the final results are reported as the $\mathrm{m}\mathrm{e}\mathrm{a}\mathrm{n}\pm \mathrm{s}\mathrm{t}\mathrm{a}\mathrm{n}\mathrm{d}\mathrm{a}\mathrm{r}\mathrm{d}$ deviation.

To comprehensively evaluate model performance in the power load anomaly detection task, this paper selects Accuracy, Precision, Recall, F1-score and FPR as evaluation metrics. The calculation methods are as follows:

$$Accuracy={\displaystyle \frac{TP+TN}{TP+FP+TN+FN}}$$

(22)

$$Precision={\displaystyle \frac{TP}{TP+FP}}$$

(23)

$$Recall={\displaystyle \frac{TP}{TP+FN}}$$

(24)

$$F1-score=2\times {\displaystyle \frac{Precision\times Recall}{Precision+Recall}}$$

(25)

$$FPR={\displaystyle \frac{FP}{FP+TN}}$$

(26)

3.3. Overall Performance Evaluation of TGCformer

To systematically evaluate the robustness of TGCformer under varying anomaly distributions, comparative experiments were conducted on datasets with anomaly rates set at 5%, 10%, and 15%. As presented in

Table 4. Comparative Experiments with Other Anomaly Detection Methods.

Method	Anomaly Rate	ACC	Precision	Recall	F1-Score	FPR
XceptionTime [36]	5%	0.955 ± 0.005	0.778 ± 0.447	0.107 ± 0.126	0.175 ± 0.180	0.001 ± 0.001
	10%	0.915 ± 0.007	0.944 ± 0.073	0.161 ± 0.101	0.263 ± 0.141	0.002 ± 0.002
	15%	0.870 ± 0.017	0.845 ± 0.102	0.153 ± 0.130	0.244 ± 0.173	0.003 ± 0.002
InceptionTime [37]	5%	0.949 ± 0.002	0.780 ± 0.114	0.171 ± 0.122	0.259 ± 0.146	0.003 ± 0.002
	10%	0.905 ± 0.004	0.880 ± 0.110	0.221 ± 0.077	0.348 ± 0.101	0.004 ± 0.004
	15%	0.889 ± 0.018	0.871 ± 0.054	0.311 ± 0.161	0.431 ± 0.185	0.009 ± 0.009
FormerTime [38]	5%	0.951 ± 0.005	0.689 ± 0.273	0.114 ± 0.042	0.187 ± 0.067	0.005 ± 0.005
	10%	0.912 ± 0.006	0.683 ± 0.134	0.229 ± 0.031	0.339 ± 0.036	0.013 ± 0.007
	15%	0.872 ± 0.014	0.639 ± 0.113	0.379 ± 0.148	0.454 ± 0.119	0.041 ± 0.021
LSTM-GNN [39]	5%	0.950 ± 0.000	0.475 ± 0.000	0.500 ± 0.000	0.487 ± 0.000	0.500 ± 0.000
	10%	0.901 ± 0.000	0.450 ± 0.000	0.500 ± 0.000	0.474 ± 0.000	0.500 ± 0.000
	15%	0.840 ± 0.013	0.471 ± 0.068	0.507 ± 0.015	0.478 ± 0.033	0.493 ± 0.015
TGCformer (Ours)	5%	0.982 ± 0.008	0.921 ± 0.079	0.714 ± 0.227	0.772 ± 0.142	0.004 ± 0.005
	10%	0.990 ± 0.005	0.978 ± 0.022	0.923 ± 0.038	0.949 ± 0.024	0.002 ± 0.002
	15%	0.979 ± 0.006	0.926 ± 0.022	0.937 ± 0.022	0.931 ± 0.021	0.013 ± 0.004

, TGCformer demonstrates superior performance and stability across all evaluation metrics compared to the baseline models.

First, TGCformer excels in handling scenarios with extreme class imbalance. In the challenging low-anomaly scenario (5%), despite the scarcity of positive samples, TGCformer achieves an Accuracy of 0.982 and an F1-score of 0.772. Although this F1-score is slightly lower than that observed at higher anomaly rates, it significantly outperforms all comparative methods, demonstrating its effectiveness in highly imbalanced settings. As the anomaly rate increases to 10% and 15%, the model’s Recall further improves to 0.923 and 0.937, respectively, with F1-score exceeding 0.93. This trend indicates that as the density of anomaly patterns increases, TGCformer captures potential faults more comprehensively while maintaining a consistently low False Positive Rate, thereby achieving an optimal balance between Precision and Recall.

In contrast, the baseline models exhibit significant limitations in low-anomaly scenarios, with distinct failure modes. On one hand, CNN-based models (InceptionTime and XceptionTime) together with the Transformer-based FormerTime are severely constrained by low Recall. This suggests a tendency to overfit the majority class (normal samples) during training, resulting in the missed detection of sparse anomalies. On the other hand, LSTM-GNN displays stochastic behavior, with its FPR hovering around 0.5 across all settings and Precision fluctuating between only 0.45 and 0.47. This indicates that LSTM-GNN lacks effective discriminative capability, performing similarly to random guessing.

In summary, the experimental results strongly confirm that TGCformer significantly surpasses traditional methods in both detection accuracy and stability. Unlike existing models that struggle to balance Precision and Recall in imbalanced datasets, TGCformer maintains high comprehensive performance with minimal fluctuation. This robustness makes it particularly suitable for real-world time-series anomaly detection tasks, effectively handling practical scenarios where anomalies are typically scarce and sporadic.

To assess the feasibility of deploying the proposed framework in real-world smart grid scenarios, we evaluated the computational performance of its three key stages: multi-scale feature extraction, graph embedding feature extraction, and the final model inference. Experiments were conducted on a workstation equipped with a GPU, and the results are summarized in

Table 5. Computational Performance Analysis of Different Stages in TGCformer.

Processing Stage	Device	Avg. Time/Sample	Throughput (Samples/s)
Multi-scale Feature Extraction (TSFresh)	CPU	98.68 s	0.01
Graph Embedding Feature Extraction (GATv2)	GPU	3.82 s	0.26
TGCformer Inference	GPU	1.60 ms	626.9

.

The multi-scale feature extraction stage is the main contributor to computational overhead, taking approximately 98.7 s per sample. Future improvements, including batch processing, GPU acceleration, and redundancy elimination through correlation analysis, are expected to mitigate this bottleneck

In contrast, the graph embedding feature extraction module effectively leverages GPU acceleration, reducing latency to 3.82 s per sample. Most importantly, the core TGCformer model demonstrates exceptional efficiency, achieving an inference time of only 1.60 ms per sample and a throughput of 626.90 samples/s while occupying merely 254.75 MB of GPU memory. This ultra-low latency and minimal memory footprint confirm that the TGCformer is highly scalable and ideally suited for deployment on resource-constrained embedded devices within smart grids, enabling robust real-time anomaly detection.

3.4. Ablation Study

To verify the effectiveness of the model design, ablation experiments were conducted on the test set with an anomaly ratio of 10%, comparing detection performance with different feature inputs. The results are shown in

Table 6. Detection Performance under Different Feature Inputs.

FeatureSet	ACC	Precision	Recall	F1-Score	FPR
Only_TSFresh	0.973 ± 0.006	0.849 ± 0.058	0.898 ± 0.063	0.870 ± 0.025	0.019 ± 0.010
Only_GATv2	0.811 ± 0.077	0.394 ± 0.259	0.526 ± 0.125	0.379 ± 0.070	0.157 ± 0.096
TGCformer (Ours)	0.990 ± 0.005	0.978 ± 0.022	0.923 ± 0.038	0.949 ± 0.024	0.002 ± 0.002

.

When using only multi-scale temporal features (Only-TSFresh) modeled via self-attention, the model achieves acceptable but suboptimal performance in both precision (0.849) and recall (0.898). Its overall performance (F1-score of 0.870) shows a clear gap compared to the complete model, indicating that relying solely on temporal statistical information is insufficient for optimal detection. When using only graph embedding features (Only-GATv2), performance is weakest, with precision notably decreased to 0.394 and the false alarm rate high (0.157), suggesting that utilizing only graph embedding features cannot provide sufficient discriminative power. The complete TGCformer, which employs dual-channel collaborative modeling and performs explicit fusion via cross-attention, achieves the best performance in precision (0.978), recall (0.923), and F1-score (0.949), while maintaining an extremely low false positive rate (0.002). This validates that the dual-channel collaborative modeling and the cross-attention mechanism can effectively integrate the strengths of different feature modalities, thereby significantly enhancing anomaly pattern recognition capability and detection stability.

Figure 6 compares the confusion matrices of single-channel and fusion models. The model employing only the Graph Attention Network (middle) exhibits suboptimal performance with a high error rate, indicating that static topology alone is insufficient for effective dynamic fault detection. The model utilizing only temporal statistical features (left) shows improved accuracy but still suffers from noticeable detection blind spots. In stark contrast, the proposed TGCformer (right) achieves a significant performance leap through cross-modal feature calibration: it substantially reduces false positive cases while minimizing false negatives to the lowest number. These results confirm that the proposed fusion strategy effectively filters out noise, thereby significantly enhancing the robustness and reliability of the detection system.

3.5. Visualization and Interpretability Analysis

To qualitatively evaluate the interpretability of the proposed model, we randomly selected a True Positive (TP) sample and a True Negative (TN) sample from the test set and visualized the attention weight matrices from the final cross-attention layer as heatmaps (Figure 7).

As illustrated in Figure 7 (Left), the TP sample exhibits a highly sparse and selective attention distribution, where specific attention heads (e.g., Head 3) show strong activation towards certain graph tokens (e.g., the token at index 2). This indicates the model’s capability to precisely localize key topological substructures associated with faults. In contrast, the TN sample in Figure 7 (Right) displays a distinctly different activation pattern (e.g., Head 5 focusing on the token at index 5). This shift in structural focus demonstrates the model’s context-awareness in adaptively adjusting its focus on graph embedding features driven by the input temporal signals.

Furthermore, the diversity in attention targets across different attention heads confirms the effectiveness of the multi-head cross-attention mechanism. This mechanism enhances representational robustness by simultaneously capturing diverse features, ranging from local neighborhood variations to global structural consistency, thereby improving the fusion and representation of complex patterns.

To intuitively evaluate the model’s effectiveness in feature representation learning and latent structure reconstruction, we compared the distribution of multi-scale features (TSFresh) with the fusion embeddings, as shown in Figure 8. Figure 8 (Left) illustrates the PCA dimensionality reduction results of the TSFresh features: although normal users (blue dots) are concentrated in the central region, they exhibit a distinct “long-tail” distribution along both the horizontal and vertical axes. Simultaneously, anomalous users (red dots) show significant overlap with normal samples, resulting in a highly entangled distribution pattern that is difficult to linearly separate. In stark contrast, the t-SNE visualization of the embeddings processed by the cross-attention mechanism (Figure 8, Right) demonstrates a qualitative leap: positive and negative samples achieve high inter-class separability in the feature space with clear boundaries between the two classes. Furthermore, the anomalous samples aggregate into two highly cohesive sub-clusters, exhibiting superior intra-class compactness. This transition from the “entanglement and overlap” of multi-scale features to the “clarity and clustering” of fusion features strongly validates that the TGCformer model has successfully captured highly discriminative latent patterns, laying a solid foundation for its superior classification performance.

4. Conclusions

This paper proposes TGCformer, a novel dual-channel model for dynamic Time-Graph feature fusion, designed for power load anomaly detection. TGCformer integrates multi-scale temporal features with graph-based semantic features, aiming to fully leverage global temporal patterns and the global semantic correlations among recurrent time steps. Experimental results demonstrate that TGCformer consistently achieves excellent performance across various anomaly ratio scenarios. The model’s overall performance significantly outperforms state-of-the-art deep temporal baselines, including XceptionTime, InceptionTime, FormerTime, and LSTM-GNN, with substantial average improvements. This validates the model’s robustness and superiority in identifying anomalies within imbalanced datasets. However, the study also reveals a limitation: when the model relies heavily on the cross-attention mechanism for fusion, it may underutilize discriminative features from individual channels, potentially hindering fine-grained recognition of specific anomaly types. Future work will explore methods to enhance the model’s adaptive utilization of diverse features, preserving its fusion strengths while better harnessing the discriminative power of heterogeneous information.