To solve the problem of low efficiency and accuracy in existing power anomaly detection, a two-stage power data anomaly recognition model is proposed. The model consists of a one-step ahead load predictor (OSALP) and a rule-engine-based load anomaly detector. The one-step ahead load predictor combines the advantages of autoregressive moving average (ARMA) and artificial neural networks (ANN), effectively improving the accuracy of load prediction. The rule-engine-based load anomaly detector integrates the strengths of models such as support vector machines (SVM), k-nearest neighbor (kNN), and the cross-entropy loss function, enabling power anomaly detection independent of prediction results. Real-time detection results show that the model achieves R2, RMSE, and F1 score metrics of 69.67%, 5.03%, and 99.53%, respectively, significantly outperforming models such as random forest (RF), SVM, ANN, and long short term memory (LSTM).