Supply chain sales anomaly detection and root cause analysis system and method fused with knowledge graph

Abstract

The invention provides a supply chain sales anomaly detection and root cause analysis system and method fused with a knowledge graph, and the system comprises a demand collection and preprocessing module which is used for connecting an order system, a supply chain system, a customer relationship management system and an external data source, and completing the data cleaning, entity analysis and feature extraction; the supply chain knowledge graph construction module is used for defining an entity type and a relationship type; the real-time anomaly detection module is used for accessing a sales index data stream, performing anomaly detection in combination with lightweight filtering and a graph neural network model, and calculating node and global anomaly scores; and the visual report generation module is used for automatically generating a visual report. According to the method, the dynamic supply chain knowledge graph is constructed, the graph neural network is applied, multi-source heterogeneous data is deeply fused, the complex dependency relationship between entities is effectively captured, the accuracy and timeliness of sales anomaly detection are remarkably improved, automatic positioning of abnormal root causes and evidence chain tracing are achieved, and the analysis efficiency is greatly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of supply chain intelligent management and anomaly diagnosis, and specifically to a supply chain sales anomaly detection and root cause analysis system and method integrated with a knowledge graph. Background Art

[0002] As global supply chains become increasingly complex and digital, businesses are placing higher demands on real-time monitoring and intelligent decision-making capabilities for supply chain operations. Sales orders, as the most direct endpoint of the supply chain, often experience unusual fluctuations (such as sudden sales drops and delayed order fulfillment) that signal problems further up the supply chain (such as supplier delays, logistics disruptions, inventory anomalies, and market competition shifts). Timely and accurate detection of sales anomalies and rapid identification of their root causes are crucial for ensuring customer satisfaction, minimizing losses, and optimizing supply chain resilience.

[0003] Currently, mainstream methods and technologies for sales anomaly detection and root cause analysis still suffer from several drawbacks. Traditional anomaly detection methods typically build models based on a single data source (e.g., order system data alone). However, sales anomalies are often the result of a complex interaction of multiple factors (suppliers, logistics, inventory, customers, marketing activities, etc.). Existing methods struggle to effectively integrate heterogeneous data from order systems, supply chain systems (suppliers, inventory, logistics), customer relationship management systems, and external environments (e.g., competitors, weather). They are unable to capture the complex connections and dependencies between entities, resulting in limited anomaly detection coverage and low accuracy. Once an anomaly is detected, locating the root cause primarily relies on manual experience. However, manual investigation is time-consuming and labor-intensive, relies on expert experience, has poor replicability, and lacks standardized, automated analysis processes, leading to inconsistent conclusions and difficulty in generalizing.

[0004] In summary, traditional anomaly detection and root cause analysis suffer from several drawbacks, including data silos, lack of relevance, inefficient root cause analysis, and high subjectivity. To address these issues, there is an urgent need for an anomaly detection and analysis technology that can deeply integrate multi-source heterogeneous data, leverage graph structures to model complex relationships and dependencies between entities, and achieve automated performance.

[0005] To address these issues, a Chinese patent application, CN202411429220.6, proposes a phased anomaly detection method for ultra-large-scale industrial software supply chains. This approach divides detection into a "rapid contamination phase" (using a simple model to screen candidate anomaly nodes / regions) and a "precise detection phase" (using a complex model to confirm anomalies). Its innovation lies in simulating anomaly propagation by leveraging the concept of "degree of disorder" from chaos theory and the rapid oversmoothing properties of graph neural networks. However, this method's graph structure may only reflect software component dependencies and lacks the ability to model key elements in the physical supply chain (such as supplier-product-warehouse-customer relationships) and their rich attributes.

[0006] A Chinese patent application, CN202410574090.9, proposes a supply chain visualization method based on big data. This approach emphasizes data collection, integration, cleaning, and preprocessing, presenting supply chain data graphically to improve transparency and implementation efficiency. However, this method focuses on data visualization, rather than in-depth analysis and interpretation, and lacks automated anomaly detection and root cause location capabilities. Users still rely on manual observation of charts, empirically identifying anomalies, and speculating on causes, failing to address the inefficient and subjective nature of root cause analysis.

[0007] To sum up, there are still some problems with the existing technology. Therefore, this application proposes a method and system for sales anomaly detection and root cause analysis in a supply chain order system that integrates knowledge graphs. Summary of the Invention

[0008] To overcome the shortcomings of the existing technology, the present invention proposes a supply chain sales anomaly detection and root cause analysis system and method that integrates knowledge graphs. The system integrates multi-source heterogeneous data by constructing a dynamic supply chain knowledge graph, combines graph neural networks (GNNs) to achieve high-precision anomaly detection, and integrates the PGExplainer algorithm and business rules to automatically locate the root cause and trace the evidence chain, significantly improving the efficiency of anomaly detection and root cause analysis capabilities.

[0009] To achieve the above objectives, the present invention proposes a supply chain sales anomaly detection and root cause analysis system that integrates knowledge graphs, including: Data collection and preprocessing module, used to connect to the order system, supply chain system, customer relationship management system and external data sources, and perform data cleaning, entity analysis and feature extraction; Entity resolution uses a multi-stage hybrid approach: In the first stage, the structured fields are matched precisely and fuzzy based on attribute rule matching. The fuzzy matching uses the Jaro-Winkler similarity algorithm with a threshold of 0.85. In the second stage, the random forest model is used to integrate name semantic similarity, address latitude and longitude distance, and transaction frequency features for entity alignment. The name semantic similarity is obtained by calculating the cosine similarity of FastText word vectors. The third stage performs contextual disambiguation of conflicting entities through a BiLSTM model based on the attention mechanism; Feature extraction includes three categories: time series features, statistical features, and relational features. Time series features calculate the 7-day moving average and month-on-month change rate of order volume. Statistical features aggregate supplier-level delivery delay rates and their standard deviation over the past 30 days. Relational features calculate node degree centrality and multi-hop neighbor aggregation properties based on graph topology. The knowledge graph construction module is used to define entity types and relationship types, and build a dynamic supply chain knowledge graph through deep semantic fusion of multi-source heterogeneous data; A real-time anomaly detection module, which is used to access the sales indicator data stream and calculate node and global anomaly scores using a graph neural network model; The root cause analysis module is used to combine the improved PGExplainer algorithm with predefined business rules to locate the root cause entity of the anomaly and generate a chain of evidence; The visualization reporting module is used to generate interactive reports that include anomaly descriptions, root cause inferences, and graph evidence paths. It uses D3.js to render force-directed graphs. The node size is proportional to the anomaly score, and the edge thickness is proportional to the relationship strength. It supports path expansion and collapse operations of up to 5 hops.

[0010] Furthermore, the entity types and relationship types in the knowledge graph construction module are as follows: The entity types include: supplier entity, including attributes {supplier ID, name, delivery delay rate, geographic location latitude and longitude}; Product entity, with attributes {product SKU, price sensitivity index, inventory turnover rate}; Warehouse entity, including attributes {warehouse ID, capacity, temperature control level}; Customer entity, including attributes {customer ID, credit rating, purchase frequency}; Logistics route entity, including attributes {route ID, average transportation time, on-time rate}; External event entity, including attributes {event ID, type, impact level}; The relationship types include: "supply" relationship between supplier and product, including attributes {supply ratio, minimum order quantity}; The "inventory is located" relationship between products and warehouses, with attributes {inventory quantity, safety threshold}; The "deliver to" relationship between warehouse and customer, including attributes {delivery distance, historical fulfillment rate}; The "ship to" relationship between logistics routes and warehouses, including attributes {carrier, unit price}; External event - "influence" relationship between entities, including attributes {influence intensity, duration}; The BERT-BiLSTM-CRF model is used to identify entities in unstructured text. A relation extraction model based on the pre-trained language model RoBERTa is used to classify relation types, with a confidence threshold set to 0.8. Incremental data is captured using the Apache Kafka stream processing engine, converted into Cypher statements, and written to the Neo4j graph database for incremental updates. The knowledge graph construction module also includes consistency checking and conflict resolution mechanisms: Static rule checking based on OWL ontology reasoning to verify the consistency between the supplier's geographical location and the logistics route coverage area; Dynamic conflict detection based on the TransE model, with the entity embedding dimension set to 100. Conflict detection is triggered when the embedding vectors of the head entity, relationship, and tail entity meet the distance condition. The distance threshold is set to 0.3 based on the supply chain scenario; A weighted voting mechanism is designed to resolve multi-source data conflicts, and the credibility calculation formula is: ,in is the normalized score for structured data sources, is the confidence score of the NLP extraction result, The time decay score of the historical records is weighted based on the reliability of each data source.

[0011] Furthermore, the graph neural network model in the real-time anomaly detection module is specifically as follows: The graph neural network model is a three-layer graph attention network with dimensions of 128, 64, and 32 in each layer. The spatiotemporal graph convolution layer is used to fuse node attribute features with the knowledge graph adjacency matrix, and the node embedding update adopts the neighbor aggregation mechanism. Use contrastive loss function to optimize model parameters: ; in 、 are the embedding vectors of the anchor node and the positive sample node respectively, is the embedding vector of all nodes in the batch, represents the cosine similarity function, is the temperature hyperparameter used to control the smoothness of the distribution, and N is the batch size; Define a two-tier anomaly scoring mechanism, node anomaly score , in is the embedding vector of node v after GNN encoding, is the cluster centroid of the historical normal node embedding, represents the L2 norm; Global anomaly score , where V is the set of all active nodes at the current moment, is the node weight based on degree centrality; Setting the adaptive threshold ,in and are the mean and standard deviation of the historical normal scores in the sliding window, is the sensitivity coefficient, updated every hour; The training process of the real-time anomaly detection module specifically includes: Construct a training set containing 90% historical normal sales data and 10% synthetic anomaly data. Synthetic anomalies include point anomalies, contextual anomalies, and collective anomalies. A negative sampling strategy is adopted, with a positive-negative sample ratio of 1:3 and a batch size of 256; Use the AdamW optimizer with an initial learning rate of 0.001 and a weight decay coefficient of 0.01; The model was trained for 100 epochs and evaluated on the validation set every 10 epochs, using an early stopping strategy to prevent overfitting.

[0012] Furthermore, the improved PGExplainer algorithm of the root cause analysis module is as follows: Based on the original mutual information maximization objective, we add the business relationship weight term and design the loss function: ; in is the mutual information between the abnormal label Y and the explanation subgraph G_S, is the subgraph edge set, For predefined edges Business importance coefficient (“supply” relationship is set to 0.9, “ship to” relationship is set to 0.8, and other relationships are set to 0.5), is the edge mask weight to be learned, To balance hyperparameters; The business rule library adopts version management, mines frequent rule item sets with support greater than 0.3 through the Apriori algorithm, and sets the rule weight time decay function: ,in is the initial weight of the rule, is the time (in days) after the rule is created. = 90 days is half-life; Design a root cause confidence calculation formula for multi-source fusion ,in is the historical accuracy of the rule, K≤3 is the number of key nodes, The normalized rule weight coefficient satisfies , Node output by PGExplainer Importance score of The specific process of extracting the abnormal node 3-hop subgraph by the root cause analysis module includes: Starting from the abnormal node, a breadth-first search is used to extract all nodes reachable within 3 hops; Preserve the edge relationships and attributes between all nodes in the subgraph; The subgraph size is limited to 500 nodes. If it exceeds the limit, the subgraph will be truncated in descending order of node anomaly scores.

[0013] The method for detecting and analyzing supply chain sales anomalies and root causes by integrating knowledge graphs is applicable to the aforementioned system for detecting and analyzing supply chain sales anomalies and root causes by integrating knowledge graphs, and includes the following steps: Step S1: Data collection and preprocessing, specifically including: S11: Collect transaction data from the order system, inventory and logistics data from the supply chain system, customer behavior data from the customer relationship management system, and market and environmental data from external APIs in real time through a unified data interface, with a collection frequency of once every 5 minutes. S12: Perform data cleaning, including removing duplicate records, filling missing values, and correcting outliers. Missing values ​​are filled using the forward filling method, and outliers are identified using the 3 times standard deviation principle and replaced with the median. S13: Perform three-stage entity resolution. The first stage compares the key attributes of the entities for exact matching. The second stage calculates multi-dimensional similarity for fuzzy matching. The third stage uses context information to eliminate ambiguity and generate a unified entity ID mapping table. S14: Extract three types of features: time series, statistics, and relationships, and store them in the feature database. Time series features are updated hourly, statistical features are updated daily, and relationship features are updated when the graph structure changes. Step S2: Construct a dynamic supply chain knowledge graph, including: S21: Based on the entity ID mapping table in step S13, six types of entity nodes are created in the graph database, and corresponding attribute values ​​are assigned to each node; S22: Create five types of relationship edges based on business logic and data association, and calculate and store relationship attributes; S23: Perform entity recognition and relationship extraction on unstructured text, and add triples with confidence greater than 0.8 to the graph; S24: Receive real-time data streams through the Kafka message queue, generate incremental update Cypher statements, and write them to Neo4j in batches. The update delay is controlled within 30 seconds. Step S3: Perform real-time anomaly detection, specifically including: S31: Extract the current graph snapshot from the knowledge graph every 5 minutes, including the feature matrix and adjacency matrix of all active nodes; S32: Input the feature matrix and adjacency matrix into the trained 3-layer graph attention network, and forward propagate to calculate the 32-dimensional embedding vector of each node; S33: A two-tiered anomaly scoring mechanism calculates node anomaly scores and global anomaly scores; S34: Compare the anomaly score with the adaptive threshold. When the node or global anomaly score exceeds the corresponding threshold, add the abnormal node to the anomaly queue. Step S4: Locate the root cause of the anomaly. This is triggered when an anomaly is detected in step S34 and specifically includes: S41: For each node in the exception queue, a 3-hop subgraph centered on the node is extracted through Neo4j graph traversal query; S42: The subgraph is input into the improved PGExplainer model. The loss function optimizes the edge mask by gradient ascent. After 50 iterations, the importance score of each node and edge is output. S43: Select the top three nodes in importance score as candidate root causes; Step S5: Verify the root cause and generate a chain of evidence, including: S51: query the matching rule of the candidate root cause node in the rule base; S52: Execute rule condition verification. The supplier node checks whether the delivery delay rate exceeds the historical mean plus 2 standard deviations. The competitor node checks whether the promotion efforts have increased by more than 50%. The logistics node checks whether the on-time rate is less than 90%. S53: For the root cause node that has passed verification, use the Dijkstra algorithm to search for the shortest path to the abnormal node in the knowledge graph. All nodes and edges on the path constitute the evidence chain; S54: Calculate the comprehensive confidence level according to the confidence level formula. When the confidence level is greater than 0.7, it is confirmed as a valid root cause. Step S6: Generate a visualization report, specifically including: S61: Use the D3.js force-directed algorithm to render the graph structure of the evidence chain, with abnormal nodes marked in red, root cause nodes marked in orange, and the evidence path highlighted with a thick line; S62: Create a details panel for each root cause node to display its historical trend graph and related raw data; S63: Generates a PDF report containing four parts: abnormal event description, root cause analysis conclusion, evidence chain visualization, and improvement suggestions, and automatically sends it to the relevant person in charge.

[0014] Furthermore, the improved PGExplainer optimization process in step S42 specifically includes: Initialize the edge mask to a matrix of all 1s; In each iteration, the mutual information between the prediction result under the current mask and the actual abnormal label is calculated; Update the edge mask value through mask gradient, and the learning rate is set to 0.01; The sigmoid function is applied to constrain the mask value to the interval [0, 1]; early termination is performed when the loss change is less than 0.001 for 5 consecutive iterations.

[0015] Furthermore, the multi-path processing mechanism of the evidence chain in step S53 includes: When there are multiple shortest paths of equal length, the business relevance score of each path is calculated; The business relevance score is equal to the sum of the business importance coefficients of all edges on the path; The three paths with the highest scores are retained as parallel chains of evidence; If the overlap of the nodes in the evidence chains of multiple root causes exceeds 60%, they will be merged into a composite root cause.

[0016] Furthermore, it also includes the online update steps of models and rules: Screening manually confirmed abnormal cases from historical test results every week; Add new cases to the training set and use incremental learning to update the GNN model parameters; Calculate the accuracy of each rule and automatically adjust the rule weight according to the time decay function; When the accuracy of a rule is lower than 50% for one month in a row, it is marked as a rule to be eliminated.

[0017] Furthermore, real-time performance is ensured through the following mechanisms: By using graph database index optimization, the query time of 3-hop subgraph is controlled within 100 milliseconds; GNN reasoning uses model quantization and batch processing, and the single-batch reasoning time does not exceed 200 milliseconds; Rule matching uses memory caching and parallel computing, and the matching time is controlled within 50 milliseconds; The total time from end-to-end anomaly detection to root cause location does not exceed 5 seconds.

[0018] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention provides a supply chain sales anomaly detection and root cause analysis system and method that integrates knowledge graphs. By constructing a dynamic supply chain knowledge graph and applying GNN, it deeply integrates the order system, supply chain system, customer relationship management system and external data sources, effectively captures the complex dependencies between entities, and significantly improves the accuracy and timeliness of sales anomaly detection. It overcomes the limitations of traditional threshold methods, combines structured data extraction and natural language processing technology, dynamically extracts entity relationships from unstructured text, constructs a knowledge graph with rich semantic associations, and uses a graph database to achieve continuous incremental updates based on real-time data streams, breaking through the data island limitations of traditional methods.

[0019] 2. This invention provides a supply chain sales anomaly detection and root cause analysis system and method that integrates knowledge graphs. By combining the PGExplainer algorithm with a business rule engine, it can automatically locate the root cause of anomalies and trace the chain of evidence, quickly identify problems such as supply chain disruptions and competitive impacts, significantly improve analysis efficiency, and reduce manual reliance.

[0020] 3. The present invention provides a supply chain sales anomaly detection and root cause analysis system and method that integrates knowledge graphs. It adopts a collaborative mechanism of lightweight filtering and GNN detection to reduce computing resource consumption while ensuring real-time performance; through continuous incremental updates of the knowledge graph, it ensures data timeliness and analysis reliability.

[0021] 4. This invention provides a supply chain sales anomaly detection and root cause analysis system and method that integrates knowledge graphs. By dynamically associating supporting data (such as logistics records and quality inspection reports) through visual graph evidence paths, decision makers can intuitively understand the causes of anomalies, shorten fault diagnosis and response time, and optimize supply chain collaborative management capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] Figure 1 It is a schematic diagram of the system flow of the present invention; Figure 2 This is the architecture diagram of the sales anomaly detection and root cause analysis system of the supply chain order system; Figure 3 It is a flowchart for building and updating the knowledge graph of a dynamic supply chain; Figure 4 This is a collaborative workflow diagram of anomaly detection and root cause analysis. DETAILED DESCRIPTION

[0024] The technical solutions of the present invention will be more clearly and completely explained below through description of preferred embodiments of the present invention in conjunction with the accompanying drawings.

[0025] Explanation of terms: NLP: Natural Language Processing, used to extract entity and relationship information from unstructured text API: Application Programming Interface; SQL: Structured Query Language, used for database queries; Cypher - query language for the Neo4j graph database. Apache Kafka - distributed stream processing platform for collecting and transmitting real-time data streams. GNN: Graph Neural Network, a deep learning model for processing graph structured data BERT: pre-trained language model; BiLSTM: Bidirectional long short-term memory network; CRF: Conditional Random Field, used for sequence labeling tasks; RoBERTa: an improved BERT model; FastText - word embedding training tool developed by Facebook. TransE: A knowledge graph embedding algorithm for vector representation of entities and relations. AdamW: Adam optimizer with weight decay; D-STGCN: Dynamic Spatiotemporal Graph Convolutional Network; PGExplainer: an algorithm for explaining predictions from graph neural networks. Jaro-Winkler: string similarity algorithm, often used for fuzzy matching; Apriori: association rule mining algorithm used to discover frequent itemsets; Dijkstra: shortest path algorithm, used to find the shortest path between two points in a graph; L2 norm: Euclidean distance, used to calculate vector length Neo4j: Graph Database Management System OWL: Web Ontology Language, used to define ontologies and inference rules; D3.js - JavaScript visualization library. SKU: Stock Keeping Unit, used to identify a specific product Delivery delay rate: The proportion of suppliers who fail to deliver on time Inventory turnover rate: an indicator of how quickly inventory is updated Fulfillment rate: the proportion of orders completed on time Safety threshold: minimum safe level of inventory Degree centrality: A measure of node importance in graph theory, based on the number of connections between nodes Confidence: The degree of confidence in the model prediction or rule matching Mutual information: an indicator in information theory that measures the degree of mutual dependence between two variables Contrastive loss function: loss function for learning similarity in deep learning Temperature parameter: a hyperparameter that controls the smoothness of the probability distribution like Figure 1 The figure shows the complete architectural process of the sales anomaly detection and root cause analysis system of the supply chain order system, including six core layers from data source to final report generation.

[0026] The top layer is the data source layer, which includes four main data sources: the order system provides sales transaction data, the supply chain system provides operational data such as inventory and logistics, the customer relationship management system provides information on customer behavior and preferences, and other external data includes competitive product information, weather data, and other environmental factors. This multi-source heterogeneous data provides a comprehensive information foundation for the system.

[0027] The second layer is the demand collection and preprocessing layer, responsible for normalizing the received raw data. The multi-source data cleaning module removes duplications, fills in gaps, and corrects outliers. The entity relationship resolution module achieves cross-system entity alignment through a three-stage hybrid approach. The feature balance extraction module calculates temporal, statistical, and relational features to prepare standardized input for subsequent analysis.

[0028] The third layer is the knowledge graph construction layer, which converts preprocessed data into a graph structure. The entity relationship definition module defines six types of entity nodes and five types of relationships. The dynamic incremental update module uses Kafka to capture data changes in real time and update the graph. The graph database construction module uses Neo4j to store and manage graph data, supporting complex graph query operations.

[0029] The fourth layer is the real-time anomaly detection layer, which continuously monitors the sales data stream. A lightweight filtering module quickly filters out normal fluctuations in data. The GNN anomaly detection scoring model uses a three-layer graph attention network to calculate node and global anomaly scores. The trigger root cause analysis signal module automatically initiates the next stage of analysis when an anomaly exceeds a threshold.

[0030] The fifth layer is the root cause analysis layer, responsible for locating the underlying causes of anomalies. The PGExplainer algorithm extracts a three-hop subgraph of the anomaly node and calculates node importance. The predefined business rules module includes a rule base for supplier risk, competitive impact, logistics disruption, and other factors. The key node location module identifies the top three key entities. The evidence chain tracing module constructs a complete chain of evidence from the root cause to the anomaly along the graph path.

[0031] The bottom layer is the visualization report generation layer, which converts analysis results into an easily understandable format. The root cause report generation module automatically compiles a structured report containing anomaly descriptions and root cause conclusions. The evidence path visualization module uses D3.js to render interactive graphs, color-coding anomaly nodes, root cause nodes, and propagation paths. The data support display module dynamically links original documentation such as logistics records and quality inspection reports to provide comprehensive support for decision-making.

[0032] As a specific implementation, a large e-commerce company deployed this system to monitor sales anomalies within its complex supply chain network. The system first uses a data acquisition and preprocessing module to automatically collect transaction data from the order system, inventory and logistics data from the supply chain system, customer behavior data from the customer relationship management system, and market competitive product promotion information and weather data from external APIs every five minutes. The collected raw data is then cleaned to remove duplicate records, forward fill missing values, and median values ​​are replaced for outliers exceeding three standard deviations.

[0033] During the entity resolution phase, the system employs a three-stage hybrid approach to address entity alignment in multi-source data. In the first stage, structured fields such as supplier names and product SKUs are matched with exact matches and fuzzy matches based on the Jaro-Winkler algorithm, with a similarity threshold of 0.85. For example, "Shenzhen Technology Co., Ltd." and "Shenzhen Technology Co., Ltd." are identified as the same entity through fuzzy matching. In the second stage, a random forest model is used to comprehensively consider name semantic similarity, address latitude and longitude distances, and historical transaction frequency. Name semantic similarity is calculated using cosine similarity calculated using FastText word embeddings. In the third stage, the system uses a BiLSTM model based on an attention mechanism to resolve ambiguous entities, incorporating contextual information. The feature extraction phase calculates three types of features: temporal features, including the 7-day moving average of order volume and the month-over-month change rate; statistical features, including the supplier delivery delay rate and its standard deviation over the past 30 days; and relational features, based on the graph topology, by calculating node degree centrality and multi-hop neighbor aggregation properties.

[0034] The knowledge graph construction module defines six types of entity nodes and five types of relationships. Entities include suppliers (including attributes such as supplier ID, name, delivery delay rate, and geographic location), products (including product SKU, price sensitivity index, and inventory turnover rate), warehouses (including warehouse ID, capacity, and temperature control level), customers (including customer ID, credit rating, and purchase frequency), logistics routes (including route ID, average transit time, and on-time performance), and external events (including event ID, type, and impact level). Relationship types include the "supply" relationship between suppliers and products (including supply percentage and minimum order quantity attributes), the "inventory located" relationship between products and warehouses, the "deliver to" relationship between warehouses and customers, the "ship to" relationship between logistics routes and warehouses, and the "impact" relationship between external events and entities. The system uses the BERT-BiLSTM-CRF model to identify entities from unstructured text such as customer service tickets and logistics notifications. A RoBERTa-based relationship extraction model is used to classify relationship types, with a confidence threshold of 0.8. Incremental data is captured in real time through the Apache Kafka stream processing engine, converted into Cypher statements and written in batches to the Neo4j graph database, with update delays controlled within 30 seconds.

[0035] To ensure the quality of the knowledge graph, the system implements consistency checking and conflict resolution mechanisms. OWL ontology reasoning verifies the consistency between supplier locations and logistics route coverage areas. Dynamic conflict detection is performed using the TransE model, with the entity embedding dimension set to 100 and the distance threshold set to 0.3. When conflicts are detected, they are resolved using a weighted voting mechanism, with structured data weighted 0.6, NLP extraction results weighted 0.3, and historical records weighted 0.1.

[0036] The real-time anomaly detection module deploys a three-layer graph attention network with layer dimensions of 128, 64, and 32, respectively. The model is trained using 90% historical normal sales data and 10% synthetic anomaly data. The synthetic anomalies cover three types: point anomalies, contextual anomalies, and collective anomalies. Optimization is performed using a contrastive loss function with a temperature parameter set to 0.1, the AdamW optimizer with an initial learning rate of 0.001 and a weight decay coefficient of 0.01. Every five minutes, the system extracts a snapshot of the current graph from the knowledge graph and feeds it into the GNN model to calculate a 32-dimensional node embedding vector. Anomaly scoring uses a two-layer mechanism: a node anomaly score is calculated by calculating the L2 distance between the node embedding and the centroid of the historical normal cluster. The global anomaly score is the weighted average of all node anomaly scores, with weights based on node degree centrality. The adaptive threshold is updated hourly and is set to the mean of the historical normal score plus three standard deviations.

[0037] When an anomaly is detected, the root cause analysis module immediately activates. The system extracts a three-hop subgraph of the anomaly node, limited to 500 nodes. The improved PGExplainer algorithm adds business relationship weighting to the original mutual information maximization objective, setting the "supply" relationship weight to 0.9, the "ship to" relationship weight to 0.8, and all other relationship weights to 0.5. Edge masks are optimized through 50 gradient ascent iterations, outputting node and edge importance scores. The top three nodes with the highest scores are selected as candidate root causes.

[0038] The business rule library is versioned and uses the Apriori algorithm to mine frequent rule itemsets with a support greater than 0.3. Rule weights decay over time, with a half-life of 90 days. Candidate root causes are subject to rule validation: the supplier node checks whether the delivery delay rate exceeds the historical mean plus two standard deviations; the competitor node checks whether promotional efforts have increased by more than 50%; and the logistics node checks whether the on-time rate falls below 90%. Once verified, the Dijkstra algorithm is used to search for the shortest path to the anomalous node and construct an evidence chain. The root cause confidence level takes into account the historical accuracy of the rule, the rule weight, and the PGExplainer output score. A confidence level greater than 0.7 is considered a valid root cause.

[0039] The visual reporting module uses D3.js to render a force-directed graph. Node size is proportional to the anomaly score, and edge thickness is proportional to the strength of the relationship. Anomaly nodes are marked in red, root cause nodes in orange, and evidence paths are highlighted with thick lines. Paths up to five hops can be expanded and collapsed. Clicking a root cause node dynamically loads supporting data such as logistics waybills and quality inspection reports in the sidebar. The system automatically generates a PDF report containing a description of the anomaly, root cause analysis conclusions, a visual chain of evidence, and improvement suggestions, which is then emailed to the relevant responsible person.

[0040] In one real-world application, the system detected a 40% drop in orders for a popular product within two hours. The GNN model output an anomaly score of 0.92 for this product node, triggering root cause analysis. PGExplainer identified key supplier S1 as having the highest importance score, and the rule engine verified that its delivery delay rate had increased dramatically from an average of 5% to 35%. Tracing back along the knowledge graph revealed a chain of evidence: "Product P sales decline ← supply delay ← supplier S1 ← typhoon impact on raw material production." The system completed the entire process analysis within five seconds, enabling the company to promptly activate contingency plans for alternative suppliers and minimize losses.

[0041] Example 1 The present invention provides a supply chain order system sales anomaly detection and root cause analysis system that integrates knowledge graphs, referring to Figure 2, including data collection and preprocessing module, knowledge graph construction module, real-time anomaly detection module, root cause analysis module and visual reporting module; The data collection and preprocessing module is used to connect with the order system, supply chain system, customer relationship management system and external data sources (such as competitor databases and weather APIs), and perform data cleaning, entity analysis and feature extraction (such as calculating order fulfillment rate and inventory turnover rate). The knowledge graph construction module is used to define entity types (such as supplier, product, warehouse, and customer) and relationship types (such as "supply," "ship to," and "purchase"). It builds a dynamic supply chain knowledge graph through structured data extraction and NLP technology, and uses a graph database (Neo4j) to achieve incremental updates based on real-time data streams. The real-time anomaly detection module is used to access sales indicator data streams (such as minute-level order volume), quickly filter out normal fluctuation data using lightweight filtering units, and calculate node and global anomaly scores through the GNN model; The root cause analysis module is used to locate the root cause entity of the anomaly by combining the PGExplainer algorithm with predefined business rules, and generate an evidence chain along the graph relationship path; The visual reporting module is used to generate interactive reports, dynamically displaying abnormal event descriptions, root cause inference results, knowledge graph evidence paths (such as the "abnormal product ← supply ← delayed supplier" path) and related supporting data (such as logistics delay records).

[0042] When the system is working, it first integrates multi-source heterogeneous data in real time through the data acquisition and preprocessing module to complete entity alignment and feature calculation; then the knowledge graph construction module dynamically updates the graph based on the ontology definition and supplements the relationships extracted from unstructured text; the real-time anomaly detection module continuously monitors the sales data stream and automatically triggers the root cause analysis process when the anomaly score output by the GNN model exceeds the threshold; the root cause analysis module extracts the local subgraph of the abnormal node, calculates the node importance through PGExplainer and matches the business rules to verify the root cause, and finally aggregates multi-hop paths to form an evidence chain; the visualization report module automatically renders the evidence path and associates the underlying data to generate a decision report.

[0043] As a specific embodiment, the present invention provides a supply chain order system sales anomaly detection and root cause analysis system that integrates a knowledge graph. Based on Example 1, the knowledge graph construction module includes an ontology definition unit, a dynamic update unit, and an NLP supplementation unit. The ontology definition unit predefines entity types (including attributes, such as a "delivery delay rate" field in a supplier node) and relationship types (such as the "inventory is located at" relationship in "product-warehouse"). The dynamic update unit captures incremental data (such as new orders and inventory changes) in real time through a streaming data processing engine (Apache Kafka), converts it into a graph structure, and writes it to a graph database. The NLP supplementation unit extracts entity relationships from unstructured text such as customer service tickets and news (such as extracting the triple "supplier A, affected event, typhoon" from "Supplier A suspended due to a typhoon") and adds them to the graph after confidence filtering.

[0044] As a specific embodiment, the present invention provides a sales anomaly detection and root cause analysis system for a supply chain order system that integrates a knowledge graph. Based on Example 1, the real-time anomaly detection module includes a lightweight filtering unit, a GNN anomaly detection unit, and a trigger mechanism unit. The lightweight filtering unit rapidly filters normal data points based on sliding window statistics (e.g., the mean ±3 standard deviations of the past seven days), inputting only suspicious data into the GNN model. The GNN anomaly detection unit utilizes a dynamic spatiotemporal graph convolutional network (D-STGCN), which can simultaneously model graph topology and the spatiotemporal dependencies of node attributes. Using the knowledge graph as the topology, it integrates node attributes (e.g., product price sensitivity) with time series features (e.g., order volume trends) to output anomaly scores for each node and a global anomaly score. The trigger mechanism unit sets a threshold strategy. For example, when a single node score is greater than 0.8 or the global score is greater than 0.7, the root cause analysis module is automatically invoked and the anomalous node is locked.

[0045] As a specific embodiment, the present invention provides a supply chain order system sales anomaly detection and root cause analysis system that integrates knowledge graphs. Based on Example 1, the root cause analysis module performs the following process: Step S1: Extract a subgraph centered on the abnormal node and covering all nodes and edges within its 3-hop relationship range; Step S2: Use PGExplainer to calculate the importance scores of nodes in the subgraph and identify the top three key entities with the highest scores (e.g., supplier S1 scores 0.92, competitor C1 scores 0.85); Step S3: Call the rule engine unit to match the business rule library. For example, if supplier S1 hits the "supplier risk rule," verify whether its attribute "delivery delay rate" is greater than the historical delivery delay rate; if competitor C1 hits the "competitive impact rule," verify whether its attribute "promotion intensity" has increased suddenly; Step S4: Aggregate the evidence chain along the graph path (e.g., “Product P sales decline ← supply delay ← supplier S1 ← raw material shortage”) and associate it with external data (e.g., supplier S1’s raw material purchase order delay record).

[0046] As a specific embodiment, the present invention provides a sales anomaly detection and root cause analysis system for a supply chain order system that integrates a knowledge graph. Based on Example 1, the visual report module includes a graph path rendering unit and a dynamic evidence association unit. The graph path rendering unit highlights the anomaly nodes, root cause nodes, and evidence paths in different colors, and supports path expansion / collapse operations. The dynamic evidence association unit realizes two-way interaction: when clicking on the root cause node (such as supplier S1), the sidebar dynamically loads its associated logistics waybill delay list and quality inspection report; when clicking on the "ship to" relationship of the evidence path, the on-time rate trend chart of the route for the past 7 days is displayed.

[0047] The process of building and updating the dynamic supply chain knowledge graph is as follows: Figure 3 As shown, the process starts with the ontology definition at the top, which includes two parallel modules: entity type definition and relationship type definition, which lays the foundation for the subsequent knowledge graph construction. The data integration link processes three different types of data sources: serialized data is processed through SQL queries, real-time data is directly connected to the system, and unstructured data requires NLP processing to extract useful information. These three data streams converge into the entity relationship extraction module, which is responsible for identifying and extracting entities and their relationships from multi-source heterogeneous data. After the extraction is completed, the system writes this information to the graph database for persistent storage. At the bottom of the process is the incremental update mechanism, which includes three parallel modules: entity update, attribute update, and relationship update. It ensures that the knowledge graph can dynamically evolve with the arrival of new data and maintain the timeliness and accuracy of the information.

[0048] The collaborative workflow of anomaly detection and root cause analysis is as follows: Figure 4As shown, the overall process is divided into two parts, left and right. The left side shows the anomaly detection process. Starting with the sales data stream input, it first undergoes lightweight filtering to quickly eliminate apparently normal data. The first judgment node assesses the data for anomalies. Normal data passes directly, while anomalous data enters the GNN model for in-depth analysis. After the GNN model calculates the anomaly score for each node, the second judgment node checks whether the score exceeds a preset threshold. Data that does not exceed the threshold is considered normal and passes. Data that exceeds the threshold triggers the root cause analysis process on the right. Upon receiving the trigger signal, the root cause analysis process on the right first extracts the hop neighborhood subgraph of the anomalous node to obtain its local network structure. It then uses the PGExplainer algorithm to analyze the importance of each node and edge in the subgraph and identify the top three key entities. These key entities are validated against business rules in the rule engine to confirm their likelihood as root causes. The system then aggregates multi-hop paths, tracing the propagation path from the root cause to the anomalous performance, ultimately generating a complete chain of evidence, providing decision makers with a clear explanation of the anomaly's cause. The two processes are seamlessly integrated through anomaly threshold judgment, forming an automated anomaly detection and intelligent root cause location system.

[0049] The above-described specific embodiments merely describe preferred embodiments of the present invention and do not limit the scope of protection of the present invention. Any modifications, substitutions, and improvements made to the technical solution of the present invention by a person skilled in the art based on the textual description and drawings provided herein, without departing from the design concept and spirit of the present invention, shall fall within the scope of protection of the present invention. The scope of protection of the present invention is determined by the claims.

Claims

1. A supply chain sales anomaly detection and root cause analysis system that integrates knowledge graphs, characterized by: include: Data collection and preprocessing module, used to connect to the order system, supply chain system, customer relationship management system and external data sources, and perform data cleaning, entity analysis and feature extraction; Entity resolution uses a multi-stage hybrid approach: In the first stage, the structured fields are matched precisely and fuzzy based on attribute rule matching. The fuzzy matching uses the Jaro-Winkler similarity algorithm with a threshold of 0.

85. In the second stage, the random forest model is used to integrate name semantic similarity, address latitude and longitude distance, and transaction frequency features for entity alignment. The name semantic similarity is obtained by calculating the cosine similarity of FastText word vectors. The third stage performs contextual disambiguation of conflicting entities through a BiLSTM model based on the attention mechanism; Feature extraction includes three categories: time series features, statistical features, and relational features. Time series features calculate the 7-day moving average and month-on-month change rate of order volume. Statistical features aggregate supplier-level delivery delay rates and their standard deviation over the past 30 days. Relational features calculate node degree centrality and multi-hop neighbor aggregation properties based on graph topology. The knowledge graph construction module is used to define entity types and relationship types, and build a dynamic supply chain knowledge graph through deep semantic fusion of multi-source heterogeneous data; A real-time anomaly detection module, which is used to access the sales indicator data stream and calculate node and global anomaly scores using a graph neural network model; The root cause analysis module is used to combine the improved PGExplainer algorithm with predefined business rules to locate the root cause entity of the anomaly and generate a chain of evidence; The visualization reporting module is used to generate interactive reports that include anomaly descriptions, root cause inferences, and graph evidence paths. It uses D3.js to render force-directed graphs. The node size is proportional to the anomaly score, and the edge thickness is proportional to the relationship strength. It supports path expansion and collapse operations of up to 5 hops.

2. The supply chain sales anomaly detection and root cause analysis system integrating knowledge graph according to claim 1 is characterized in that: The entity types and relationship types in the knowledge graph construction module are as follows: The entity types include: supplier entity, including attributes {supplier ID, name, delivery delay rate, geographic location latitude and longitude}; Product entity, with attributes {product SKU, price sensitivity index, inventory turnover rate}; Warehouse entity, including attributes {warehouse ID, capacity, temperature control level}; Customer entity, including attributes {customer ID, credit rating, purchase frequency}; Logistics route entity, including attributes {route ID, average transportation time, on-time rate}; External event entity, including attributes {event ID, type, impact level}; The relationship types include: "supply" relationship between supplier and product, including attributes {supply ratio, minimum order quantity}; The "Inventory Located" relationship between a product and a warehouse contains attributes {inventory quantity, safety threshold}; The "deliver to" relationship between a warehouse and a customer, including attributes {delivery distance, historical fulfillment rate}; The "Ship To" relationship between a logistics route and a warehouse, including attributes {carrier, unit price}; External event - "impact" relationship between entities, including attributes {impact intensity, duration}; The BERT-BiLSTM-CRF model is used to identify entities in unstructured text. A relation extraction model based on the pre-trained language model RoBERTa is used to classify relation types, with a confidence threshold set to 0.

8. Incremental data is captured using the Apache Kafka stream processing engine, converted into Cypher statements, and written to the Neo4j graph database for incremental updates. The knowledge graph construction module also includes consistency checking and conflict resolution mechanisms: Static rule checking based on OWL ontology reasoning to verify the consistency between the supplier's geographical location and the logistics route coverage area; Dynamic conflict detection based on the TransE model, with the entity embedding dimension set to 100. Conflict detection is triggered when the embedding vectors of the head entity, relationship, and tail entity meet the distance condition. The distance threshold is set to 0.3 based on the supply chain scenario; A weighted voting mechanism is designed to resolve multi-source data conflicts, and the credibility calculation formula is: ,in is the normalized score for structured data sources, is the confidence score of the NLP extraction result, The time decay score of the historical records, with the weight coefficient set based on the reliability of each data source.

3. The supply chain sales anomaly detection and root cause analysis system integrating knowledge graph according to claim 1 is characterized in that: The graph neural network model in the real-time anomaly detection module is as follows: The graph neural network model is a three-layer graph attention network with dimensions of 128, 64, and 32 in each layer. The spatiotemporal graph convolution layer is used to fuse node attribute features with the knowledge graph adjacency matrix, and the node embedding update adopts the neighbor aggregation mechanism. Use contrastive loss function to optimize model parameters: ； in 、 are the embedding vectors of the anchor node and the positive sample node respectively, is the embedding vector of all nodes in the batch, represents the cosine similarity function, is the temperature hyperparameter used to control the smoothness of the distribution, and N is the batch size; Define a two-tier anomaly scoring mechanism, node anomaly score , in is the embedding vector of node v after GNN encoding, is the cluster centroid of the historical normal node embedding, represents the L2 norm; Global anomaly score , where V is the set of all active nodes at the current moment, is the node weight based on degree centrality; Setting the adaptive threshold ,in and are the mean and standard deviation of the historical normal scores in the sliding window, is the sensitivity coefficient, updated every hour; The training process of the real-time anomaly detection module specifically includes: Construct a training set containing 90% historical normal sales data and 10% synthetic anomaly data. Synthetic anomalies include point anomalies, contextual anomalies, and collective anomalies. A negative sampling strategy is adopted, with a positive-negative sample ratio of 1:3 and a batch size of 256; Use the AdamW optimizer with an initial learning rate of 0.001 and a weight decay coefficient of 0.01; The model was trained for 100 epochs and evaluated on the validation set every 10 epochs. An early stopping strategy was used to prevent overfitting.

4. The supply chain sales anomaly detection and root cause analysis system integrating knowledge graph according to claim 1 is characterized in that: The improved PGExplainer algorithm of the root cause analysis module is as follows: Based on the original mutual information maximization objective, we add the business relationship weight term and design the loss function: ， in is the mutual information between the abnormal label Y and the explanation subgraph G_S, is the subgraph edge set, For predefined edges The business importance coefficient is set to 0.9 for the "supply" relationship, 0.8 for the "ship to" relationship, and 0.5 for other relationships. is the edge mask weight to be learned, To balance hyperparameters; The business rule library adopts version management, mines frequent rule item sets with support greater than 0.3 through the Apriori algorithm, and sets the rule weight time decay function: ,in is the initial weight of the rule, The time after the rule is created. = 90 days is half-life; Design a root cause confidence calculation formula for multi-source fusion ,in is the historical accuracy of the rule, K≤3 is the number of key nodes, The normalized rule weight coefficient satisfies , Node output by PGExplainer Importance score of The specific process of extracting the abnormal node 3-hop subgraph by the root cause analysis module includes: Starting from the abnormal node, a breadth-first search is used to extract all nodes reachable within 3 hops; Preserve the edge relationships and attributes between all nodes in the subgraph; The subgraph size is limited to 500 nodes. If it exceeds the limit, the subgraph will be truncated in descending order of node anomaly scores.

5. A method for detecting and analyzing supply chain sales anomalies and root causes by integrating knowledge graphs, applicable to the system for detecting and analyzing supply chain sales anomalies and root causes by integrating knowledge graphs as described in any one of claims 1 to 4, characterized in that: The following steps are involved: Step S1: Data collection and preprocessing, specifically including: S11: Collect transaction data from the order system, inventory and logistics data from the supply chain system, customer behavior data from the customer relationship management system, and market and environmental data from external APIs in real time through a unified data interface, with a collection frequency of once every 5 minutes. S12: Perform data cleaning, including removing duplicate records, filling missing values, and correcting outliers. Missing values ​​are filled using the forward filling method, and outliers are identified using the 3 times standard deviation principle and replaced with the median. S13: Perform three-stage entity resolution. The first stage compares the key attributes of the entities for exact matching. The second stage calculates multi-dimensional similarity for fuzzy matching. The third stage uses context information to eliminate ambiguity and generate a unified entity ID mapping table. S14: Extract three types of features: time series, statistics, and relationships, and store them in the feature database. Time series features are updated hourly, statistical features are updated daily, and relationship features are updated when the graph structure changes. Step S2: Construct a dynamic supply chain knowledge graph, specifically including: S21: Based on the entity ID mapping table in step S13, six types of entity nodes are created in the graph database, and corresponding attribute values ​​are assigned to each node; S22: Create five types of relationship edges based on business logic and data association, and calculate and store relationship attributes; S23: Perform entity recognition and relationship extraction on unstructured text, and add triples with confidence greater than 0.8 to the graph; S24: Receive real-time data streams through the Kafka message queue, generate incremental update Cypher statements, and write them to Neo4j in batches. The update delay is controlled within 30 seconds. Step S3: Perform real-time anomaly detection, specifically including: S31: Extract the current graph snapshot from the knowledge graph every 5 minutes, including the feature matrix and adjacency matrix of all active nodes; S32: Input the feature matrix and adjacency matrix into the trained 3-layer graph attention network, and forward propagate to calculate the 32-dimensional embedding vector of each node; S33: A two-tiered anomaly scoring mechanism calculates node anomaly scores and global anomaly scores; S34: Compare the anomaly score with the adaptive threshold. When the node or global anomaly score exceeds the corresponding threshold, add the abnormal node to the anomaly queue. Step S4: Locate the root cause of the anomaly. This is triggered when an anomaly is detected in step S34 and specifically includes: S41: For each node in the exception queue, a 3-hop subgraph centered on the node is extracted through Neo4j graph traversal query; S42: The subgraph is input into the improved PGExplainer model. The loss function optimizes the edge mask by gradient ascent. After 50 iterations, the importance score of each node and edge is output. S43: Select the top three nodes in importance score as candidate root causes; Step S5: Verify the root cause and generate a chain of evidence, including: S51: query the matching rule of the candidate root cause node in the rule base; S52: Execute rule condition verification. The supplier node checks whether the delivery delay rate exceeds the historical mean plus 2 standard deviations. The competitor node checks whether the promotion efforts have increased by more than 50%. The logistics node checks whether the on-time rate is less than 90%. S53: For the root cause node that has passed verification, use the Dijkstra algorithm to search for the shortest path to the abnormal node in the knowledge graph. All nodes and edges on the path constitute the evidence chain; S54: Calculate the comprehensive confidence level according to the confidence level formula. When the confidence level is greater than 0.7, it is confirmed as a valid root cause. Step S6: Generate a visualization report, specifically including: S61: Use the D3.js force-directed algorithm to render the graph structure of the evidence chain, with abnormal nodes marked in red, root cause nodes marked in orange, and the evidence path highlighted with a thick line; S62: Create a details panel for each root cause node to display its historical trend graph and related raw data; S63: Generates a PDF report containing four parts: abnormal event description, root cause analysis conclusion, evidence chain visualization, and improvement suggestions, and automatically sends it to the relevant person in charge.

6. The method for supply chain sales anomaly detection and root cause analysis based on knowledge graph integration according to claim 5 is characterized in that: The improved PGExplainer optimization process in step S42 specifically includes: Initialize the edge mask to a matrix of all 1s; In each iteration, the mutual information between the prediction result under the current mask and the true abnormal label is calculated; Update the edge mask value through mask gradient, and the learning rate is set to 0.01; The sigmoid function is applied to constrain the mask value to the interval [0, 1]; early termination is performed when the loss change is less than 0.001 for 5 consecutive iterations.

7. The method for supply chain sales anomaly detection and root cause analysis based on knowledge graph integration according to claim 5 is characterized in that: The multi-path processing mechanism of the evidence chain in step S53 includes: When there are multiple shortest paths of equal length, the business relevance score of each path is calculated; The business relevance score is equal to the sum of the business importance coefficients of all edges on the path; The three paths with the highest scores are retained as parallel chains of evidence; If the overlap of the nodes in the evidence chains of multiple root causes exceeds 60%, they will be merged into a composite root cause.

8. The method for supply chain sales anomaly detection and root cause analysis based on knowledge graph integration according to claim 5 is characterized in that: It also includes the online update steps of the model and rules: Screening manually confirmed abnormal cases from historical test results every week; Add new cases to the training set and use incremental learning to update the GNN model parameters; Calculate the accuracy of each rule and automatically adjust the rule weight according to the time decay function; When the accuracy of a rule is lower than 50% for one month in a row, it is marked as a rule to be eliminated.

9. The method for supply chain sales anomaly detection and root cause analysis based on knowledge graph integration according to claim 5 is characterized in that: Real-time performance is ensured through the following mechanisms: By using graph database index optimization, the query time of 3-hop subgraph is controlled within 100 milliseconds; GNN reasoning uses model quantization and batch processing, and the single-batch reasoning time does not exceed 200 milliseconds; Rule matching uses memory caching and parallel computing, and the matching time is controlled within 50 milliseconds; The total time from end-to-end anomaly detection to root cause location does not exceed 5 seconds.

Images