# An Anomaly Detection Ensemble for Protection Systems in Distribution Networks
###### Abstract  
Due to the complex topology, multi-line branches, and dense spatial distribution characteristics of a distribution network, potential disturbances and failures cannot be eliminated in real scenes, which means that higher levels of both reliability and stability are required in its corresponding protection system. For this reason, the timely monitoring and pinpoint identification of an underlying abnormal operation status in those protection systems must be ensured. To this end, a data-driven-based real-time anomaly detection ensemble is proposed in this paper. First, the kernel principal components investigation (KPCI) process is deployed to compress the dimensionality of input data, which can reduce the computational complexity within such high-dimensional data environments. Next, the isolated forest (IF) model is applied to excavate potential outliers according to the numeric range of the normal operating states of different features. Thus, a better detection performance in biased or sparse distributions can be achieved by reacting swiftly to those outliers. Finally, the operation data of the power distribution network protection system in a certain area is used as a simulation case. It is evident that compared with the single model IF detection method, combining the IF with the data dimension reduction model can effectively reduce data complexity. Due to the addition of kernel functions, KPCI can adapt to high-dimensional data environments better than standard PCI, and it also has certain advantages in calculation efficiency. This validates the theory that the proposed model has a high level of anomaly detection in practical applications, can assist in the automatic identification of and response to power distribution network security risks, effectively dig out potential system operational disturbances and state abnormalities, and achieve real-time anomaly monitoring and early warning. distribution network; protection system; anomaly detection; data mining; KPCI-IF ensemble 4.0.0.0000-0000-0000-0000-0000-00000-0000-00000-00000-00000-00000-00000-00000-00000-00000-00000-00000-00000-000000-00000-000000-000000-000000-000000-000000-000000-0000000-0  
devices. For example, references [6; 7; 8; 9; 10; 11] use infrared temperature measurement technology during the operation and maintenance of transmission line equipment for the abnormal monitoring of protective equipment. The authors of [12] detected SF6 protective equipment faults through a gas monitor, and those of [13; 14; 15; 16; 17; 18] conducted abnormal monitoring of the relay protection system through inspection robots. The authors of [19; 20; 21; 22; 23] used artificial intelligence for the data detection of protective equipment. These methods can achieve timely detection and rapid processing, but they usually require additional specific facilities to implement monitoring, increasing the cost and making it difficult to realize comprehensive coverage of the distribution network under the prerequisite conditions. Generally, anomalies in the operation of the relay protection system often originate from changes in state parameters. Therefore, accurate identification of abnormal operating state quantities can effectively identify existing or potential deterioration phenomena in the protection system. Hence, data-driven operation anomaly detection has become another feasible direction of research. For example, reference [24] introduces the affinity propagation (AP) clustering method and combines the local outlier factor (LOF) algorithm to detect outliers in the cluster center, thereby accurately identifying abnormalities. The authors of [25] fitted the failure rate model of the protection system based on historical data and corrected the actual failure rate model, based on medium, long-term, and short-term factors, to set a cumulative failure rate threshold.