Detecting electricity theft via meter tampering using statistical methods

A system and method for detecting anomalous energy usage of building or household entities. The method applies a number of successively stringent anomaly detection techniques to isolate households that are highly suspect for having engaged in electricity theft via meter tampering. The system utilizes historical time series data of electricity usage, weather, and household characteristics (e.g., size, age, value) and provides a list of households that are worthy of a formal theft investigation. Generally, raw utility usage data, weather history data, and household characteristics are cleansed, and loaded into an analytics data mart. The data mart feeds four classes of anomaly detection algorithms developed, with each analytic producing a set of households suspected of having engaged in electricity theft. The system allows a user to select households from each list or a set based on the intersection of all individual sets.

FIELD OF INVENTION

The present disclosure relates to techniques for detecting electricity theft; more particularly, disclosure relates to a system and method to detect electricity theft via meter tampering using statistical method of anomaly detection.

BACKGROUND

An electric meter is used to assist electric utility companies to monitor electrical energy usage at a respective household or place of business. Electricity tampering is a phenomena conducted by unscrupulous people to obtain free electricity use by compromising the electricity meter typically installed at household residences and businesses to alter their recorded energy consumed. Theft of electricity via meter tampering is a large problem ($1B-10B in lost revenue).

Utilities that have installed smart meters would like to leverage their investment by reducing this loss. Today, common methods include visual inspection of usage and ad-hoc auditing, i.e., manual processes to perform ad-hoc analysis of meter usage data. False positives are embarrassing and can damage customer relationships.

There currently does not exist any method of system to help an electric utility detect electricity theft. What few techniques are available are not coordinated with the electric utility company, nor are existing techniques effective in any sense to detect and/or isolate a single household's converting of electrical energy via meter tampering.

That is, many supervised learning techniques exist but these suffer from the need to have labeled theft data which is very hard to obtain. A system and method that addresses the need to perform such an analysis using unsupervised methods with unsupervised data would be highly desirable.

SUMMARY

There is provided a system and methodology for detecting and/or isolate a single household's converting of electrical energy using unsupervised methods such as via meter tampering.

In one embodiment, the system and methodology for detecting and/or isolate a single household's converting of electrical energy includes analyzing customer usage data, household characteristics, and weather data by flagging anomalously low energy consumption.

Generally, in one embodiment, the method applies a number of successively stringent anomaly detection techniques to isolate households that are highly suspect for having engaged in electricity theft via meter tampering. The system and methods employ adaptive statistical methods for detecting anomalous energy usage at the household level.

In one embodiment, the system utilizes historical time series data of electricity usage, weather, and household characteristics (size, age, value) and provides a list of households that are worthy of a formal theft investigation.

In one embodiment, there is provided a computer-implemented method for detecting anomalous energy usage amongst building and household entities. The method comprises: receiving, at a computing system, data comprising energy usage data relating to a building's actual energy use over a defined time period, characteristics data of the building, and weather data over one or more defined time periods; clustering buildings in one or more clusters as determined based on a building's energy usage in each time period; identifying buildings having energy usage that migrate from one cluster to another cluster between time periods, generating a model to predict a building's energy usage, the model defining expected bounds of energy consumption given time of day (shift) and weather and building characteristics data received; comparing energy usage for each building against an energy use predicted by the model for the building; and identifying, from the comparison, buildings whose electricity usage is not predicted by model; wherein the buildings identified as migrating from one cluster to another cluster between time periods, and the buildings exhibiting electricity usage not predicted by the generated model are flagged as anomalous energy usage entities, wherein a processing unit of the computer system is configured to perform the receiving, clustering, identifying of migrating buildings, model generating, comparing, and the identifying of buildings from the comparison.

In a further aspect, there is provided a system for detecting anomalous energy usage amongst building and household entities. The system comprises: a data storage device; a processor unit coupled to the data storage device configured to perform a method to: receive, at a computing system, data comprising energy usage data relating to a building's actual energy use over a defined time period, characteristics data of the building, and weather data over one or more defined time periods; cluster buildings in one or more clusters as determined based on a building's energy usage in each time period; identify buildings having energy usage that migrate from one cluster to another cluster between time periods, generate a model to predict a building's energy usage, the model defining expected bounds of energy consumption given time of day (shift) and weather and building characteristics data received; compare energy usage for each building against an energy use predicted by the model for the building; and identify, from the comparison, buildings whose electricity usage is not predicted by model, wherein the buildings identified as migrating from one cluster to another cluster between time periods, and the buildings exhibiting electricity usage not predicted by the generated model are flagged as anomalous energy usage entities.

In accordance with a further aspect, there is provided a computer-implemented method for detecting anomalous energy usage amongst building and household entities, the method comprising: receiving, at a computing system, data comprising energy usage data relating to a building's actual energy use over a defined time period, characteristics data of the building, and weather data over one or more defined time periods; running a first anomaly energy use detection scheme to cluster buildings in one or more clusters as determined based on a building's energy usage in each time period and identify buildings having energy usage that migrate from one cluster to another cluster between time periods; running a second anomaly energy use detection scheme to generate a non-linear regression model to predict a building's energy usage, the model defining expected bounds of energy consumption given time of day (shift) and weather and building characteristics data received, and identifying buildings whose electricity usage is not predicted by model; and running a third anomaly energy use detection scheme to obtain from the generated non-linear regression model, a pattern of residuals of the generated model over time, a residual representing a difference between the energy actual and predicted energy use for a building, and identifying buildings demonstrating non-randomness of its obtained pattern of residuals; and running a fourth anomaly energy use detection scheme to estimate a sigma and theft likelihood field {Ln,t} of each building and each day, and obtaining a theft likelihood field for all the shifts; and, invoke a rule applied to the theft likelihood field; and flagging anomalous energy usage buildings as buildings identified as: having energy usage that migrate from one cluster to another cluster between time periods; having electricity usage not predicted by the model; exhibiting demonstrating non-randomness of its obtained pattern of residuals; or have a residual energy computed for a building as exceeding a certain distance from an expected residual mean based on the rule; or combinations thereof.

A computer program product is provided for performing operations. The computer program product includes a storage medium readable by a processing circuit and storing instructions run by the processing circuit for running a method(s). The method(s) is(are) the same as listed above.

DETAILED DESCRIPTION

The present system and methods address a number of challenges when detecting non-technical losses at the household level using Automated Metering System (AMS) meter data. These include: the managing of typically high AMS data volumes that are often not warehoused in a way that readily support analytics; the development and use of analytics that have low false-positive rates so that utility revenue assurance teams can better allocate their revenue protection investigative and enforcement resources; and identifying, obtaining, and cleansing additional (possibly third party) data such as weather and household and demographic characteristics. These data are critical for building better analytical models of household energy use.

As shown inFIG. 1A, the basic system infrastructure10to detect electricity theft via meter tampering using statistical methods is as follows: 1) data12, such as Raw utility usage data, weather history data, and household characteristics data, are subject to extraction, transformation and loading (ETL) processing15for cleansing, and eventual loading into an analytics data mart20; 2). The data mart20feeds data to a number of classes, e.g., four classes, of anomaly detection algorithms50that the system employs. As shown inFIG. 1A, the system applies a number of customized anomaly detection techniques52,54,56and58to isolate households that are highly suspect for having engaged in electricity theft via meter tampering. 3). Each analytic, e.g.,52,54,56and58, produces a corresponding set of households62,64,66and68suspected of having engaged in electricity theft. 4). The system allows the user to select households from each list or a set65based on the intersection60of all individual sets.

As referred to herein, a “household” entity corresponds to a physical structure or premises having one or more units to which electrical energy is supplied and used by occupants, and a “building” entity also corresponds to a structure or premises having a plurality of office or dwelling units to which electrical energy is supplied and used by occupants. Household, premises and building entities are interchangeable in the description herein.

FIG. 1Billustrates an example high level view30of the data architecture ofFIG. 1Aincluding all data elements12, ETL processing15, and the meter theft analytics datamart design20. As shown, the system10utilizes historical time series data of electricity usage32, customer demographics34and household/building characteristics (size, age, value) data36and weather data38. The datamart20is configured so that the relevant data features driving the theft analytics52,54,56,58are isolated. This ensures that for future engagements with other utilities, the main task would be a relatively easy (from a resource availability point of view) one of implementing the suitable ETL jobs to move utility-specific data to the datamart for consumption by the analytics. The goal is to eliminate the need to alter the analytics to accommodate utility-specific data schemas.

In one embodiment, the datamart20supplies the data in a cleansed structured form for delivery to the analytics described. This ensures structuring of analytic solutions so that they are not tied to a particular customer. Therefore, the datamart20is an enabler of the novel analytics to be deployed in the system. In one embodiment, the datamart schema incorporates a star schema for maintaining information to be provided for the combination of statistical and heuristic techniques described herein.

In one embodiment, the analysis includes providing meter theft analytic tracks52,54,56,58that automatically identify “suspicious” sets of households that are worthy of being further investigated by the utility's revenue protection department, and provide a list of households that should be considered suspect. The system assists an electric utility detect electricity theft by analyzing customer usage data, household characteristics, and weather data by flagging anomalously low energy consumption.

In one example embodiment, there is received or provided all data staging and analytic development activity on a computer system such as shown inFIG. 14described in greater detail herein below. In one embodiment, metered usage data33of all households in a utility's service area is being analyzed.

As a means of managing data volumes without sacrificing the quality of the developed analytics, meter usage data33may be aggregated daily, e.g., 15-minute time interval or “shift”, or aggregated data at an 8-hour shift. There may be three eight-hour shifts, for example, on input from the utility. As a reasonable assumption that theft patterns tend to follow customers' work schedules (i.e., customers remove meter tamper devices during normal business hours when they are not at home), then example shifts may be defined as an 8-hour block of time during the day: Shift 1 may corresponded to 00:00-07:59:59 hours, shift 2: 08:00-15:59:59 hours, and shift 3: 16:00-23:59:59 hours.

In addition to utility provided meter usage data33, there is input to the system weather data38, e.g., which may be provided as 5-minute interval reads of temperature and other features from monitoring stations within the utility's service area. This data may further be aggregated to the 3-daily shift level by postal code.

The system and method described herein are automatically invoked to identify anomalous buildings relative to problems that arise from meter tampering/electricity theft that: through a novel migration algorithm, identifies houses that change their behavior relative to other houses across times of the day; through generalization of Runs test used to test randomness of residuals, identifies houses with inexplicable electricity usage patterns after factoring out weather conditions and house characteristics; and through combination of rule-based and probability field methods, identifies houses that are occupied and exhibit suspiciously low electricity usage.

Since there are many different techniques for doing anomaly detection, one embodiment provides the utility revenue protection personal with a “menu” of activity tracks or “algorithmic kernels” that can be employed and arranged in customized flows for theft detection. Besides giving users the choice of which algorithmic kernel(s) (activity tracks) to employ for theft detection, each kernel ultimately draws some statistical or machine-learned inference about the data.

In a further embodiment, these techniques are used as an ensemble of filters applied to households to narrow down the set of suspicious ones; such techniques employing independent statistical and data analysis algorithms. The filter ensemble is the application of each of the analytics as a means of applying more rigorous criteria for flagging a household as ‘suspicious’ in an effort to reduce false positives. A method controlling ensemble filtering includes first identifying the set up of all suspicious households, Si, identified by analytic stream i, and implementing an ensemble technique to form the intersection of these sets to produce a new set of highly suspect households as they appear anomalous to all techniques.

A first algorithmic kernel identifies, in one example embodiment, buildings with anomalous usage patterns. In this first analytic track, the inputs to the computer system include daily shift usage data and weather data. Example whether data include, but are not limited to: temperature, peak temperature, temperature variance. Inputs further include building characteristics (e.g., size (e.g., square feet), floors, Number of occupants, age (year built), cooking fuel in use, heating fuel in use, a type of air conditioning (e.g., window air conditioners vs. central air conditioning), latitude of premise, longitude of premise, presence of a swimming pool, assessment value, number of bedrooms, number of bathrooms, last appraiser value, etc.). This track spots energy use cluster membership migrations from shift to shift.

The method includes first clustering households by usage in each shift. That is, for each of these shifts, the method assigns households to one of N clusters of homes determined based on their energy usage. The clustering is performed using the “2-step” using SPSS® (a registered trademark of Amos Development Corp.) analytics software provided K-means clustering method known in the art. For example, there are typically three clusters per shift: low usage households, medium usage, and high usage. The analytic identifies homes that migrate from one cluster to another between shifts.

The method leverages the fact that energy usage characteristics of households should follow regular patterns throughout the day (i.e., people going to work, coming home and turning on lights and air conditioners, etc.) If a home is placed in a cluster of ‘large’ energy consumers for morning and afternoon shifts, for example, it should remain there for the evening hours too since its large usage is likely an inherent characteristic of the home and its occupants. If it consistently migrates to a “small” usage cluster in the evening, for example, this is indicative of suspicious (electricity meter tampering) behavior.

In one embodiment, a 2-step clustering algorithm is implemented that uses the energy used in each shift as the clustering dimension (or distance measure). As shown in an example clustering application inFIG. 2, two clusters of households, household Cluster 1 including households H4, H5, H6and household Cluster 2 including households H1, H2, H3are generated in each shift. The algorithm first identifies consistently different households/buildings for each shift; and for each shift, forms clusters based on usage and find households that migrate from one group to another across shifts. The migrating households are indicative of suspicious behaviour. More particularly, as shown inFIG. 2, a migration algorithm40looks for houses (Households (H1, H2, H3)) that migrate between these energy usage clusters as the shift (time of day) changes. This technique exploits the fact that if a house acts as high energy user in one shift (e.g., it's big, or maybe inefficient) then it should not be acting as a low energy user in a different shift (because nothing fundamentally has changed about the house in the time from one shift to the next.) In fact, the data show that most houses remain in their peer cluster throughout the day. A small percentage does not, however, as exemplified by household (H3) which is shown to be part of an initial Cluster 2 in shift 2, however has migrated55to Cluster 1 in shift 3. These identified migrating households are collected as an initial set of suspicious houses65asFIG. 1Aillustrates.

A “migration algorithm” shown inFIG. 3is implemented for identifying houses that change based on usage the peer groups they belong to across times of day/shifts.FIG. 3shows a general method100of detecting migrating energy usage entities in the context of the present disclosure. From the theft data mart20, data processing techniques are invoked at102to partition the usage data into the number of usage shifts, e.g., three shifts. Then, at104, in each shift, for each building and/or household, a mean (M) and standard deviation (std) is computed. Then, at106, in each shift, there is performed clustering of the building/households based on the computed M and std. Then at108, there is performed identifying any building or household that switch clusters in different shifts, which buildings or households or flagged and reported at110as potentially anomalous.

The example result of this analysis40as depicted inFIG. 2shows that energy usage cluster migrations to low use clusters happen predominantly during the shift 2 to shift 3 time frame. This aligns very well with feedback from utility revenue protection personal about when people tamper with their meters (e.g., when they get home from work and want to turn on the air conditioning).

FIG. 4Adepicts an implementation of this analytic track implemented using analytics software such as the SPSS®, and particularly an example SPSS® Modeler that link together various data manipulations and analytic operations to make an overall “stream”70representing a solution flow. As shown inFIG. 4A, a Modeler Stream70for determining migrating houses is depicted. The SPSS® modeller stream70includes interconnected (linked) nodes such as the usage data source72node from which a data processing node73obtains usage data. Then the method splits into parallel paths74,75and76for processing according to shifts, with each parallel path including a series of one or more tasks represented as usage data aggregating supernode71, and clustering operations represented as supernode77each supernode consisting of complex processing operations once expanded. For example, the ‘complex’ operations include a collection of common data processing operations like data reading, whitespace removal, etc. Any analytic software or combination of software supporting linear regression, 2-step clustering, CSV file reading, and string manipulation can be used. In one embodiment, the R programming language (part of the GNU project) and environment for statistical computing could be used to encode this algorithm, for example. The data aggregating and clustering operations performed at each task are then merged at79to obtain a final list63of detected household migrations.

FIG. 5shows an example results list63of usage cluster migrations generated by the analytics software. This list indicates those premises detected as having energy use characteristics that “migrate” from one group (cluster) to another. The example list63shows the premises ID (corresponding to a household or building address)67and the corresponding entries56a,56band56ccorresponding to each of usage cluster the building belongs at each respective time interval, e.g., shift 1, shift 2 and shift 3, as processed according to the algorithm ofFIG. 3to detect the migration. From the example results list, it is seen that migration detected mostly occurs in the 3rdshift as shown by the example detections57, with some in the 1stshift.

A second algorithmic kernel identifies, in one example embodiment, buildings whose usage is persistently well below expected usage given the building characteristics and weather conditions. In this second analytic track, the method performs modeling energy usage with non-linear regression and flagging anomalies. This includes steps, for example, of identifying buildings whose electricity usage, after factoring out variations due to building characteristics and weather conditions, has a pattern that is inexplicable by the input variable such as temperature, home size, etc. This is done by creating a non-linear regression model of energy usage and comparing household usage to that predicted by the model. For each shift, the model “learns” over weather conditions and building characteristics to build the best fitting model.

That is, for each shift defined in the first analytic track, the system and method builds linear and non-linear regression models (see, e.g., Duda and Hart,Pattern Recognition and Classification,2nd Ed, November 2000. where the best model(s) is(are) chosen based on goodness of fit metrics) for household energy usage. The model features (i.e., predictors) include weather measurements (temperature, rainfall, wind speed, etc.) and building characteristics (size, age, presence of central air conditioning, etc.). The models define what are expected bounds of energy consumption given time of day (shift) and weather inputs. Then, the households are sorted by the number of times that their household energy usage falls below the model-defined lower bounds. Thus, the method applies regression modeling for finding anomalies for use with large scale electric utility meter data and the implements a metric for ranking relative theft likelihood based on the number of excursions from expected values factoring in weather and other predictors.

FIG. 6shows a general method200of detecting low energy usage by modeling an entity's energy usage with non-linear regressions. From the theft data mart20, data processing techniques are invoked at202to partition the usage data into the number of usage shifts, e.g., three shifts. Then, at204, there is built linear and non-linear regression models for each of the shifts where building characteristics, temperature statistics are inputs and total usage is the output. Then, at208, the method performs selecting the model(s) with the lowest computed error for each shift. Continuing, at step210, the method performs identifying, for each shift and each building/household, days when the usage is less than a predetermined amount of the estimated usage, e.g., less than 50% of the estimated usage. Such identified households or buildings are determined anomalous usage. Then, at220, for each building “b” and over all shifts, the method performs calculating “Tb”—a total number of anomalous usage time points. Then, at225, there is performed sorting the buildings/households based on Tb values in descending order. In one embodiment, as shown at230, a ranked ordered list of buildings showing significant excursions may be generated.

FIG. 7shows an example method of determining a household with a lower than expected usage, where for each shift80, a non-linear regression model is built that learns usage patterns over weather conditions and building characteristics. As indicated at82, models are generated that result in usage patterns85,86,87generated for respective households H1, H2and H3having similar characteristics and experiencing similar weather. In comparing the example learned usages85,86,87, there is identified household87whose usage is (persistently or) often significantly below expected and anomalous. Thus, the method at88includes identifying buildings whose usage is anomalous often significantly below expected.

FIG. 4Bshows the SPSS® Modeler stream ofFIG. 4Adeveloped to differentiates a suspicious from normal household and modified for determining low and persistently low usage buildings. In the example SPSS® Modeler Stream70′ ofFIG. 4B, the modeller stream includes interconnected nodes such as the energy usage data source72node from which a data processing node73obtains usage data. Then the method splits processing into parallel paths74′,75′ and76′ which may run concurrently, for processing data usage according to the defined shifts (three for example), with each path including tasks with a first task for generating non-linear regression models of energy use (by shift) represented as supernode46, and anomalous households detection operations based on the models represented as supernode47and other processing for obtaining totals, means and standard deviations and other statistical quantities used in detecting anomalous usage represented as supernode48. For example, supernode48takes the mean, sum, and standard deviation of the number of times a household's usage is flagged as anomalous and uses this as a basis for ranking the most ‘suspicious’ households. The generated statistical quantities based on the computed non-linear regression models of energy used for anomalous households detection operations are performed at each task are then merged at79′ to obtain a final list63′ of detected household migrations.

It is understood that one can also use combinations of the above (and other) methods to obtain a smaller list and gain higher confidence that a given household is engaged in fraudulent activity.

FIG. 8Ashows an example generated usage plot250of a most anomalous premises with the plot260being the actual usage and the plot270is the expected usage, e.g., for a shift, over a time period. Missing data is indicated at respective breaks in time in the plots.

FIG. 8Bdisplays an example usage plot255of a normal building in the previous plot. The plot265is the actual usage and the plot275is the expected usage. These two plots together show that the actual usage is actual greater than expected and thus the premise is not a candidate for potential theft investigation.

A third algorithmic kernel tests, in one example embodiment, a Randomness of Residuals. This third analytic track extends the use of non-linear regression techniques used during the second analytic track (e.g.,FIGS. 6, 7) by focusing on the pattern in the residuals of the model. In one embodiment, the method analyzes residual effects of usage after factoring out building characteristics and weather conditions by developing a customized randomization test. This kernel activity is used to spot apparent ‘intelligent’ behavior or ‘gaming’ in modeling residuals to flag possibly electricity theft.

A residual is defined as the difference in what a model (be it linear, or otherwise) predicts for the energy use of a house/building and what the energy use actually was as recorded by the meter, i.e., the difference in the actual and predicted energy use for a household. A random pattern(s) of residuals is expected in a statistical sense and is indicative that households are using energy in accordance with what would be ‘expected’ by the model. Residual patterns that demonstrate non-randomness (that is, display some sort of pattern) indicate that households are trying to ‘game’ the system by adjusting their energy usage to ‘make it look normal’.

In this embodiment, the methods implemented determine if daily usage is randomized given that there is some amount of usage. This involves creating the non-linear regression models of energy usage, such as described herein with respect toFIGS. 6 and 7, and then analyzing the time variations in the model residuals. This analytic uses a novel variant of runs statistic techniques as described in Bradley, Distribution-Free Statistical Test 1968 in which this method is adapted for continuous data rather than just binary data and introduces asymmetry in the statistic so that residuals where lower than expected energy consumption is seen are flagged, thus detecting the degree of “non-randomness” in the residual pattern of energy use in households.

FIG. 9demonstrates the concept for determining if daily usage is randomized. For example,FIG. 9depicts the households where for each shift90, a non-linear regression model is built200′ that learns usage patterns over weather conditions and building characteristics and can determine residual patterns. As indicated at92, models are generated that result in residual patterns95,96,97generated for respective households H1, H2and H3having similar characteristics and experiencing similar weather. In one embodiment, under normal conditions, after factoring out the weather and building characteristics by subtracting the actual usage from the expected usage obtained from the non-linear regression model, the residuals95,96,97of the non-linear regression models in the second analytic kernel described herein above should be random. If a pattern exists, then this is possibly a consequence of intelligent behavior on the part of the homeowner, and would indicate anomalous activity (e.g., household owner trying to adjust their usage to make it ‘look’ reasonable to avoid detection but yet below what it actually is to reduce their bill).

FIG. 10shows a general method300of detecting residual patterns by first modeling an entity's energy usage with non-linear regressions. From the theft data mart20, data processing techniques are invoked at302that perform regression or time series methods, such as by using Autoregressive Integrated Moving Average (ARIMA) exponential smoothing techniques, to obtain estimates (E) of total usage for each shift, e.g., three shifts. The process continues at305to perform computing a residual for each building, Rb, for every day in each shift as follows:
Rb=Fb−Ab
where Fb is the predicted usage and Ab are the actual energy usage. Then, at310, the computed Rb values (for each building) are sorted based on a time order. Then, continuing to315, there is performed computing a binary sequence(s) as follows:
s=1 ifRb>0
s=−1 ifRb<0.

In one aspect, the data is continuous (e.g., a sequence of real numbers, e.g., 0.5, 1.2, 2.4, . . . as a consequence of which Rb is continuous. The described conditions transform Rb which is a continuous sequence into an appropriate discrete one before the adapted test is applied.

Then, continuing to320, there is performed computing a runs statistic having a value “Z”. In particular, ‘Z’ is a “runs” statistic which is computed over a binary sequence, e.g., 1-1111-1. In this embodiment, there is implemented a customized statistic ‘P’ to detect patterns in the residuals. ‘P’ is computed from ‘Z’ multiplied by ‘f’ for the problem since only negative values of Rb (residual) are of interest.

First, as shown at325, there is computed a value “f” governed by
f=(# ofs=1)/(Length of Sequence).

Then, at330, there is computed a “P” value governed by:
P=Z*f

Continuing to335, a determination is made as to whether the computed value P>1. For example, if it is detected based on computed residuals that P>1, then this is indication that there exists a pattern and the corresponding building has anomalous usage as indicated at340. This statistic is implemented in SPSS Modeler such as via Modeler's component framework extension API. Otherwise, if P≦1 then, the building is deemed to exhibit normal usage (no residuals pattern detected). The statistic P, used in this “runs” test for detecting non-randomness, the threshold of value ‘1’ to decide randomness or not, and the application of this technique as applied to continuous data is distinguishable from the prior art Bradley, 1968.

Thus, returning to the example scenario ofFIG. 9demonstrating computing the example residuals95,96,97, there will be identified household97whose usage results in computed residuals exhibiting a pattern. The last household (H3) is then flagged at98as anomalous because the pattern of its residuals97fail a randomness test indicating that someone is trying to ‘game’ their usage to make it look ‘reasonable’ but yet lower than it actually is.

FIG. 11Adepicts example usage plots of residuals (y-axis) over time (x-axis) where a first plot400depicts usages401exhibiting a pattern where a calculation for P yields 7.5>>1 thereby indicating the residual computed for a most anomalous building; and the second plot410inFIG. 11Bdepicts usages411that do not exhibit a pattern where a calculation for P yields 0.03<<1 thereby indicating the residual computed for a normal building.

A fourth algorithmic kernel, in one example embodiment, utilizes clustering techniques to improve Predictive Models of Energy Use. This fourth analytic track uses the standard techniques (K-means clustering or two-step) to cluster buildings by characteristics (size, age, etc.) for each shift, and then, exploring shifting household cluster membership by building linear (e.g., it can be non-linear but it may be limited to linear) models of energy usage vs. temperature. The method includes determining, based on the goodness of fit of shift-level models, whether a household is better suited in one cluster vs. another. Thus, this technique builds the “best” (e.g., according to a computed r2measure of how good a statistical model fits the actual data) predictive model of energy use for houses within a cluster.

FIG. 12Ashows a general method500of anomaly usage detection driven by rules and the usage versus temperature variable data. As daily energy usage can be driven by many features or factors (e.g., temperature, seasonal holidays, building size), then for a household, n, energy usage, Un, is modeled to be a function of various features or factors X, according to:
Un=f(X)+Rn,
where X is a vector of variables, R is the computed residual of household n as defined above. As shown in the plot550ofFIG. 13A, for a given shift, daily usage plotted on y-axis shows dependence on temperature plotted on x-axis. Particularly, as shown inFIG. 13A, the plot550of usage vs. temperature is depicted as a fitted curve551, e.g., a “bathtub” shaped curve (as it goes from high to low and then back again or vice-versa). The method invokes a piecewise robust linear regression technique to model the usage pattern of each household. The piecewise robust linear regression removes the usage pattern due to factors, such as temperature, building size. The residuals should be random.

The resulting residuals form a random probability field: {Rn,t}, where t denotes the t-th day. Theoretically, the residual field Rn, t should be independent and identically distributed. In one embodiment, it is assumed they follow a normal distribution N(0, sigma). The random probability field {Rn,t} is used when the theft likelihood of a household or a day is calculated wherein, in one embodiment, the method fixes n and multiplies the probability over all t; or alternatively, the method fixes t and multiplies the probability over all households (n). That is, as shown inFIG. 13B, for a given shift, the residuals from all the households and all of the days are fit to a normal distribution Φ(0, σ)560, i.e., an estimate a. Thus, given a residual value b, the shaded area563is the theft probability {Ln,t} of household n on day t.

Thus, after obtaining “clean” usage data (“clean” data being data presented for analysis after all of the various errors have been corrected) at502, methods are invoked at504to select a feature variable of X, e.g., temperature, for regression. Then, at505, the temperature impact on the usage data per shift is removed considering the curve551ofFIG. 13Aas effected by constructing a piecewise linear robust regression. It should be understood that temperature is used as an example, and that other “features” that prove influential to energy consumption (e.g., hours of direct sunlight) can be used as well. Then at510, methods are invoked to estimate the distribution of the residuals, e.g., a normal distribution N(0, sigma) as shown resulting in a distribution curve560shown inFIG. 13B. In one embodiment, the residual distribution is estimated by fitting the residual to the normal distribution and using a statistical method such as a maximum likelihood computation to estimate the parameters of the normal distribution. Then, as shown inFIG. 12A, the solution outputs the parameters565of the piecewise linear robust regression and outputs the parameters566of the residual distribution after training. These parameters can be used for predicting the electrical theft in future applications.

Thus, given the cleansed sample data, there is estimated the sigma and calculated theft likelihood field of each household and each day, {Ln,t} at520,FIG. 12A. This process is repeated to obtain the likelihood field for all the three shifts. Then, at525, processes are performed to identify the suspected households and times based on rules (e.g., thresholds α_1, α_2) in terms of the theft likelihood field. In this manner, the solution will output suspected dates554and suspected households555.

For example, if the total theft likelihood, i.e., the product of the likelihood from all the shifts, e.g., 3 shifts, per a household per day is greater or equal than α_1, it is identified as a suspected household; if the total theft likelihood of a day is greater or equal than α_2, the day is deemed as a suspected time; for the suspected household and day, if for example, the theft probability of shift 3 is higher than that of the others, the day is not deemed as a holiday or vacation time. Note: α_1 and α_2 are calculated across all the households and all the days, respectively. The rules are learned from both date and domain knowledge, and can be many.

An example application of a rule is shown with respect toFIG. 12B which shows a 3-Dimensional plot575of households, vs. days and shift, depicted for use in determining a suspected household and time. In the 3D graph plot example575, if the theft likelihood of a shift is significantly inconsistent to that of the other shifts in a day, and that of the other households, and its historical behavior, then this household and the corresponding day is labeled as “suspicious”, e.g., as shown as suspicious point580representing a suspicious day and household with a computed large probability of theft based on the comparison of the residual usage to a given threshold. Such rules not only can identify suspicious household and times but also reduce false alarms, e.g., due to low usage during vacation days.

In one embodiment, this analytic can autonomously identify vacation and other key calendar events (e.g., school breaks when families tend to go on vacation) that suppress electricity usage and factor this in at step530before making the assertion that a low usage in a time period is suspicious. That is, at530, methods are invoked to remove special days by peer hood (fractions of outlier households, α_3) where α_3 is a threshold given by experiences and domain knowledge, or learned from usage and theft history. In one embodiment, for households, for any day or all the days, if the determined usage is over threshold α_3, then that fraction of household are outliers on a particular day, and this day is identified as holiday or vacation period. Then, at535, methods are invoked to remove vacation days based on usage consistency across shifts. An example of inconsistent shift usage is when, for a given household on a given day, the usage of one shift is identified as outlier and the usages in other shifts are not. For example, given a day, the method calculates the fraction of households with theft probability larger than α_2; if the fraction is larger than α_3 threshold, that means the usage of most households are consistently low and deemed as a “holiday”.

Then, as shown inFIG. 12B, a suspected point580is determined for a given shift: the theft probability form a probability field: day by household. The process steps ofFIG. 12Aare repeated to obtain the likelihood field for all the three shifts. Then there is automatically detected suspected household581and time (e.g., day)582based on rules in terms of theft likelihood field. For example, if the theft likelihood of a shift is significantly inconsistent to that of the other shifts in a day, that of the other households, and its historical behavior, the household and the corresponding day is labeled as “suspicious”.

Thus, a random probability field and usage consistency based theft detection is devised. The systems and methods described herein enable an electric utility to: automate the task of identifying households suspected of theft via meter tampering; identify during which times of day a particular household typically engages in meter tampering; prioritize costly theft investigative resources according the a rank-ordered list of likely fraudulent households; and reduce non-technical losses due to electricity theft.

In one embodiment, each of the four kernel algorithms described produces the same output—a list of household identifiers ordered (except for the third analytic track) by the degree to which their usage deviates from expected. For the first analytic track, the rank ordering is based on the number of shift migrations observed. For the second analytic track, it's based on the number of times that energy usage falls below predicted (based on the best fitting model) levels. For the third analytic track, there is no explicit sorting since a household is placed in a set of suspicious ones if at any time non-randomness is detected in the residual patterns. For the fourth analytic track, it is the theft likelihood (based on probability of having residual energy use be a certain distance from an expected residual mean) of each household on each day.

FIG. 14illustrates an exemplary hardware configuration of a computing system700running and/or implementing the methods described herein. The hardware configuration preferably has at least one processor or central processing unit (CPU)711. The CPUs711are interconnected via a system bus712to a random access memory (RAM)714, read-only memory (ROM)716, input/output (I/O) adapter718(for connecting peripheral devices such as disk units721and tape drives740to the bus712), user interface adapter722(for connecting a keyboard724, mouse726, speaker728, microphone732, and/or other user interface device to the bus712), a communication adapter734for connecting the system700to a data processing network, the Internet, an Intranet, a local area network (LAN), etc., and a display adapter736for connecting the bus712to a display device738and/or printer739(e.g., a digital printer of the like).