Method for detecting log abnormity of power dispatching automation system

Abstract

The invention relates to the technical field of electric digital data processing, and discloses a method for detecting log abnormity of an electric power dispatching automation system, which comprises the following steps of: constructing a fixed depth analysis tree through historical log data, and extracting a log template based on word segmentation similarity; converting knowledge in the power dispatching field into vectors and storing the vectors into a knowledge base; retrieving knowledge base associated domain knowledge of the log template, inputting the large model to carry out abnormity judgment and marking a template label; after real-time log preprocessing, a template label is inherited through a parse tree matching template library and a self-adaptive threshold strategy, and online template updating is triggered for unmatched logs; and the context and high-frequency parameters of the abnormal log are aggregated, a dynamic cue word is constructed in combination with a retrieval result and a template feature weight, a large model is input for multi-dimensional root cause analysis, and template mechanism optimization is driven based on the cue word. The problems that in the prior art, manual maintenance is difficult, the generalization ability is weak, and the detection speed is low are solved, and the purposes of efficient detection, high accuracy and self-adaption are achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of electrical digital data processing, and in particular to intelligent operation and maintenance of electric power dispatching automation systems. Background Art

[0002] As the complexity of power dispatching automation systems continues to increase, especially as new-generation power dispatching automation systems gradually replace the original Open3000 system, the number of various types of logs generated by power dispatching systems has also increased dramatically. This makes it difficult for operations and maintenance personnel to quickly process the operating status, operation logs, and three-remote control events of these power dispatching monitoring systems. If these log information cannot be analyzed in a timely manner, it may cause power system failures and even have a serious impact on the stability of the entire power grid. Therefore, log event detection of power dispatching monitoring systems is of great significance in dispatching operations and maintenance.

[0003] Currently, there are several approaches to anomaly detection: 1) Traditional log anomaly detection methods typically employ rule- and feature-based detection. While this approach offers rapid detection capabilities, it requires manual configuration and updating of rule bases. With the constant emergence of new anomaly patterns and fault conditions, manual rule base maintenance becomes extremely difficult. 2) Machine learning-based log anomaly detection methods, such as DBSCAN for log cluster analysis, require no rule configuration, but require retraining when new types of log samples appear. These methods have weak generalization capabilities and are unable to detect new anomalies. 3) Large-model-based log anomaly detection methods offer strong generalization but slow detection speeds, making them particularly ineffective when faced with the thousands of log entries per second in power dispatch systems. 4) Log anomaly detection methods based on large models combined with log templates address the slow detection speed and leverage the generalization capabilities of large models. However, these methods lack domain knowledge of the power dispatch system and have low accuracy in detecting power dispatch system logs.

[0004] For example, the Chinese patent with publication number CN114048870B discloses a method for monitoring power system anomalies based on intelligent mining of log features, and provides the following technical solutions: The present invention discloses a method for monitoring power system anomalies based on intelligent mining of log features, comprising the following steps: collecting log data in multiple time spans and multiple scenarios and performing preprocessing to form log data samples; clustering analysis of the log data samples based on the DBSCAN clustering algorithm to obtain clustering results, and screening the clustering results using the Pearson correlation coefficient to obtain abnormal logs in the log data samples; parsing the abnormal log text using natural language processing technology, and feeding back the parsed content to relevant staff. The present invention will improve the algorithm based on machine learning clustering algorithms and natural language processing technology in response to the characteristics of business scenarios and the defects of the original algorithm, so that the entire process does not require manual intervention, automatically analyzes log information, improves anomaly detection performance, can effectively realize abnormal power detection, improve the degree of automation and efficiency of power audits, and save manpower and material resources. However, the aforementioned power system anomaly monitoring method based on intelligent mining of log features cannot automatically update the rule base to handle new anomaly patterns and lacks domain knowledge support. This leads to weak generalization and slow detection, especially when log volume surges. Furthermore, the accuracy is low when dealing with complex power system logs. The patent relies on the DBSCAN clustering algorithm, which is cumbersome to adjust parameters, cannot adaptively handle unknown faults, and does not integrate real-time context or multi-dimensional analysis, resulting in inefficient operations and maintenance. Summary of the Invention

[0005] The present invention solves the problems of difficult manual maintenance, weak generalization ability, slow detection speed and lack of domain knowledge in the existing technology, and proposes a method for detecting anomalies in the logs of the power dispatching automation system, achieving the goals of efficient detection, high accuracy and adaptive updating.

[0006] Furthermore, the present invention achieves rapid preliminary anomaly detection, effectively reduces the burden of manual rule maintenance, significantly improves recognition accuracy and second-level response, adapts to new log patterns through an online template update mechanism, enhances system stability and improves the overall detection automation level and efficiency.

[0007] To achieve the above object, the present invention adopts the following technical solutions: A method for detecting abnormalities in a power dispatching automation system log, comprising: A fixed-depth parsing tree is constructed from historical log data, and log templates are extracted based on word segmentation similarity. Knowledge in the power dispatching field is converted into vectors and stored in the knowledge base. Retrieve domain knowledge from the knowledge base of the log template, input it into the big model to perform anomaly judgment and mark the template tag; After real-time log preprocessing, the template tag is inherited through the parsing tree matching template library and adaptive threshold strategy, triggering online template updates for unmatched logs; Aggregate the context and high-frequency parameters of abnormal logs, combine the search results and template feature weights to build dynamic prompt words, input into the large model for multi-dimensional root cause analysis, and drive template mechanism optimization based on the prompt words.

[0008] Integrate offline template analysis and online real-time detection to significantly improve the efficiency and accuracy of log anomaly detection, build a fixed-depth parse tree and extract templates based on word segmentation similarity to ensure the efficient generation of a standardized template library, and vectorize and store knowledge in the power dispatching field to lay the foundation for subsequent knowledge enhancement. Parsing tree matching combined with adaptive thresholds achieves detection in seconds, and unmatched logs trigger online updates to enhance system adaptability. Aggregate context and high-frequency parameters to construct dynamic prompt words for multi-dimensional root cause analysis, and combine prompt words to drive template optimization mechanism, significantly improving the level of intelligent operation and maintenance and reducing the burden of manual maintenance.

[0009] Preferably, the input of the large model for abnormal judgment and marking of template labels specifically includes: constructing prompt words containing the content of the log template, searching the knowledge base with template semantics, embedding related domain knowledge into the prompt words and inputting them into the large model; outputting normal or abnormal labels and confidence levels and storing them, introducing manual verification, and optimizing the judgment accuracy of the large model based on feedback; if the large model identifies a misjudgment pattern, automatically generating template correction instructions including adding semantic remarks and adding context verification rules, and upgrading the template matching to the semantic layer.

[0010] Constructing prompt word embedding retrieval of power dispatching domain knowledge, allowing the large model to integrate historical fault cases and other professional knowledge to improve judgment accuracy. The manual verification feedback mechanism can continuously optimize the model to reduce misjudgments. When a misjudgment is identified, instructions for adding semantic remarks and context verification rules are automatically generated to realize the upgrade of template matching to the semantic layer, effectively solving the problem of poor adaptability of traditional methods to new abnormal patterns, and enhancing the system's self-learning ability and stability.

[0011] Preferably, the dynamic prompt word construction combining the retrieval results and the template feature weights specifically includes: automatically selecting the prompt word template according to the log type, wherein the network layer log adopts the network layer analysis template, and the system log adopts the application layer template; the prompt word template embeds high-frequency parameter values ​​and abnormal times and context log information, and enhances the large model input by retrieving the domain knowledge associated with the vector knowledge base; and adding a template abnormality weight coefficient to the prompt word template, which is calculated based on the historical abnormality rate, to guide the large model to prioritize the analysis of high-frequency abnormal templates.

[0012] Automatically select dedicated templates according to log type to adapt to the multi-source log characteristics of the power dispatching system and improve the targeted analysis; embed high-frequency parameter values, abnormality times and contextual information, combine with vector knowledge base retrieval to enhance input, and integrate large models with professional knowledge such as equipment specifications to avoid misjudgment; weight coefficients calculated based on historical abnormality rates guide the priority processing of high-frequency abnormality templates, achieve optimal resource allocation, and significantly reduce processing delays.

[0013] Preferably, the online template update includes: triggering a new template generation process for unmatched logs, caching them in a pending state, and limiting the frequency of participation in matching; updating the parsing tree and template library through timed loop matching, and recording matching failure modes to automatically correct the adaptive threshold model.

[0014] Unmatched logs trigger the generation of new templates and cache them in a pending state, which is combined with matching frequency limits to avoid resource waste. The timed loop matching mechanism continuously updates the parsing tree and template library to achieve dynamic optimization of the template library. The matching failure mode is recorded to automatically correct the adaptive threshold model, effectively solving the problem of missed reports and false alarms caused by fluctuations in log volume, and improving the stability of the system in complex environments.

[0015] Preferably, the multi-dimensional root cause analysis specifically includes: adopting a two-stage hierarchical architecture, including a quick classification stage and a deep analysis stage; the quick classification stage includes using lightweight prompt words for preliminary analysis, embedding key fields of the exception log and knowledge base retrieval results, and outputting preliminary exception classification by the large model; the deep analysis stage includes aggregating exception logs by template ID, counting the number of exceptions and high-frequency dynamic parameters within the time window, associating the context log sequence of the same device or task, constructing multi-dimensional prompt word structured output instructions, retrieving domain knowledge associated with key entities, injecting prompt words and analyzing the root causes of each dimension in parallel, summarizing the conclusions of each dimension, and inputting the large model to generate a comprehensive fault report.

[0016] The two-stage design optimizes resource allocation. In the rapid classification stage, lightweight prompt words are embedded in key fields to achieve a response within seconds. In the deep analysis stage, logs are aggregated by template ID, contextualized, and knowledge from dimensions such as equipment failures is injected to perform parallel root cause analysis, generating structured fault reports with time spans and abnormal causes. The overall process significantly enhances decision-making support capabilities, assisting operations and maintenance personnel in quickly and accurately locating problems.

[0017] Preferably, the method of constructing a fixed-depth parse tree using historical log data specifically includes: preprocessing the historical log data, replacing dynamic content with a unified identifier using a regular expression, constructing a parse tree based on the number of segmentations and leading words, and storing candidate templates in leaf nodes.

[0018] A fixed-depth parsing tree is constructed based on the number of segmented words and leading words, and the leaf nodes store candidate templates. This creates an efficient retrieval structure to avoid branch explosion and provide a high-accuracy basic library for real-time matching.

[0019] Preferably, the prompt word driven template mechanism specifically includes: when the large model is automatically executed through dynamic prompt word recognition misjudgment, adding semantic remarks in the template library, and adding context verification rules in the template matching stage.

[0020] When a large model identifies a misjudgment, it automatically adds semantic annotations and upgrades template matching to the semantic layer, effectively solving the difficulties of manually maintaining the rule base and continuously improving the reliability of anomaly detection through a self-learning mechanism.

[0021] Preferably, the parse tree matching template library specifically includes: selecting the corresponding branch of the first layer of the parse tree according to the number of word segments after real-time log preprocessing; matching nodes layer by layer according to the first several words of the log, and automatically matching dynamic words with wildcard nodes; after reaching a leaf node, extracting all candidate templates stored under the node.

[0022] The first-level branches are located based on the number of segmented words, and the leading words are matched layer by layer with the dynamic word wildcard mechanism to achieve fast screening; the leaf nodes extract candidate templates to complete positioning in seconds, supporting high-throughput processing requirements.

[0023] Preferably, the word segmentation similarity specifically includes: comparing each word position of the log message with the candidate template, and for the total number of words after preprocessing of the log message, comparing position by position from the first word position to the last word position, and checking at each position whether the log word is equal to the template word: if equal, assigning a contribution value of 1 to the position; if not equal, assigning a contribution value of 0 to the position; calculating the sum of the contribution values ​​of all positions, dividing the sum by the total number of words to obtain a similarity value, which ranges from 0 to 1, where 0 indicates a complete mismatch and 1 indicates a complete match.

[0024] The word-by-word position comparison assigns a contribution value of 01, and the sum is divided by the total number of words to generate an objective similarity index, which supports dynamic threshold determination and real-time matching requirements, significantly improving detection reliability.

[0025] Preferably, the adaptive threshold strategy includes: the initial similarity threshold is set to 0.4, when the real-time log generation rate exceeds 5 / second, the threshold is reduced by 0.1 for every increase of 5 / second, the minimum threshold is not less than 0.1, and the sensitivity is dynamically adjusted according to the system operation load.

[0026] Compared with the prior art, the present invention has the following beneficial effects.

[0027] 1. This invention completely gets rid of the burden of manual rule maintenance through a fixed-depth parse tree and an online template update mechanism. Based on the collaborative analysis of the domain knowledge vector library and the large model, it breaks through the limitations of the weak generalization ability of traditional methods. The parse tree matching is combined with the adaptive threshold strategy to achieve a response in seconds, solving the bottleneck of real-time detection speed. Dynamic prompt words are injected into the power dispatching professional knowledge to make up for the lack of domain knowledge in the general model, significantly improving the detection automation level and system stability, and meeting the high reliability requirements of the power system.

[0028] 2. This invention builds a knowledge-enhanced analysis framework, embedding domain knowledge through template semantic retrieval, significantly improving the judgment accuracy of large models. It adopts a dynamic prompt-driven mechanism to automatically select analysis templates based on log type, embed high-frequency parameters and weight coefficients, and prioritize high-risk anomalies. Through a layered root cause analysis architecture, two-stage processing achieves parallel classification and in-depth diagnosis in seconds, generating structured fault reports with time spans, achieving a balance between high precision and high efficiency.

[0029] 3. The online template update mechanism of the present invention captures new log patterns in real time, balances resources by caching pending logs and matching frequency limits, automatically upgrades semantic layer rules for false positives, continuously optimizes template library accuracy, and dynamically adjusts the adaptive threshold model with the log rate. Combined with system load optimization sensitivity, it ultimately significantly reduces the operation and maintenance burden, generates comprehensive fault reports to directly guide decision-making, and significantly improves power system availability. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is an overall flow chart of a method for detecting anomalies in a power dispatching automation system log according to the present invention.

[0031] Figure 2 This is a specific flow chart of a method for detecting abnormalities in a power dispatching automation system log according to the present invention.

[0032] Figure 3 This is an architectural diagram of a method for detecting anomalies in a power dispatching automation system log according to the present invention. DETAILED DESCRIPTION

[0033] To make the objectives, technical solutions, and advantages of the present disclosure more apparent, embodiments of the present disclosure are described in further detail below with reference to the accompanying drawings. The proportions of the components herein are not drawn to scale, and the proportions and dimensions shown in the accompanying drawings are not intended to limit the essential technical solutions of the present disclosure. These embodiments do not describe all details in detail, nor do they limit the present disclosure to the specific embodiments described.

[0034] See also Figure 1-3 As shown, a method for detecting abnormalities in a power dispatching automation system log includes: A fixed-depth parsing tree is constructed from historical log data, and log templates are extracted based on word segmentation similarity. Knowledge in the power dispatching field is converted into vectors and stored in the knowledge base. Retrieve domain knowledge from the knowledge base of the log template, input it into the big model to perform anomaly judgment and mark the template tag; After real-time log preprocessing, the template tag is inherited through the parsing tree matching template library and adaptive threshold strategy, triggering online template updates for unmatched logs; Aggregate the context and high-frequency parameters of abnormal logs, combine the search results and template feature weights to build dynamic prompt words, input into the large model for multi-dimensional root cause analysis, and drive template mechanism optimization based on the prompt words.

[0035] The present invention collects historical log data of the electric power dispatching automation system, performs data preprocessing, feature extraction and selection, and uses intelligent template matching technology and a large model enhanced with domain knowledge to perform anomaly judgment and analysis, thereby achieving effective detection and positioning of log anomalies. The present invention performs preliminary anomaly detection through a log template library and a template matching algorithm, and calls the knowledge-enhanced large model for further analysis based on the detection results to ensure accurate identification and classification of anomalies. During operation, by storing historical data in a vector knowledge library and a real-time update template library, the log pattern features are gradually optimized, thereby achieving anomaly monitoring of real-time log data. Overall, the present invention improves the efficiency and automation level of log anomaly detection in the electric power dispatching automation system through the combination of intelligent template matching and a large language model.

[0036] like Figure 1 In one embodiment shown, Figure 1 This is a flowchart of the overall method for detecting anomalies in the logs of an electric power dispatch automation system. First, a fixed-depth parse tree is constructed using historical log data. The method preprocesses the historical log data, replaces dynamic content with uniform identifiers using regular expressions, and constructs a parse tree based on the number of segmented words and leading words. Leaf nodes store candidate templates. Simultaneously, knowledge in the electric power dispatching field is converted into vectors and stored in a knowledge base.

[0037] Next, template anomaly annotation is performed: the knowledge base for the log template is searched for domain knowledge associated with it, prompt words are constructed to capture the log template content, the knowledge base is searched using template semantics, and the associated domain knowledge is embedded in the prompt words and fed into the large model. Labels of normal or abnormal data and their confidence levels are output and stored, and manual verification is introduced to optimize the accuracy of the large model's judgments. If the large model identifies an incorrect pattern, template correction instructions are automatically generated to add semantic annotations and contextual verification rules, upgrading the template matching to the semantic layer.

[0038] Next, the real-time logs are processed: After preprocessing the real-time logs, the corresponding branch in the first level of the parse tree is selected based on the number of tokens in the preprocessed logs. Nodes are matched layer by layer based on the first few words in the logs, with dynamic words automatically matching wildcard nodes. Upon reaching a leaf node, all stored candidate templates are extracted. Template tags are inherited using an adaptive threshold strategy—the initial similarity threshold is 0.4. When the real-time log generation rate exceeds 5 logs per second, the threshold decreases by 0.1 for every 5 logs per second, with a minimum of 0.1. The sensitivity is dynamically adjusted based on system load.

[0039] For unmatched logs: trigger the online template update process, cache it as a pending state and limit the frequency of participation in matching; update the parsing tree and template library through timed loop matching, and record the matching failure mode to automatically correct the adaptive threshold model.

[0040] Finally, a multi-dimensional root cause analysis is performed: a two-stage hierarchical architecture is adopted. In the rapid classification stage, lightweight prompt words are used to embed the key fields of the exception log and the knowledge base retrieval results, and the large model outputs the preliminary exception classification; in the deep analysis stage, the exception logs are aggregated by template ID, the number of exceptions and high-frequency dynamic parameters in the time window are counted, the context log sequence of the same device or task is associated, and a multi-dimensional prompt word structured output instruction is constructed. The domain knowledge associated with key entities is retrieved and the prompt words are injected. The root causes of each dimension are analyzed in parallel and the conclusions are summarized. The input is then input into the large model to generate a comprehensive fault report.

[0041] During this process, when the large model misidentifies through dynamic prompt words, the prompt word driven template mechanism is automatically executed: semantic comments are added to the template library, and context verification rules are added in the template matching stage.

[0042] like Figure 2 In one embodiment shown, Figure 2 This is a detailed flowchart of a method for detecting anomalies in logs of a power dispatch automation system, according to the present invention. This diagram illustrates the actual operational flow of the present invention. The dashed line represents the preparatory steps before actual operation, encompassing the process of extracting log templates from historical data and anomaly annotation based on the templates. The solid line represents the actual operational process, where real-time logs undergo preprocessing, template matching, anomaly tagging, information statistics, and aggregation before being analyzed by a large model to produce an analysis report.

[0043] In this embodiment, the method designed by the present invention includes the following steps: S1, log template extraction; S2. Establishment of knowledge base for power dispatching automation; S3, template-based abnormality judgment; S4, log template matching and updating; S5. Collaborative analysis of large models.

[0044] Among them, the specific steps of S1 include: Step 1: Historical data collection Collect historical log data from the power automation system's operational records. This data includes, but is not limited to, equipment operating status, alarm information, maintenance logs, and system events. The collected data should cover system performance under different operating conditions to ensure that the generated log templates accurately reflect various normal operating modes. During data collection, log data must be preprocessed, including removing redundant information, formatting standardization, and timestamp correction. This provides a high-quality data foundation for subsequent template generation and anomaly detection.

[0045] Step 2: Data preprocessing Before extracting log templates, logs need to be preprocessed to improve the efficiency and accuracy of subsequent processing. Specific operations include: (1) Removing structured information: such as timestamp, host name, log level, etc. This information is usually fixed in the log. Removing it can reduce noise and improve the accuracy of template extraction.

[0046] (2) Word segmentation: split the log message into words or symbols for subsequent processing.

[0047] (3) Regular expression replacement: Use simple regular expressions to replace dynamic parts in the log, such as IP addresses, numbers, etc., to unify the representation of these dynamic parts.

[0048] Step 3: Build a fixed depth parse tree This step constructs a tree structure of fixed depth for subsequent log parsing. Each node represents a feature of the log message, and the leaf node represents the log template. The root node of the tree represents all log messages. The middle layer nodes filter log messages according to the rules. The leaf nodes of the tree store candidate log templates. For deep parsing trees, it is necessary to limit their depth and the maximum number of child nodes to prevent the tree from becoming too large and exploding with branches. Each candidate log template has a unique ID corresponding to it.

[0049] Step 4: Hierarchical search log template First, we perform a first-level filter based on the length of the log message. This involves selecting the corresponding branch based on the number of tokens in the preprocessed log. We then perform a second-level filter based on the leading word. This involves selecting the branch based on the tokens in the first d-2 positions of the log message, where d represents the depth of the tree. If the current word contains a number, it may be a numeric value or an identifier. In this case, a special node "*" is set to match it to prevent branch explosion.

[0050] Step 5: Match templates based on word segmentation similarity Similarity calculation: For each log that needs to be matched, we first filter it according to the parse tree. After reaching a leaf node, we obtain all candidate log groups (i.e., existing log templates) under that node. We traverse each candidate log group and calculate the similarity between the current preprocessed log message and the template for that log group. Calculating the similarity between the log message and the template requires position-by-position comparison. The formula for calculating similarity is as follows: The similarity value simSeq is equal to, starting from position index i equal to 1 and ending at position index i equal to n (n represents the total number of words in the log message after preprocessing), calculating the value of the equ function for each position i; The input parameters of the equ function are tlog(i) and ttemplate(i) (tlog(i) represents the i-th word of the log message, and ttemplate(i) represents the i-th word of the candidate template); The output rule of the equ function is: when tlog(i) is equal to ttemplate(i), return 1; otherwise, return 0; Sum the output values ​​of the equ function at all positions i above; Finally, the sum is divided by the total number of words n to obtain the similarity value simSeq, which ranges from 0 to 1.

[0051] According to the similarity formula, the words in the log information and the template are compared position by position, the number of identical words is counted, and the number of identical words is divided by the total number of words to obtain the similarity value simSeq∈[0,1].

[0052] Template matching After similarity calculation, the log template with the highest simSeq value matching the current log is selected from all candidate log templates. This is the template with the highest matching degree. If the highest simSeq value is greater than or equal to the preset threshold, the match is considered successful. If the simSeq values ​​of all candidate log templates are less than the preset threshold, the match is considered unsuccessful.

[0053] (3) Template update After template matching is completed, the log group needs to be updated according to the matching results.

[0054] If the template is successfully matched, the current log ID is first added to the log ID list of the matching log group. Then, the log template is updated position by position and the templates are merged. The rules are as follows: If tlog(i)=ttemplate(i), keep the original template markup.

[0055] If tlog(i)≠ttemplate(i), replace the word in the template with the wildcard character "*".

[0056] If the template matching fails, the preprocessing result of the current log message is used as the new template, and the parse tree is updated: in the path from the root node to the leaf node, the nodes are updated according to the rules. If a node is missing in the path, it is automatically created. If the word in the path contains a number, a special node "*" is inserted to avoid branch explosion.

[0057] Among them, the specific steps of S2 include: Step 1: Collect and organize domain knowledge Collect domain knowledge related to the power dispatch automation system from sources such as equipment operating manuals, operation and maintenance work instructions, historical fault case reports, system design documents, expert experience, and S5 analysis results. Clean and organize the collected unstructured and semi-structured documents, extract key information, and structure them into formats such as question-and-answer pairs, factual descriptions, and fault handling procedures to facilitate model learning and retrieval.

[0058] Step 2: Knowledge Text Vectorization Text embedding technology is used to convert the organized structured knowledge items into high-dimensional vector representations. Each vector contains the semantic information of the corresponding knowledge text.

[0059] Step 3: Vector knowledge base construction The vectors corresponding to all knowledge texts are stored in a dedicated vector database. This database supports efficient similarity retrieval, quickly finding the semantically closest knowledge vector based on the input query vector, and then returning the relevant original knowledge text. This knowledge base will be used to enhance the analytical capabilities of the large model in subsequent steps.

[0060] The specific steps of S3 include: Step 1: Template-level log prompt construction The log template extracted in step S1 is semantically represented to construct a text form suitable for large-scale model input. Using prompt engineering, the log template is embedded in specific prompts to guide the large-scale model's understanding and analysis. The following prompts are used to determine anomalies: The following is a log template generated by the power automation system: {Log template content} Please judge the abnormality of the log represented by the log template based on its semantic content, classify it as "normal" or "abnormal", and attach a confidence level. ".

[0061] Step 2: Knowledge base-based retrieval enhancement The content of the log template is used as a query to perform similarity search in the power dispatch automation vector knowledge base built by S2 to find the domain knowledge most relevant to the semantics of the template.

[0062] Step 3: Abnormal judgment based on large model with knowledge enhancement The original log template and the domain knowledge retrieved in the previous step are embedded into the input. This enhanced prompt, which includes additional domain knowledge, is then fed into the pre-trained large language model. This approach provides the large model with critical contextual information, enabling it to perform reasoning and analysis based on domain knowledge, more accurately determining whether the template has potential anomaly risks and assigning a judgment label (abnormal or normal).

[0063] Step 3: Abnormal template marking and storage The template is marked according to the obtained judgment tag, and the original template ID, log template content, abnormal judgment result and template parsing tree are stored together as a reference for subsequent abnormal log judgment.

[0064] Among them, the specific steps of S4 include: Step 1: Real-time log preprocessing According to the preprocessing rules predefined in S1 (removing structured information, regularizing dynamic content, and word segmentation), real-time logs are standardized to ensure format consistency with historical templates.

[0065] Step 2: Quick screening of the parse tree Based on the fixed-depth parsing tree built by S1, candidate templates are quickly located using the following rules: (1) Length matching: Select the first-level branch of the parse tree based on the number of log words.

[0066] (2) Leading word matching: Match the parse tree nodes according to the first N words in the log (N is the tree depth). Dynamic words (numbers / IP, etc.) automatically match the wildcard "*" node.

[0067] (3) Obtaining the leaf node candidate set: When reaching a leaf node, extract all candidate templates under the node.

[0068] Step 3: Dynamic similarity calculation and threshold determination Similarity calculation: Based on the word-by-word comparison of S1, dynamic weighting is introduced to assign higher weights to key positions (operation words, error codes) to improve the accuracy of core semantic matching.

[0069] Adaptive threshold adjustment: Dynamically adjust the matching threshold based on the power system operating status (peak / maintenance period), taking into account matching efficiency while avoiding missing critical anomalies.

[0070] Step 4: Online learning of unmatched logs Parsing tree and template library update: The template generation process of S1 is triggered only for unmatched logs, and a loop wait is entered to periodically match again with the template library.

[0071] Temporary template cache: Before a new template is judged, it is marked as "pending judgment" and its frequency of participation in matching is limited until the large model completes the judgment and performs online learning to update the template library in real time.

[0072] Online learning and threshold feedback: Match failure logs and their contextual information are used as input for online learning to continuously optimize the template library. The frequency and patterns of match failures are also recorded and analyzed. If the failure rate remains high under specific operating conditions, the adaptive threshold model is automatically modified (coefficient adjustment) to form a closed feedback loop, improving the system's adaptability to new patterns.

[0073] Step 5: Abnormal label output If a match is successful, the template's predicted label (normal / abnormal) in S3 is directly inherited without repeated analysis. After the abnormal label is associated with the log, it is pushed to the alarm system in real time.

[0074] The specific steps of S5 include: Step 1: Dynamic prompt word construction First, real-time logs marked as "anomaly" in S3 are grouped by matching template IDs. The occurrence count of each anomaly template within the most recent time window is counted. Dynamic fields in the logs are extracted, and high-frequency or outlier values ​​are counted. The template ID, number of anomalies, high-frequency parameters, and number of occurrences are recorded as auxiliary data. Combined with device topology information, anomaly logs from the same device or multiple devices with direct upstream and downstream relationships are correlated and incorporated into the log context. Regular expression matching is used to obtain some dynamic fields (such as the same IP address, task ID, session ID), and anomaly logs containing the same dynamic fields are correlated and incorporated into the log context. For each anomaly log, the system dynamically selects and constructs a prompt template based on its type (e.g., network layer log, SCADA system log, etc.). Ancillary data related to the log and a fixed number of log data preceding it are used as context and input into the corresponding prompt template along with the original log text. In some cases, a template anomaly weight coefficient (calculated based on the template's historical anomaly rate in S3) is added to guide the model to prioritize high-frequency anomaly templates. The following is the structure used for the combination of a single anomaly log message: "Exception log {serial number} {log timestamp} {log information} Log category template: {Log template content}; Log source: {Log type}; This type of exception has recently occurred {number of exceptions} times, of which the parameter {high-frequency parameter} has appeared {number of high-frequency parameters} times.

[0075] Before this exception, the following logs appeared: {log context information}".

[0076] Step 2: Multi-angle collaborative anomaly analysis After a certain amount or a certain period of time of abnormal logs are accumulated, the abnormal logs combined with relevant information are embedded with prompt words in the following way: The following are potential abnormal logs that have recently appeared in the power automation system. Please use the relevant information provided to determine whether there are any abnormalities in the power automation system recently, and analyze the most likely causes of the abnormal logs from the {dimension} level.

[0077] {Log 1 Information} {Log 2 Information} {...} Please output in the following format: Time span: [year-month-day hour:minute:second - hour:minute:second] Power automation system status: [Abnormal / Normal] Abnormal reason: According to [log content and information], you can see [device] [abnormal reason]. ”

[0078] Where {dimension} is (device failure, network failure, application failure, etc.). The system then extracts key entities from the exception log (such as device name, IP address, task ID, etc.) as query conditions and retrieves detailed domain knowledge related to these entities from the vector knowledge base built by S2. The retrieved knowledge (for example, common failure modes of a device, functional descriptions of an application module, etc.) is combined with the summarized exception log information into prompt words. The prompt words are input into the model in parallel to draw conclusions for the corresponding analysis dimensions. These conclusions are summarized and spliced ​​into the following prompt words: The following are potential abnormality logs that have recently appeared in the power automation system. Please comprehensively determine whether there are any abnormalities in the power automation system based on the relevant information provided and various abnormality judgments and analyses. Summarize and analyze the most likely causes of the abnormality logs.

[0079] {Log 1 Information} {Log 2 Information} {...} ## Equipment failure dimension analysis conclusion: {Analysis conclusion of equipment failure model} ## Conclusion of network failure dimension analysis: {Analysis conclusion of network failure model} ... {...} Please output in the following format: Time span: [year-month-day hour:minute:second - hour:minute:second] Power automation system status: [Abnormal / Normal] Abnormal reason: According to [log content and information], it can be seen that [device] has [fault dimension], and the reason is [abnormal reason]. ”

[0080] In another embodiment, the multi-dimensional analysis is divided into two stages: The first stage is rapid anomaly classification, which uses lightweight prompt words. The prompt words only contain the key fields of the anomaly log (device name, IP address, task ID) and related domain knowledge retrieved from the vector knowledge base; the second stage is deep root cause analysis enhanced prompt words, which include context and multi-dimensional evidence.

[0081] The prompt is re-entered into the big model, which summarizes and produces the final analysis results. When the big model detects a misjudgment of a certain type of anomaly through dynamic prompt words (such as misjudging "network delay jitter" as "equipment failure"), it automatically generates template correction instructions: Add semantic comments to the log template in the S1 template library (such as "need to distinguish network / device context"), Add context verification rules to the template matching stage of S4, upgrading template matching from the syntax level to the semantic level.

[0082] Step 3: Exception report output Extract key information from the large model output according to a predefined format, including the time when potential abnormal logs appear, the assessed power automation system status, abnormal equipment and the cause of the abnormality. The extracted structured data is combined with the original output of the large model into an abnormality report and stored, reminding and assisting operation and maintenance personnel in troubleshooting.

[0083] like Figure 3 In one embodiment shown, Figure 3 This is an architectural diagram of a method for detecting anomalies in a power dispatching automation system log. To solve the above technical problems, the present invention provides a method for detecting anomalies in a power dispatching automation system log based on intelligent templates and large model knowledge enhancement. Figure 3 As shown in the figure, by maintaining and updating the domain vector knowledge enhancement model, the power dispatching automation system log is judged and analyzed for abnormalities, and the real-time updated intelligent log template matching method is used to make preliminary judgments on log abnormalities, while taking into account the detection accuracy and improving the detection speed.

[0084] Figure 3The core concept and workflow of the present invention are presented in detail. The entire system is built around a large model for automated log analysis of power dispatching, and is divided into two stages: offline preparation and online operation. The offline preparation stage mainly involves preprocessing the model and knowledge. On the one hand, templates are extracted from historical logs to form a log template library, and the large model completes the anomaly labeling work. On the other hand, the power dispatching knowledge is vectorized and constructed into a power dispatching vector knowledge base. The knowledge base injects professional domain knowledge into the central large model through retrieval enhancement. The online operation stage performs real-time processing of business logs. After the real-time log enters the system, it is first matched with the log template library for template matching. If the match is successful, it indicates that there may be an event with a known pattern. The system will trigger the abnormal log analysis process and finally generate a structured analysis report through in-depth interaction with the power dispatching operation and maintenance knowledge base. Otherwise, it means that a new log pattern has appeared, and the system will generate a new template, thereby realizing online learning and adaptation of unknown patterns.

[0085] In this embodiment, the present invention specifically includes: 1. Log template library construction In this step, historical log data from the power automation system is first collected. This data includes equipment operating status, alarm information, maintenance logs, and system events, ensuring that the data encompasses log patterns from various operating scenarios. To ensure the accuracy of template matching and anomaly detection, the collected data covers system performance under different operating conditions, with a weekly historical data collection cycle. During data collection, data preprocessing is performed, including removing redundant information, standardizing the format, and correcting timestamps. This provides a high-quality data foundation for subsequent template generation and anomaly detection. This process involves removing structured information such as timestamps, hostnames, and log levels. Natural language processing tools are used to segment log messages into word and symbol sequences, and regular expressions are used to replace predefined dynamic components (e.g., converting IP addresses and numbers to [IP] and [NUM]). A fixed-depth parse tree is constructed from the log data, and log templates are extracted. A series of candidate log templates are generated through layer-by-layer screening and word segmentation similarity matching. Template matching is achieved by calculating similarity. If a log's similarity exceeds a preset threshold (default 0.4), the log is considered a successful match to the corresponding template. For logs that fail to match, new template generation rules are used to update the parsing tree and template library, gradually optimizing the accuracy and completeness of the template library.

[0086] 2. Construction of domain knowledge base Collect system-related domain knowledge, such as equipment manuals, historical failure cases, and maintenance guides, to prepare for building a knowledge base. This collected domain knowledge is processed, converted into vectors using text embedding technology, and stored in a vector database. This knowledge base supports efficient semantic retrieval and provides domain knowledge support for subsequent large-scale model analysis.

[0087] 2. Abnormal judgment based on templates and knowledge enhancement For each log template extracted in the first phase, the system first uses its semantic content to search for relevant background knowledge within the established vector knowledge base. The log template and the retrieved domain knowledge are combined into a single prompt and fed into a pre-trained large language model. Based on this information, the model determines whether the log event represented by the template is "normal" or "abnormal." Each template is assigned an abnormal label and stored. Furthermore, a manual verification and feedback correction mechanism is introduced to optimize the model's judgment accuracy. Abnormal results are marked and stored to provide reference for subsequent log matching.

[0088] 3. Real-time log matching and online learning When the system is running, the logs generated in real time will go through the same preprocessing process as historical data. Subsequently, the constructed parse tree is used for rapid screening and the similarity with the candidate template is calculated. On this basis, the system adopts an adaptive threshold strategy (based on the log generation speed, the initial setting is 0.4. When the log exceeds 5 logs / s, the threshold is reduced by 0.1 for every 5 logs, and the minimum threshold is 0.1). It dynamically adjusts the matching threshold to avoid false positives and missed negatives during peak periods. If the real-time log successfully matches a template, it will directly inherit the existing "normal" or "abnormal" label of the template. For logs that fail to match, the system will trigger a new template generation process and temporarily cache it in the "pending judgment" state, waiting to enter the subsequent loop judgment.

[0089] 4. Dynamic prompt word construction This step aims to dynamically generate prompt word templates based on different log types and analysis requirements, thereby improving the relevance and accuracy of the large-scale model's analysis. Logs marked as abnormal are first submitted to the large-scale model for preliminary analysis in conjunction with the knowledge base. The model automatically identifies the log type based on its source and content and invokes pre-defined dynamic prompt word templates. For example, a network-layer analysis template is used for network-layer logs, and an application-layer template is used for SCADA systems. The prompt word templates contain variable parameters that are populated based on real-time log information (such as log template content, number of abnormalities, and high-frequency parameters). During multi-dimensional collaborative analysis, the prompt word templates are dynamically adjusted based on the analysis dimension (such as device failure, network failure, and application failure), guiding the large-scale model to conduct attribution analysis from a specific perspective. Simultaneously, the system uses key information from the log template or abnormal log as a query to search the vector knowledge base for relevant domain knowledge. This retrieved knowledge is integrated into the prompt word along with the original log information to enhance the large-scale model's analytical capabilities.

[0090] 5. Collaborative analysis and report generation of large models The system groups recently marked "anomaly" logs by their template IDs and collects key information, including the number of occurrences of this type of anomaly within a specific time window, frequently occurring dynamic parameter values ​​within the logs, and contextual log information preceding the anomaly. Before conducting in-depth analysis, the system extracts key information from the anomaly logs (such as device name and task ID) and searches the vector knowledge base for relevant domain knowledge. The system then integrates the original anomaly logs, aggregated statistical data, contextual information, and domain knowledge retrieved from the knowledge base into a structured prompt word template. These enhanced prompt words are fed into the large model, guiding it to conduct attribution analysis across multiple dimensions, such as device failure and network issues. The conclusions from each dimension are aggregated to ultimately derive a comprehensive, most likely anomaly cause. Based on the final output of the large model, the system automatically extracts key information (such as the time of the failure, affected device, and root cause), generates a structured anomaly report, and delivers it to operations and maintenance personnel in real time, supporting rapid troubleshooting and decision-making.

[0091] The power dispatching automation system log anomaly detection method proposed in this invention, based on intelligent templates and large model knowledge enhancement, combines efficient template matching technology with the deep reasoning capability of large models infused with domain knowledge, thus bringing about a qualitative improvement in the accuracy and intelligence level of power system log monitoring.

[0092] Its core innovations and advantages are: ① Rapid abnormal log detection based on intelligent templates: The core of this invention is "template analysis first, then log matching." The system completes offline analysis and characterization of log templates. During real-time monitoring, only efficient template matching is required to inherit the predicted results. This architecture decouples the high cost of large-scale model inference from the demanding real-time detection requirements. This ensures high detection efficiency and immediate response capabilities when dealing with the large amounts of real-time data generated by power dispatch automation systems.

[0093] ② High-precision anomaly detection based on a knowledge base in the power dispatching domain: To address the lack of domain knowledge and low accuracy of general large-scale models, this invention incorporates a knowledge base in the power dispatching automation domain. When pre-judging log templates, the large-scale model no longer performs independent analysis. Instead, it first retrieves relevant domain knowledge (such as equipment specifications, normal operating conditions, and historical faults) from the knowledge base and then combines this precise contextual information for comprehensive analysis. This knowledge-enhanced mechanism provides a more robust basis for the model's judgments, significantly improving its understanding and accuracy of specialized power logs.

[0094] ③ Deep aggregation and multi-dimensional analysis based on a large model: In the final anomaly analysis phase, this invention again leverages the knowledge base and log context for enhanced analysis. By aggregating contextual information from anomaly logs and retrieving detailed data and historical behavior patterns of related devices from the knowledge base, the large model enables deeper, multi-dimensional collaborative analysis. This not only enables anomaly detection but also provides logically rigorous and highly reliable root cause analysis reports, providing precise decision support for operations and maintenance personnel.

[0095] ④ Online Adaptability: The system features a comprehensive online learning mechanism. For new logs that cannot be matched, it automatically triggers the generation and update of new templates. Furthermore, the introduction of an adaptive threshold matching strategy dynamically adjusts the matching sensitivity based on system load, effectively addressing fluctuations in log volume and ensuring the method's stability and continuous adaptability in complex and changing real-world environments.

[0096] The present invention is not limited to the above-mentioned embodiments. Regardless of any changes in shape or material composition, any structural design provided by the present invention is a variation of the present invention and should be considered within the scope of protection of the present invention.

Claims

1. A method for detecting abnormalities in a power dispatching automation system log, characterized in that: include: Build a fixed-depth parsing tree from historical log data and extract log templates based on word segmentation similarity; Convert the knowledge in the field of power dispatching into vectors and store them in the knowledge base; Retrieve domain knowledge from the knowledge base of the log template, input it into the big model to perform anomaly judgment and mark the template label; After real-time log preprocessing, the template tag is inherited through the parsing tree matching template library and adaptive threshold strategy, triggering online template updates for unmatched logs; Aggregate the context and high-frequency parameters of abnormal logs, combine the search results and template feature weights to build dynamic prompt words, input into the large model for multi-dimensional root cause analysis, and drive template mechanism optimization based on the prompt words.

2. A method for detecting abnormality in a power dispatching automation system log according to claim 1, characterized in that: The input of the large model for abnormal judgment and marking of template tags specifically includes: constructing a prompt word containing the log template content, searching the knowledge base with template semantics, embedding related domain knowledge into the prompt word and inputting it into the large model; outputting normal or abnormal labels and confidence levels and storing them, introducing manual verification, and optimizing the judgment accuracy of the large model based on feedback; if the large model identifies a misjudgment pattern, automatically generating template correction instructions including adding semantic remarks and adding context verification rules, and upgrading the template matching to the semantic layer.

3. A method for detecting abnormality in a power dispatching automation system log according to claim 1 or 2, characterized in that: The method of constructing dynamic prompt words by combining retrieval results and template feature weights specifically includes: automatically selecting prompt word templates according to log types, wherein network layer logs use network layer analysis templates, and system logs use application layer templates; embedding high-frequency parameter values, anomaly counts, and contextual log information into prompt word templates, and enhancing large model input by associating domain knowledge through a retrieval vector knowledge base; and adding a template anomaly weight coefficient to the prompt word template, which is calculated based on historical anomaly rates, to guide the large model to prioritize analyzing high-frequency anomaly templates.

4. A method for detecting abnormality in a power dispatching automation system log according to claim 3, characterized in that: The online template update includes: triggering a new template generation process for unmatched logs, caching them in a pending state, and limiting the frequency of participation in matching; updating the parsing tree and template library through timed loop matching, and recording matching failure modes to automatically correct the adaptive threshold model.

5. A method for detecting abnormality in a power dispatching automation system log according to claim 4, characterized in that: The multi-dimensional root cause analysis specifically includes: adopting a two-stage hierarchical architecture, including a rapid classification stage and a deep analysis stage; the rapid classification stage includes using lightweight prompt words for preliminary analysis, embedding key fields of the exception log and knowledge base retrieval results, and outputting preliminary exception classification by the large model; the deep analysis stage includes aggregating exception logs by template ID, counting the number of exceptions and high-frequency dynamic parameters within the time window, associating context log sequences of the same device or task, constructing multi-dimensional prompt word structured output instructions, retrieving domain knowledge associated with key entities, injecting prompt words and analyzing the root causes of each dimension in parallel, summarizing the conclusions of each dimension, and inputting the large model to generate a comprehensive fault report.

6. A method for detecting abnormality in a power dispatching automation system log according to claim 1, characterized in that: The method of constructing a fixed-depth parsing tree using historical log data specifically includes: preprocessing the historical log data, replacing dynamic content with a unified identifier using a regular expression, constructing a parsing tree based on the number of segmented words and leading words, and storing candidate templates in leaf nodes.

7. A method for detecting abnormalities in a power dispatching automation system log according to claim 5 or 6, characterized in that: The prompt word driven template mechanism specifically includes: when the large model automatically executes through dynamic prompt word recognition misjudgment, adding semantic remarks in the template library, and adding context verification rules in the template matching stage.

8. A method for detecting abnormality in a power dispatching automation system log according to claim 7, characterized in that: The parse tree matching template library specifically includes: selecting the corresponding branch of the first layer of the parse tree according to the number of word segments after real-time log preprocessing; matching nodes layer by layer according to the first several words of the log, and automatically matching dynamic words with wildcard nodes; after reaching a leaf node, extracting all candidate templates stored under the node.

9. A method for detecting abnormality in a power dispatching automation system log according to claim 8, characterized in that: The word segmentation similarity specifically includes: comparing each word position of the log message and the candidate template, for the total number of words after preprocessing the log message, comparing each position from the first word position to the last word position, and checking at each position whether the log word is equal to the template word: if equal, assigning a contribution value of 1 to the position; if not equal, assigning a contribution value of 0 to the position; calculating the sum of the contribution values ​​of all positions, dividing the sum by the total number of words to obtain a similarity value, which ranges from 0 to 1, where 0 indicates a complete mismatch and 1 indicates a complete match.

10. A method for detecting abnormality in a power dispatching automation system log according to claim 1 or 8, characterized in that: The adaptive threshold strategy includes: the initial similarity threshold is set to 0.4, when the real-time log generation rate exceeds 5 / second, the threshold is reduced by 0.1 for every 5 / second increase, the minimum threshold is not less than 0.1, and the sensitivity is dynamically adjusted according to the system operation load.

Images