# An Anomaly Detection Ensemble for Protection Systems in Distribution Networks
###### Abstract
Reference [26] relies on the random truncation characteristics of defect data, adopts the maximum likelihood estimation method, and implements parameter estimation based on the Weibull distribution model. A joint distribution model of the overall defect distribution of the device is then established to achieve parameter estimation for a probability distribution model of the defects of each module and the whole system. The authors of [27] applied a wide-area information method and conducted a global real-time state assessment of a single relay protection action behavior through information sources such as the power grid scheduling system. References [28; 29; 30; 31; 32] also introduce various new methods to participate in the operation of relay protection equipment. Those methods have achieved good anomaly detection results, but there is still the potential for further improvement in method performance in a multi-type, high-dimensional data environment. With these motivations, this paper develops a unique combination of two advanced machine learning models--kernel principal components investigation (KPCI) and the isolation forest (IF) anomaly detection model. The objective is to construct a data-driven ensemble model that can effectively detect abnormal operation states for power distribution network protection. KPCI comes into play during the pre-processing stage. This model is essentially a non-linear extension of traditional principal component analysis (PCA), rendering it capable of efficiently managing non-linear and non-Gaussian distributed data. Harnessing the Sigmoid kernel function, KPCI maps the original input data into a high-dimensional space. The superior linear separability of the data points in this transformed space allows for effective dimensional reduction through projection, thereby enhancing the ensemble model's capability when processing high-dimensional data environments. The subsequent stage in our detection strategy involves the deployment of the isolation forest model. IF is especially adept at distinguishing outlier sample points that are grounded on the values associated with diverse features under typical operating conditions. The process entails the construction of multiple binary decision trees, each of which is randomly divided. The depth of leaf nodes within each tree is established through iterative training, and the average path length of each data point is computed to pinpoint outliers. The tree-structured architecture of IF grants the model a remarkable level of robustness when coping with high-dimensional or biased data environments, which results in maintained high detection performance and computational advantage. Validation of the ensemble's effectiveness is attained through a case study that is grounded on actual operation data from a specific region's distribution network protection system. The results demonstrate that this innovative ensemble model exhibits excellent anomaly detection performance. Unlike other existing models, this novel approach can perform parallel anomaly identification across diverse parameters within the protection systems. This capability significantly enhances the ensemble's comprehensiveness and applicability in practical scenarios, further cementing its superior feasibility in terms of actual implementation. This article proposes a data-driven real-time model for detecting potential abnormal operating conditions in the distribution network protection system. The overall flow chart is shown in Figure 1 below.