SCADA plays a key role in the wind energy generation industry by enabling real-time monitoring and recording of the operating status of wind turbines through sensors in the turbines. The main responsibility of the system is to monitor and control the operation of the wind turbine and to assess the operational status of the WTGs by analyzing the collected data. Early identification of potential anomalies and timely alerts enable personnel to deal with them quickly and reduce the number of unplanned downtimes at wind farms [12] .

The SCADA system records a large amount of WTG operation data, which is categorized into discrete and continuous data. Discrete data, such as equipment switching status, brake status, etc., are only represented by the numbers 0 or 1, which cannot well characterize the continuous changes of the unit, while continuous data information, such as temperature, wind speed, barometric pressure, rotational speed, etc., can well reveal the continuous changes of the WTGs.

The continuous signals in SCADA data are roughly divided into three categories: environmental parameters that reflect the environmental conditions around the WTGs, unit parameters that describe the state of the WTGs themselves, and state parameters that characterize the interaction with the grid. This is shown in Figure 1 . These parameters cover wind speed, wind direction, ambient temperature, blade angle, current, etc. With the support of these data, the operating characteristics of the WTGs can be better analyzed for anomaly detection. Although the SCADA system could monitor anomalies and provide timely warnings based on established thresholds, it is often activated when the performance of the equipment is already impaired, which means that there is still room for further improvement in anomaly detection and early diagnosis.

SCADA data, which is essentially complex and multivariate time-series data closely related to the entity’s physical objects [13] , has key attributes that include, but are not limited to, the following:

Firstly, SCADA systems are massively informative and complex, with the ability to monitor and collect over a hundred variables in real time through many sensors. However, this massive amount of information also creates a notable challenge: important information in the data is often made less visible due to excessive redundancy, which directly affects the accuracy of the modelling and the ability to generalize the model. Therefore, it is particularly critical to select the most appropriate parameters for modelling. The second is the complex spatial coupling. The composition of WTGs is complex, and there is a close interdependence between many subsystems. The failure of one subsystem can often trigger the abnormal state of multiple related subsystems, and this phenomenon reveals the complex relationship between the parameters monitored by the sensors. Then there is the obvious time series correlation. the data collected by the SCADA system is arranged in chronological order, and the data recorded by each sensor forms a time series. When an abnormality occurs, the data before and after the occurrence of the abnormality may show changes, showing the correlation of the data in the time dimension, i.e., trend characteristics. The abnormal state of WTGs will not only cause abnormal changes among multiple monitoring variables, but these changes will also occur at different points in time. Finally, there is the imbalance of the data. In the actual operation of WTGs, the time of normal operation is much more than the time of failure. Therefore, the number of normal samples collected by the SCADA system is far more than the abnormal samples, forming the unbalanced character of the data.

In summary, the characteristics of SCADA data include large and complex data volume, obvious time-series correlation, and data imbalance, which pose challenges for data processing and modelling.

Convolutional Neural Network (CNN) is a hierarchical neural network structure which consists of a filtering phase and a classification phase. The filtering stage is responsible for extracting features from the input signal, while the classification stage is responsible for classifying these extracted features. The network parameters of these two stages are obtained by joint training. Specifically, the filtering phase consists of convolutional, pooling and activation layers, etc., while the classification phase consists of fully connected layers.

The convolutional layer, as a core component of convolutional neural networks (CNNs), extracts feature by performing convolution operations on local regions of the input signal using convolutional kernels. One of its key characteristics is weight sharing, wherein the same convolutional kernel processes all local regions of the input signal as it moves across the input. This approach reduces the number of network parameters, lowers model complexity, prevents overfitting, and decreases the model’s memory requirements.

(2-1)

where, , .

2D convolution extracts features to generate an output feature map by sliding a convolution kernel over the input matrix and performing an element-by-element multiply-and-sum operation. This process continues until the convolution kernel traverses all positions of the input matrix:

(2-2)

where denotes the element in the weight vector w, p is the number of input matrix rows, q is the number of input matrix columns, and is the output feature map, whose dimensionality is related to the number of convolutional kernels, each of which is equipped with a unique set of initial weight matrices. For a single convolutional kernel, the dimension c of the resulting output feature map can be computed using the following equation:

(2-3)

Where w is the size of the input vector of the convolutional layer, filter is the size of the convolutional kernel, padding is the size of the padding, and stride is the sliding step of the convolutional kernel. One of the features of the convolution operation is weight sharing, which means that the weight matrix of each convolution kernel remains unchanged while performing the sliding convolution operation on the input signal. This weight sharing mechanism greatly reduces the number of parameters in the model, allowing the CNN to efficiently capture the local features of the input data, which in turn enhances the robustness of the model to the transformation of the input data. In addition, the weight sharing mechanism also significantly improves the generalization ability of the model when dealing with various complex tasks.

The pooling layer performs dimensionality reduction of the feature map that has passed through the convolutional layer by pooling computation. This reduces the number of parameters and computational complexity of the subsequent layers while retaining important feature information. Pooling methods can be divided into different types, the most common of which include maximum pooling and average pooling. Maximum pooling extracts features by selecting the maximum value in the region, while average pooling calculates the average of all values in the region.

The activation layer plays a crucial role in neural networks and is responsible for introducing nonlinear properties that enable the network to learn complex functional relationships. By employing different activation functions, the activation layer enhances the network’s ability to deal with nonlinear problems, improves the robustness of the model, and optimizes the training efficiency. Common activation functions include Sigmoid, ReLU, Leaky ReLU, and Tanh, etc., and the formula expressions of the four functions are shown in 2-4, 2-5, 2-6, and 2-7, respectively.

(2-4)

(2-5)

(2-6)

(2-7)

The fully connected layer, also known as the dense layer, is usually at the end of the neural network and is primarily responsible for summarizing the features extracted by the previous neural network and performing tasks such as classification or regression. This layer processes the one-dimensional input vectors through a series of linear transformations (using weight matrices and biases) to produce new one-dimensional output vectors, thus completing the final output of the model.

The Long Short-Term Memory (LSTM) network is a special type of recurrent neural network which is more advantageous in dealing with sequential problems. Figure 3 shows a typical LSTM neural unit. A typical LSTM neural unit consists of a master unit and three gates: an input gate, a forgetting gate, and an output gate. By controlling these three gates and thereby controlling the updating and forgetting of memories, it ensures that important information is remembered while less important information is lost. This mechanism enables the storage of state and the flow of information in the implicit layer.

In Figure 3 , C_t represents the cellular unit state at the current time, C_t-1 and C_t+1 are the cellular unit states at the previous and the next time step, respectively, h_t denotes the current hidden unit state, h_t-1 and h_t+1 denote the hidden unit states at the previous and the next time step, respectively, f_t, i_t, and o_t are the oblivious gate cell, the input gate cell, and the output gate activation values, respectively, x_t is the current input of the time step, x_t-1 and x_t+1 are the inputs of the previous and the next time step, respectively, and σ is the sigmoid activation function. A complete LSTM cell update process is described below. Firstly the LSTM cell decides which information needs to be discarded from the cell state by means of a forgetting gate, and this process is formulated as follows：

(2-8)

where f_t is the output of the forgetting gate, w_f is the weight of the forgetting gate, b_f is the bias term of the forgetting gate, and [h_t-1, x_t] is the result of splicing together the hidden state of the previous time step and the input of the current time step.

Then the input gate decides which new information will be stored in the cell state, which includes two steps, one is the sigmoid layer decides which values will be updated, and the second is the tanh layer of the input gate generates a new vector of candidate values representing the information that is about to be updated into the cell state, which is computed as shown in Equation 2-9 and Equation 2-10.

(2-9)

where i_t is the sigmoid layer output of the input gate, and w_i, b_i are the weights and bias terms of the input gate, respectively.

(2-10)

where is the new candidate cell state, w_c and b_c are the weights and bias terms of the input gate, respectively.

The cell state is then updated by combining the result of the forgetting gate and the new information of the input gate as follows:

(2-11)

where C_t is the cell state of the current time step, the cell state of the previous time step C_t-1, denotes the dot product.

Subsequently the output gate determines the content of the hidden state, i.e., what info rations will be passed to the next time step, and is calculated as follows:

(2-12)

where o_t is the output of the output gate, and w_o, b_o are the weights and bias terms of the output gate, respectively.

Finally, the hidden state of the current time step is calculated by Equation 2-13, which is the result of the cell state filtered by the output gate.

(2-13)

where h_t is the hidden state of the current time step, which will be passed to the next time step as input. With the above steps, the LSTM unit can update its state efficiently throughout the sequence and capture long-term dependencies. The update of each time step depends on the state of the previous time step and the input of the current time step, and such a cyclic process continues throughout the processing of the entire sequence.

The structure of LSTM-ACGAN is shown in Figure 4 , where generator G is based on the CNN framework and incorporates category labels as auxiliary information to enhance the ability of generating new samples with high quality and specific labels. This strategy not only expands the number of fault samples in the training set, but also effectively prevents the pattern collapse problem and accelerates the model convergence by generating a more balanced dataset. Meanwhile, the discriminator D employs an LSTM network, which gives the model powerful time-series data processing capabilities to accurately determine the authenticity of the samples and classify them, and the introduction of LSTM has a significant advantage in dealing with long-term dependencies in time-series data, which further enhances the model’s performance in the fault detection task.

In the LSTM-ACGAN network design, the discriminator plays a crucial role by labelling and classifying the generated samples and the real samples, which in turn is responsible for determining the authenticity of the samples and their fault types. Specifically, generated samples are labelled as 0, indicating that they are generated by the generator, while real samples are labelled as 1, representing that they come from a real dataset. This process involves not only a simple true/false judgement, but also the identification of the sample category, and to achieve this, the LSTM-ACGAN network introduces two key labelled classifiers in its top layer. The first classifier uses a Sigmoid function to predict whether a sample is true or false, i.e., to determine whether a sample is generated by a generator or comes from a real dataset; the second classifier uses a SoftMax function to predict the fault category to which the sample belongs, and this design allows the network to not only differentiate between real and generated data, but also to effectively identify different types of faults.

To train the discriminator, the LSTM-ACGAN network employs a cross-entropy loss function to measure the errors of the authenticity labels and fault category labels. By minimizing the errors of these two labels, the discriminator can gradually improve its accuracy in determining authenticity and fault type. The application of this loss function not only optimizes the performance of the discriminator, but also enhances the network’s ability to learn from complex data distributions, thus improving the accuracy of anomaly detection while ensuring the model’s ability to generalize to new samples. The specific formula is as follows:

(2-14)

(2-15)

(2-16)

where L_c denotes the cross-entropy loss for classification, L_d denotes the cross-entropy loss value error for true and false labels, L_D is the loss function of the discriminator, and represents the parameters of the discriminator. R and F are the number of true and false samples, respectively. y_r denotes the labels of the true samples, y_f denotes the labels of the generated samples, a_r and a_f denote the labels of samples predicted by the sigmoid function, b_r and b_f are the SoftMax function predicted sample categories.

The structure of the generator is a DCGAN structure, which mainly consists of an inverse convolutional layer, an activation function, and a batch normalization layer, and the inputs it accepts are noise as well as category labels. The aim is to generate samples that are like the category and difficult for the discriminator to distinguish. The parameters are mainly updated by the error and loss function of the discriminator, which is formulated as follows:

(2-17)

(2-18)

where L_g is the cross-entropy loss error of the authenticity label, L_G and are the generator loss function and parameters.

The specific anomaly detection process of LSTM-ACGAN is described below, as shown in Figure 5 , where the data is first cleaned and normalized to allow subsequent model training to speed up convergence. Once the data set has been appropriately partitioned to form the training and test sets, two key components of the neural network are built: the generator and the discriminator. During generator training, random noise is introduced into the latent space to generate pseudo-samples with specified labels. The discriminator, on the other hand, discriminates between mixed pseudo and real samples and aims to improve its ability to distinguish between real and pseudo samples by continuously iterating and optimizing the parameters of the discriminator. Once the discriminator has reached a certain level of performance, the training focus shifts to the generator. At this stage, the parameters of the discriminator are fixed and no further updates are made. The goal of the generator is to produce false samples that are as close as possible to the true samples to fool the discriminator. To do this, the generator adjusts its own parameters according to the accuracy with which the samples it generates are recognized by the discriminator, thus improving the quality and fidelity of the generated samples.

By iteratively adjusting the parameters of the two networks, the model can gradually enhance its performance in adversarial training. During the training process, it is necessary to continuously monitor whether the generator and the discriminator reach Nash equilibrium, i.e., the two sides reach dynamic equilibrium during the confrontation process, and ensure that the generator parameters converge stably to the optimal state. After training, the model parameters are stored, and the test set is fed into the trained LSTM-ACGAN model after the same data preprocessing, directly outputting the results of the WTGs’ operating conditions and achieving end-to-end anomaly detection.

The dataset used for data validation is the wind turbine icing data from the industrial big data competition [14] . The data provided in the competition was collected by the SCADA system of a wind farm in North China, containing hundreds of sensor signals and variables, with the sensors recording data at an average interval of seven seconds. It contains 26 features related to the icing state of wind turbines, and the information of the 26 features is shown in Table 1 .

Table 1. Description of SCADA data information for wind turbines.

Figure 6 illustrates a scatter plot of key operational parameters of the wind turbine (including wind speed, generator speed, power, x-direction acceleration, and Ng5-1 charger DC current) over time. The blue area reflects the data distribution of the unit under normal operating conditions, while the red area identifies the data characteristics during the occurrence of blade icing anomalies. By analyzing the scatter plots, it can be observed that each parameter shows a clear trend of change over time. When the operating status of the unit changes, the corresponding recorded data also show corresponding fluctuations. When an abnormality occurs in the unit, the data change trend is more significant, or manifested in an obscure way, which provides important clues for anomaly detection and diagnosis. Therefore, analyzing the SCADA data of wind turbines from the time dimension, it can be found that the change trend of individual parameters can reflect the occurrence of icing anomalies.

However, a single parameter is often insufficient to fully reflect the complexity of anomalies, and thus joint analyses of multiple parameters need to be considered to improve the accuracy of identifying anomalous states. Therefore, further bivariate relationship analyses of several groups of commonly used WTG SCADA data parameters were conducted with the aim of exploring the interactions between the parameters and their sensitivity to the anomalous state. The bivariate relationships of several groups of commonly used WTG SCADA data variables are analyzed below. Specifically, as shown in Figure 7 , the combined analysis using two variables can more accurately reveal the abnormal state in WTG operation compared to the analysis of a single variable. As shown in Figure 7(a) the relationship curve between wind speed and power, the generation power shows a decreasing trend when blade icing abnormality occurs in the unit. The results shown in Figure 7 indicate that the abnormal operation of the unit will lead to changes in the data of multiple sensors, and the correlation changes between these sensors present a complex coupling relationship. Therefore, the complex coupling relationship between the SCADA data variables of WTGs provides important information for the identification and analysis of abnormal states. Comprehensive consideration of the interactions between multiple variables helps to improve the accuracy of the detection of abnormal states in WTG operation, and provides a solid data foundation for subsequent anomaly detection and condition monitoring.

In summary, the time series analysis of SCADA data of wind turbine is of great significance for the condition monitoring and fault diagnosis of the turbine, and by comprehensively analyzing the change trends and interrelationships of multiple parameters, the accuracy of the turbine’s anomaly detection can be effectively improved.

Data preprocessing phase: the quality of the dataset has a decisive impact on the model performance, and converting the data into a uniform format can simplify the subsequent model training. Pre-processing includes the following key steps: data cleaning, extracting key features, splitting the training and test sets, performing data normalization and employing sliding window techniques.

There are three time periods labelled in the WTG dataset, which are the time periods in normal, icing and invalid states, and the data is labelled according to the time periods. Since the data in invalid state will have an impact on the training, this part of the data is discarded and not considered. At the same time, the relationship between the data variables is analyzed and it is found that the power value of the data in icing samples is generally smaller than 2, so the data with power greater than 2 are excluded, and since all the data are processed by the competition, the size of their values cannot represent the physical significance of the actual working conditions. Since the features of this competition are selected based on the expert’s empirical knowledge, all of them are retained.

The normalization process becomes a necessary pre-processing step to ensure that the training and test data are analyzed and compared on the same scale. The normalization process can be achieved by the following formula: for each feature value, subtract the mean value of that feature on the training set and divide by the standard deviation of that feature on the training set.

The mean and standard deviation of the training dataset are first calculated during the training phase. These statistics are then used to normalize the data for each feature in the training set to ensure that model training is carried out on a uniform scale, using the following formula:

(2-19)

where x is the value of the original sensor variable and x_scale is the value after normalization. μ and S are the mean and standard deviation of the original data samples, respectively. When processing the test set, the normalization is performed by applying the μ and S computed in the training set, instead of using the statistical data from the test set itself. The purpose of this step is to avoid statistical bias due to the potentially small amount of test data and to ensure the accuracy of model evaluation and prediction. With this approach, the data processing remains consistent, both for training and testing, which helps the model to learn and generalize better, especially when the difference in the amount of processed data is significant, and the statistical properties of the training set can be effectively exploited to ensure the accuracy and robustness of the model evaluation.

In the SCADA system, sensor data is recorded every 7 seconds. In this chapter, sensor data every 224 seconds is selected as a sample, i.e., the dimensionality of the sample is 32 26 In the training phase, after preprocessing, the generator generates false samples, and the discriminator distinguishes between mixed false and true samples, and continuously updates the parameters by minimizing the loss function to improve the discriminative ability. After the optimization of the discriminator parameters, the GAN enters an important training phase, when the discriminator is frozen and the training focus is shifted to the generator. In this phase, the generator’s loss function is calculated based on whether the fake samples it generates can deceive the discriminator. By minimizing the generator’s loss function, its parameters can be optimized to improve the quality of the fake samples, and the two continue to learn against each other until convergence. And use Adam method gradient descent to adjust the optimal parameters. Its momentum parameters are set as β₁ = 0.5, β₂ = 0.999. The initial learning rate is 0.0002, the training batch size is 16, and the number of rounds is 100. in the testing phase, the test set is loaded to the trained model and the classification results are output.

In the evaluation of binary classification problems, True Positive (TP) refers to the number of positive samples correctly identified by the model, False Negative (FN) refers to the number of positive samples incorrectly identified as negative by the model, False Positive (FP) refers to the number of negative samples incorrectly identified as positive by the model, and True Negative (TN) refers to the number of negative samples correctly identified by the model [15] . The above four numbers also form the confusion matrix as in Figure 8 . To validate the effectiveness of the proposed method, this chapter uses the Area Under the Curve (AUC) of Receiver Operating Characteristic (ROC) for effect comparison. The larger the value of AUC, the higher the accuracy of anomaly detection and the more effective the method is. The ROC takes the False Positive Rate (FPR) as the horizontal coordinate, the True Positive Rate (False Positive Rate (FPR) as the horizontal coordinate and True Positive Rate (TPR) as the vertical coordinate. Other common evaluation indexes include Missed Alarm Rate (MAR), False Alarm Rate (FAR), Accuracy Rate (AR), etc. The specific formulas are as follows:

(2-20)

To accurately assess the performance of the algorithms, this section introduces several key performance metrics to compare the efficacy of the models, which include the judging scores commonly used in competition scenarios S. Each of these metrics comprehensively evaluates the performance of the models from different

perspectives. In the scenario dealing with the icing operational state of WTGs, engineers and maintenance personnel pay more attention to the identification of icing fault samples in practice, i.e., more attention is paid to the leakage alarm rate than to the false alarm rate. Therefore, the judging score S introduced in the competition was chosen as the main evaluation criterion, and its detailed calculation method is described below:

(2-21)

where represents the ratio of the number of positive and negative samples, S ranges from [0,1], and the better the model works, the closer the value of S is to 1.

In terms of evaluation metrics, the false alarm rate and the missed alarm rate are the key metrics for judging the strengths and weaknesses of the model. The false alarm rate reflects the proportion of faultless samples that are incorrectly determined as faulty, while the missed alarm rate refers to the proportion of faulty samples that are incorrectly determined as faultless. Ideally, the lower the values of these two metrics, the higher the performance of anomaly detection. However, false alarm rate and missed alarm rate are often constrained by each other in practical applications, and improving the performance of one tends to sacrifice the results of the other. Therefore, in practical anomaly detection applications, it is crucial to balance these two according to the specific situation. Both a high false alarm rate and a high leakage rate will have a negative impact on the practical application of anomaly detection: a high leakage rate will directly affect the diagnostic results, while a high false alarm rate will increase the workload of validation and verification.

To demonstrate the effectiveness of the proposed anomaly detection model for LSTM-ACGAN networks in this paper, several classical machine learning methods as well as deep learning methods are selected for comparison. The anomaly detection method proposed in this paper is compared with classical methods such as Logistic Regression (LR) [16] , K-Nearest Neighbors (KNN) [17] , Support Vector Classifier (SVC) [18] and Extreme Gradient Boosting (XGBoost) [19] , Random Forest (RF) [20] , LSTM [21] , CNN [22] . The above methods achieve a balance of positive and negative categories by sliding windows on the training set, increasing the number of positive samples (representing icing samples) by generating overlapping positive segments and negative slices without overlapping regions. In this way a balanced dataset is constructed for model training and validation. The method in this paper, on the other hand, increases the number of samples by generating faulty samples through a generator to achieve a balanced dataset.

The classification of anomalies is achieved based on the comparison of the final probability values and thresholds, and from the overall analysis of Figure 9 , the machine learning algorithms are shown in Figure a, Figure b, and Figure c as LR, RF, and SVC, respectively. it can be clearly seen that the probability distributions of their learning are relatively scattered, and the probability values in the entire range of 0-1 are widely distributed, and most of the probabilities are bifurcated for deep learning and are concentrated near 0 and 1, and there is only some scattering of the probabilities in the only part of the scatter distribution between 0-1. Where the LSTM and CNN methods identify many of the positive class samples as negative, the algorithms in this chapter predict a much smaller number of positive class samples as negative class samples. Based on the output probability of each sample, a threshold value of 0.5 is set, and for probabilities greater than the threshold, the final output of the positive class samples is predicted to be 1. For probabilities less than the threshold, the output of the positive class samples is predicted to be 0, i.e., they are predicted to be negative class samples. Finally, the results were counted to obtain the parameters TP, FP, FN, TN in the model evaluation metrics, based on which the four parameters formed a confusion matrix as shown in Figure 10 .

The confusion matrices of the detection results of the different models are shown in Figure 10 . The KNN model has the highest error rate for classification and performs poorly when dealing with high dimensional data. Both RF and CNN have 20 faults recognized as normal but CNN has more normal identifications than RF and extracts the features more efficiently. The results of the confusion matrices of SVC and LR are more similar. The number of identifications is around 1700 for both methods, and the classification results for normal abnormal samples are not much different. XGBoost has only 269 normal samples misclassified in this dataset, which is a big improvement over the other methods, while the algorithm in this chapter has only 106 normal samples misclassified, and the faulty samples are predicted to be normal with only 11, which is a big improvement compared to the better performing XGBoost algorithm, where the number of abnormal samples being misclassified by half. For the unbalanced data classification problem to further assess the performance of the comparison model from the overall evaluation indexes, the four evaluation indexes of AUC, FAR, MAR and S are calculated to make a comprehensive judgement, and the results of the calculations are shown in Table 2 and Figure 11 .

As can be seen in Table 2 and Figure 11 , the AUC and S scores of the KNN algorithm are at the lowest and MAR is at the highest because KNN suffers from dimensional catastrophe when dealing with high-dimensional data, whereas the algorithms proposed in this chapter have an AUC and S value of 0.9104 and 0.9287, which are much larger than the KNN method. The errors of both FAR and MAR are reduced by more than 50% compared to the machine learning XGBoost method with better results. The evaluation metrics S and AUC are also improved by 5.278% and 4.55%, respectively. Meanwhile, compared with other comparative methods, the evaluation metrics of S and AUC of the algorithm in this chapter are

higher than those of the comparative methods, while the values of the false alarm rate FAR and the missed alarm rate MAR are 0.0738 and 0.0509, respectively, which are lower than those of the other methods, which further illustrates the effectiveness and superiority of the model.