A method for detecting log anomalies in a power dispatch automation system

Abstract

This invention relates to the field of electrical digital data processing technology and discloses a method for detecting log anomalies in power dispatch automation systems. The method includes: constructing a fixed-depth parse tree using historical log data and extracting log templates based on word segmentation similarity; converting power dispatch domain knowledge into vectors and storing them in a knowledge base; retrieving knowledge related to the log templates from the knowledge base, inputting it into a large model for anomaly detection, and labeling the templates; after real-time log preprocessing, inheriting template labels by matching the template library with the parse tree and using an adaptive threshold strategy, triggering online template updates for unmatched logs; aggregating the context and high-frequency parameters of the abnormal logs, constructing dynamic prompt words based on the retrieval results and template feature weights, inputting them into a large model for multi-dimensional root cause analysis, and optimizing the template mechanism based on the prompt words. This method solves the problems of difficult manual maintenance, weak generalization ability, and slow detection speed in existing technologies, achieving efficient detection, high accuracy, and adaptability.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of electric digital data processing, and particularly relates to intelligent operation and maintenance of a power dispatching automation system. BACKGROUND

[0002] With the increasing complexity of the power dispatching automation system, especially the gradual replacement of the original Open3000 system by the new generation of power dispatching automation system, the number of various types of logs generated by the power dispatching system has also increased dramatically, making it difficult for operation and maintenance personnel to quickly process the running state, operation logs, and three-remote events of the power dispatching monitoring system. If these log information cannot be analyzed in a timely manner, it may lead to power system failure and even serious impact on the stability of the entire power grid. Therefore, log event detection of the power dispatching monitoring system is of great significance in dispatching and operation.

[0003] There are several methods for anomaly detection as follows: 1) The traditional log anomaly detection method usually adopts a rule-based and feature-based detection method. This method has the ability of rapid detection, but it needs to manually set and update the rule base. New abnormal patterns and fault conditions appear constantly, and it is very difficult to manually maintain the rule base. 2) The log anomaly detection method based on machine learning, such as using DBSCAN for log clustering analysis. This method does not need to configure rules, but when new types of log samples appear, it needs to be retrained, and the generalization ability is weak, and it cannot find new abnormal conditions. 3) The log anomaly detection method based on large models. This method has strong generalization ability, but the detection speed is slow, especially when facing thousands of logs per second of the power dispatching system, it cannot be effectively processed. 4) The log anomaly detection method based on large models + log templates. This method solves the problem of slow log detection speed, and makes use of the generalization ability of large models, but lacks the domain knowledge of the power dispatching system, and the accuracy of the judgment of the power dispatching system logs is low.

[0004] For example, the Chinese patent with publication number CN114048870B discloses an electric power system anomaly monitoring method based on log feature intelligent mining, which provides the following technical solution. The present application discloses an electric power system anomaly monitoring method based on log feature intelligent mining, which comprises the following steps: collecting log data under multiple time spans and multiple scenes and preprocessing to form log data samples; clustering analysis is performed on the log data samples based on the DBSCAN clustering algorithm, the clustering results are obtained, and the Pearson correlation coefficient is used to screen the clustering results to obtain abnormal logs in the log data samples; and the natural language processing technology is used to analyze the abnormal log text, and the analyzed content is fed back to the relevant staff. The present application improves the algorithm based on the machine learning clustering algorithm and the natural language processing technology according to the business scene characteristics and the original algorithm defects, so that the whole process does not need manual intervention, the log information is automatically analyzed, the abnormal detection performance is improved, the abnormal electric power detection can be effectively realized, the automation degree and the inspection efficiency of the electric power inspection are improved, and the manpower and material resources are saved. However, the above-mentioned electric power system anomaly monitoring method based on log feature intelligent mining cannot automatically update the rule base to handle new abnormal patterns, lacks domain knowledge support, especially when the log volume increases sharply, which will result in weak generalization ability, slow detection speed, and low accuracy when facing complex electric power system logs. The patent relies on the DBSCAN clustering algorithm, which is complicated to adjust parameters, cannot adaptively handle unknown faults, and does not integrate real-time context or multi-dimensional analysis, resulting in low operation and maintenance efficiency. SUMMARY

[0005] The present application solves the problems of difficult manual maintenance, weak generalization ability, slow detection speed, and lack of domain knowledge in the prior art, and proposes a detection method for log anomalies in an electric power dispatching automation system, achieving the purposes of efficient detection, high accuracy, and adaptive updating.

[0006] Further, the present application realizes rapid preliminary anomaly detection, effectively reduces the burden of manual rule maintenance, significantly improves the recognition accuracy and second-level response, adaptively updates new log patterns through an online template updating mechanism, enhances system stability, and improves the overall detection automation level and efficiency.

[0007] To achieve the above-mentioned purposes, the present application adopts the following technical solutions:

[0008] A detection method for log anomalies in an electric power dispatching automation system, comprising:

[0009] A fixed-depth parsing tree is constructed from historical log data, and log templates are extracted based on word segmentation similarity; electric power dispatching domain knowledge is converted into a vector and stored in a knowledge base;

[0010] The knowledge base associated with the log template is searched, a large model is input for anomaly judgment and template tag labeling;

[0011] After real-time log preprocessing, the template library is matched by parsing tree and the template label is inherited by adaptive threshold strategy, and online template updating is triggered for unmatched logs;

[0012] The context and high-frequency parameters of aggregated abnormal logs are combined with the search results and template feature weights to build dynamic prompt words, which are input into a large model for multi-dimensional root cause analysis, and the template mechanism is optimized based on the prompt words.

[0013] The offline template analysis and online real-time detection are integrated to significantly improve the efficiency and accuracy of log anomaly detection. A fixed-depth parsing tree and a template based on word segmentation similarity are constructed to ensure efficient generation of a standardized template library. The power dispatching domain knowledge is vectorized for subsequent knowledge enhancement. The adaptive threshold is used to achieve second-level detection. The adaptive system is enhanced by triggering online updates for unmatched logs. The dynamic prompt words are built by aggregating the context and high-frequency parameters for multi-dimensional root cause analysis. The template optimization mechanism is driven by the prompt words, which significantly improves the intelligent level of operation and maintenance and reduces the burden of manual maintenance.

[0014] As a preferred embodiment, the input large model for anomaly judgment and template label marking specifically includes: constructing prompt words containing log template content, retrieving knowledge base based on template semantics, embedding associated domain knowledge into prompt words input into a large model; outputting normal or abnormal labels and confidence and storing, and introducing manual verification to optimize the judgment accuracy of the large model according to feedback; if the large model misjudges, automatically generating template correction instructions including adding semantic notes and increasing context verification rules, and upgrading template matching to the semantic layer.

[0015] The power dispatching domain knowledge is embedded in the prompt word retrieval to make the large model integrate professional knowledge such as historical fault cases to improve the judgment accuracy. The manual verification feedback mechanism can continuously optimize the model to reduce misjudgment. When misjudgment occurs, instructions for adding semantic notes and context verification rules are automatically generated to upgrade template matching to the semantic layer, effectively solving the problem of poor adaptability of traditional methods to new abnormal patterns and enhancing the system's self-learning ability and stability.

[0016] As a preferred embodiment, the dynamic prompt words are built by combining search results and template feature weights, which specifically includes: automatically selecting prompt word templates according to log types, where network layer logs use network layer analysis templates and system logs use application layer templates; the prompt word templates are embedded with high-frequency parameter values, abnormal times, and context log information, and associated domain knowledge is retrieved from the vector knowledge base to enhance the input of the large model; the template abnormal weight coefficient is added in the prompt word template, which is calculated based on the historical abnormal rate to guide the large model to preferentially analyze high-frequency abnormal templates.

[0017] The special template is automatically selected according to the log type, the analysis is targeted to the multi-source log characteristics of the power dispatching system, high-frequency parameter values, abnormal times and context information are embedded, the input is enhanced by combining vector knowledge base retrieval, the large model is combined with professional knowledge such as equipment specifications to avoid misjudgment, the weight coefficient based on the historical abnormal rate is used to guide the priority processing of high-frequency abnormal templates, the resource optimal allocation is realized, and the processing delay is significantly reduced.

[0018] As preferred, the online template updating comprises: triggering a new template generation process for unmatched logs, caching them as a to-be-judged state, and limiting the matching frequency; the parsing tree and template library are updated through a timing cycle matching, and the matching failure mode is recorded to automatically correct the adaptive threshold model.

[0019] The unmatched logs trigger the new template generation and cache the to-be-judged state, and the matching frequency limit is used to avoid resource waste; the parsing tree and template library are continuously updated through a timing cycle matching mechanism, the template library is dynamically optimized, the adaptive threshold model is automatically corrected by recording the matching failure mode, the false alarm and missed alarm problems caused by the fluctuation of log quantity are effectively solved, and the stability of the system in complex environment is improved.

[0020] As preferred, the multi-dimensional root cause analysis specifically comprises: adopting a two-stage hierarchical architecture, including a rapid classification stage and a deep analysis stage; the rapid classification stage comprises using lightweight cues for preliminary analysis, embedding key fields of abnormal logs and knowledge base retrieval results, and outputting preliminary abnormal classification by a large model; the deep analysis stage comprises aggregating abnormal logs according to template ID, counting abnormal times and high-frequency dynamic parameters within a time window, correlating context log sequences of the same device or task, constructing a multi-dimensional cue structured output instruction, retrieving domain knowledge associated with key entities, injecting cues and analyzing each dimension root cause in parallel, summarizing each dimension conclusion, and inputting a large model to generate a comprehensive fault report.

[0021] The two-stage design optimizes resource allocation, the rapid classification stage uses lightweight cues to embed key fields to achieve a response within seconds; the deep analysis stage aggregates logs according to template ID, correlates context and injects device fault and other dimension knowledge for parallel root cause analysis, and generates a structured fault report containing time span and abnormal cause; the overall process significantly improves the decision support capability, and assists the operation and maintenance personnel to quickly and accurately locate the problem.

[0022] As preferred, the fixed-depth parsing tree is constructed by historical log data, specifically comprising: preprocessing the historical log data, replacing dynamic content with a uniform identifier through regular expressions, constructing a parsing tree based on the number of word segmentation and leading words, and storing candidate templates in leaf nodes.

[0023] Based on the number of word segmentation and the leading word, a fixed depth analysis tree is constructed, the leaf node stores the candidate template, an efficient retrieval structure is created to avoid branch explosion, and a high accuracy base library is provided for real-time matching.

[0024] As preferred, the prompt word driven template mechanism specifically comprises: when the large model automatically executes by dynamic prompt word identification error, adding semantic notes in the template library, and increasing context verification rules in the template matching stage.

[0025] When the large model identification error, automatically add semantic notes, upgrade the template matching to the semantic layer, effectively solve the difficulty of artificial maintenance rule library, continuously improve the reliability of abnormal detection through self-learning mechanism.

[0026] As preferred, the analysis tree matching template library specifically comprises: according to the number of word segmentation after real-time log preprocessing, the first layer of the analysis tree corresponding branch is selected; The node is matched layer by layer according to the first several words of the log, and the dynamic word is automatically matched with the wildcard node; After reaching the leaf node, all candidate templates stored under the node are extracted.

[0027] According to the number of word segmentation, the first layer branch is located, the leading word is matched layer by layer, and the dynamic word wildcard mechanism is realized to realize fast screening; The candidate template is extracted from the leaf node to complete the second-level positioning, and the high throughput processing demand is supported.

[0028] As preferred, the word similarity specifically comprises: comparing each word position of the log message and the candidate template, for the total number of words after preprocessing the log message, from the first word position to the last word position, the positions are compared one by one, and at each position, it is checked whether the log word is equal to the template word: if equal, a contribution value of 1 is assigned to the position; If not equal, a contribution value of 0 is assigned to the position; The sum of the contribution values of all positions is calculated, the sum is divided by the total number of words, and a similarity value is obtained, the value range is between 0 and 1, wherein 0 represents complete mismatch, and 1 represents complete match.

[0029] The 01 contribution value is assigned by comparing the word position, the sum is divided by the total number of words to generate an objective similarity index, which supports the dynamic threshold judgment and real-time matching demand, and significantly improves the detection reliability.

[0030] As preferred, the adaptive threshold strategy comprises: the initial similarity threshold is set to 0.4, when the real-time log generation rate exceeds 5 per second, the threshold is reduced by 0.1 for every 5 per second, the minimum threshold is not less than 0.1, and the sensitivity is dynamically adjusted according to the system running load.

[0031] Compared with the prior art, the beneficial effects of the present application are.

[0032] 1.The method for detecting log abnormity of the power dispatch automation system according to the present application completely gets rid of the burden of artificial rule maintenance through the fixed-depth parsing tree and the online template updating mechanism, breaks through the limitation of weak generalization ability of traditional methods based on the field knowledge vector library and large model collaborative analysis, realizes second-level response by combining adaptive threshold strategy with parsing tree matching, solves the speed bottleneck of real-time detection, dynamically injects power dispatch professional knowledge into prompt words, makes up for the lack of field knowledge of general models, significantly improves the detection automation level and system stability, and meets the high reliability demand of the power system.

[0033] 2.The present application constructs a knowledge-enhanced analysis framework, embeds field knowledge through template semantic retrieval, greatly improves the accuracy of large model judgment, adopts a dynamic prompt word-driven mechanism, automatically selects analysis templates according to log types, embeds high-frequency parameters and weight coefficients, and prioritizes high-risk abnormalities; through a hierarchical root cause analysis architecture, two-stage processing is used to realize parallel classification and deep diagnosis in seconds, and generate a structured fault report containing time span, achieving the unity of high precision and high efficiency.

[0034] 3.The online template updating mechanism of the present application can capture new log patterns in real time, balance resources through caching undetermined logs and frequency-limited matching, automatically upgrade semantic layer rules for misjudgment identification, continuously optimize the accuracy of the template library, and dynamically adjust the adaptive threshold model according to the log rate, combined with system load optimization sensitivity, ultimately realize a significant reduction in operation and maintenance burden, and generate a comprehensive fault report to directly guide decision-making, greatly improving the availability of the power system. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 The present application is a kind of power dispatch automation system log abnormity detection method.

[0036] Figure 2 The present application is a kind of power dispatch automation system log abnormity detection method.

[0037] Figure 3 The present application is a kind of power dispatch automation system log abnormity detection method. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical scheme and advantages of the present disclosure clearer, the following will further describe the embodiments of the present disclosure in combination with the drawings. The proportions of the components are not drawn according to the true proportions, and the proportions and sizes shown in the drawings should not limit the essential technical scheme of the present application. These embodiments do not describe all the details, and the present application is not limited to the specific embodiments described.

[0039] Referring to Figures 1-3 As shown in the drawings, a method for detecting log abnormity of a power dispatch automation system includes:

[0040] A fixed-depth parse tree is constructed using historical log data, and log templates are extracted based on word segmentation similarity; knowledge in the field of power dispatching is transformed into vectors and stored in a knowledge base;

[0041] Retrieve knowledge related to log templates from the knowledge base, input them into a large model for anomaly detection, and tag the templates with labels.

[0042] After real-time log preprocessing, template tags are inherited through parse tree matching template library and adaptive threshold strategy, and online template updates are triggered for unmatched logs;

[0043] The system aggregates the context and high-frequency parameters of abnormal logs, combines the search results and template feature weights to construct dynamic prompt words, inputs them into a large model for multi-dimensional root cause analysis, and optimizes the template mechanism based on the prompt words.

[0044] This invention collects historical log data from a power dispatch automation system, performs data preprocessing, feature extraction and selection, and uses intelligent template matching technology and a domain knowledge-enhanced large-scale model for anomaly judgment and analysis, thereby achieving effective detection and localization of log anomalies. This invention uses a log template library and template matching algorithm for initial anomaly detection, and then calls the knowledge-enhanced large-scale model for further analysis based on the detection results, ensuring accurate identification and classification of anomalies. During operation, by storing historical data in a vector knowledge base and updating the template library in real time, the log pattern features are progressively optimized, thereby achieving anomaly monitoring of real-time log data. Overall, this invention improves the efficiency and automation level of log anomaly detection in power dispatch automation systems by combining intelligent template matching and a large-scale language model.

[0045] like Figure 1 In one embodiment shown, Figure 1 This is an overall flowchart of a method for detecting log anomalies in a power dispatch automation system according to the present invention. First, a fixed-depth parse tree is constructed using historical log data: the historical log data is preprocessed, dynamic content is replaced with unified identifiers using regular expressions, and a parse tree is constructed based on the number of word segments and leading words, with leaf nodes storing candidate templates. Simultaneously, knowledge in the power dispatch domain is converted into vectors and stored in a knowledge base.

[0046] Then, template anomaly labeling is performed: Knowledge base related to the log template's domain is retrieved, and prompt words containing the log template content are constructed. The knowledge base is then retrieved using template semantics, and the related domain knowledge is embedded into the prompt words and input into the large model. Normal or abnormal labels and confidence levels are output and stored, and manual verification is introduced to optimize the accuracy of the large model's judgment. If the large model identifies a misjudgment pattern, template correction instructions are automatically generated to add semantic annotations and contextual verification rules, upgrading the template matching to the semantic layer.

[0047] Next, real-time logs are processed: After preprocessing, the corresponding branch of the first level of the parse tree is selected based on the number of words segmented after preprocessing; nodes are matched layer by layer according to the first few words of the log, and wildcard nodes are automatically matched for dynamic words; after reaching the leaf node, all candidate templates are extracted. Template labels are inherited through an adaptive threshold strategy—the initial similarity threshold is 0.4, and when the real-time log generation rate exceeds 5 logs / second, the threshold decreases by 0.1 for every additional 5 logs / second, with a minimum of no less than 0.1, and the sensitivity is dynamically adjusted according to the system load.

[0048] For unmatched logs: trigger the online template update process, cache them as pending judgment status and limit their participation frequency in matching; update the parse tree and template library through timed cyclic matching, and record the matching failure mode to automatically correct the adaptive threshold model.

[0049] Finally, multi-dimensional root cause analysis is performed: a two-stage hierarchical architecture is adopted. In the rapid classification stage, lightweight prompt words are used to embed key fields of the anomaly logs and knowledge base retrieval results, and the large model outputs a preliminary anomaly classification. In the deep analysis stage, anomaly logs are aggregated by template ID, the number of anomalies and high-frequency dynamic parameters within the time window are counted, the context log sequences of the same device or task are associated, multi-dimensional prompt words are constructed to form a structured output instruction, domain knowledge related to key entities is retrieved and injected into prompt words, the root causes of each dimension are analyzed in parallel and the conclusions are summarized, and the large model is input to generate a comprehensive fault report.

[0050] During this process, when the large model misjudges the dynamic prompt words, it automatically executes the prompt word-driven template mechanism: adding semantic notes to the template library and adding context verification rules during the template matching stage.

[0051] like Figure 2 In one embodiment shown, Figure 2 This is a flowchart illustrating the specific process of an anomaly detection method for logs in a power dispatch automation system according to the present invention. The diagram shows the actual operation flow of the invention. Dashed lines represent the preparatory steps before actual operation, including the process of extracting log templates from historical data and anomaly labeling based on the templates. Solid lines represent the actual operation process, where real-time generated logs undergo preprocessing, template matching, anomaly labeling, information statistics, and aggregation before being analyzed by a large model, ultimately producing an analysis report.

[0052] In this embodiment, the method designed by the present invention includes the following steps:

[0053] S1. Log template extraction;

[0054] S2. Establishment of a knowledge base for power dispatch automation;

[0055] S3. Template-based anomaly detection;

[0056] S4, log template matching and updating;

[0057] S5, large model collaborative analysis.

[0058] The S1 specific steps include:

[0059] Step one: historical data collection

[0060] Collect historical log data through the operation records of the power automation system. These data include but are not limited to device operation status, alarm information, maintenance logs, system events, etc. The collected data should cover the performance of the system under different operating conditions to ensure that the generated log templates can accurately reflect various normal operating modes. During the data collection process, the log data needs to be preprocessed, including removing redundant information, standardizing the format, and correcting the timestamp, to provide a high-quality data foundation for subsequent template generation and anomaly detection.

[0061] Step two: data preprocessing

[0062] Before log template extraction, the log needs to be preprocessed to improve the efficiency and accuracy of subsequent processing. The specific operations include:

[0063] (1) Remove structured information: such as timestamp, hostname, log level, etc. These information are usually fixed in the log, removing them can reduce noise and improve the accuracy of template extraction.

[0064] (2) Tokenization: split the log message into words or symbols for subsequent processing.

[0065] (3) Regular expression replacement: use simple regular expressions to replace dynamic parts in the log, such as IP addresses, numbers, etc., to unify the representation of these dynamic parts.

[0066] Step three: build fixed-depth parse tree

[0067] This step builds a fixed-depth tree structure for subsequent log parsing, each node represents a certain feature of the log message, and the leaf node represents the log template. The root node of the tree represents all log messages, the intermediate layer nodes filter log messages according to rules, and the leaf nodes of the tree store candidate log templates. For the depth parsing tree, the depth and maximum number of child nodes need to be limited to prevent the tree from becoming too large and the branch explosion. For each candidate log template, there is a unique ID corresponding to it.

[0068] Step four: hierarchical search for log templates

[0069] First, a first layer of screening is needed according to the length of the log message, that is, a corresponding branch is selected according to the number of words after preprocessing of the log. Then, a second layer of screening is performed according to the leading word, that is, a branch is selected according to the label at the first d-2 positions of the log message, where d represents the depth of the tree. If the current word contains a number, it may be a numerical value or an identifier. Therefore, a special node "*" is set for matching to prevent branch explosion.

[0070] Step five: template matching based on word similarity

[0071] Similarity calculation:

[0072] For each log that needs to be matched, first, screening is performed according to the parse tree. After reaching the leaf node, all candidate log groups (that is, existing log templates) under the node are obtained. Then, each candidate log group is traversed, and the similarity between the current preprocessed log message and the log group template is calculated. The similarity between the log message and the template needs to be compared position by position. The formula for calculating the similarity is as follows:

[0073] The similarity value simSeq is equal to, starting from position index i equal to 1 and ending at position index i equal to n (n represents the total number of words after preprocessing of the log message), the equ function value is calculated for each position i;

[0074] Among them, the input parameters of the equ function are t_log(i) and t_template(i) (t_log(i) represents the i-th word of the log message, and t_template(i) represents the i-th word of the candidate template);

[0075] The output rule of the equ function is: when t_log(i) is equal to t_template(i), 1 is returned; otherwise, 0 is returned;

[0076] The sum of the output values of the equ function at all positions i is calculated;

[0077] Finally, the sum result is divided by the total number of words n to obtain the similarity value simSeq, which ranges from 0 to 1.

[0078] According to the similarity formula, the words of the log information and the template are compared position by position, the number of same words is counted, and the number of same words is divided by the total number of words to obtain the similarity value simSeq∈[0,1].

[0079] Template matching

[0080] After the similarity calculation, the log template with the highest simSeq value is selected from all candidate log templates, that is, the template with the highest matching degree. If the highest simSeq is greater than or equal to the preset threshold, it is determined that the matching is successful; if all candidate simSeqs are less than the preset threshold, it is determined that the matching fails.

[0081] (3) Template updating

[0082] After template matching is completed, the log group needs to be updated according to the matching situation.

[0083] In the case of successful matching of the template, first, the ID of the current log is added to the log ID list of the matching log group. Subsequently, the log template is updated position by position and the templates are merged, with the following rules:

[0084] If t_log(i) = t_template(i), the original template mark is retained.

[0085] If t_log(i) ≠ t_template(i), the word of the template is replaced with the wildcard "*".

[0086] In the case of failed matching of the template, the preprocessed result of the current log message is taken as a new template, and the parse tree is updated: from the root node to the leaf node, update the nodes according to the rules, automatically create the missing nodes in the path, and insert the special node "*" to avoid branch explosion if the word in the path contains numbers.

[0087] The S2 includes the following specific steps:

[0088] Step one: collection and arrangement of domain knowledge

[0089] Collect the domain knowledge related to the power dispatching automation system, including: equipment operation manual, operation and maintenance work guide, historical fault case report, system design document, as well as expert experience knowledge, analysis results in S5, etc. Clean and arrange the collected unstructured and semi-structured documents, extract key information, and structure them into question and answer pairs, fact descriptions and fault handling processes, etc. to facilitate model learning and retrieval.

[0090] Step two: vectorization of knowledge text

[0091] Adopt text embedding technology to convert the arranged structured knowledge items into high-dimensional vector representations. Each vector contains the semantic information of the corresponding knowledge text.

[0092] Step three: construction of vector knowledge base

[0093] Store all knowledge text vectors in a special vector database. This database supports efficient similarity retrieval and can quickly find the most semantically similar knowledge vectors according to the input query vector, thereby returning the relevant original knowledge text. This knowledge base will be used to enhance the analysis capabilities of the large model in the subsequent steps.

[0094] The S3 includes the following specific steps:

[0095] Step one: construction of template-level log prompt

[0096] The log template extracted in S1 is semantically represented, and a text form suitable for large model input is constructed. In the way of prompt engineering, the log template is embedded in a specific prompt to guide the large model for understanding and analysis. The following is the prompt for judging abnormality:

[0097] "The following is a log template generated by the power automation system:

[0098] {Log template content}

[0099] Please judge the abnormality of the log represented by the semantic content of the log template and classify it as "normal" or "abnormal", and attach the confidence level."

[0100] Step two: knowledge base retrieval enhancement

[0101] The content of the log template is used as a query to perform similarity retrieval in the power dispatch automation vector knowledge base constructed in S2, to find the most relevant domain knowledge to the template semantics.

[0102] Step three: large model abnormality judgment based on knowledge enhancement

[0103] The original log template and the domain knowledge retrieved in the previous step are embedded into the input, and then the enhanced prompt containing additional domain knowledge is input into the pre-trained large language model. This way provides the large model with key contextual information, enabling it to combine domain knowledge for reasoning and analysis, thus more accurately determining whether the template has potential abnormal risks and giving a judgment label (abnormal or normal).

[0104] Step three: abnormal template labeling and storage

[0105] According to the judgment label obtained, the template is labeled, and the original template ID, log template content, abnormality judgment result and template parse tree are stored together as a reference for subsequent abnormal log judgment.

[0106] Among them, S4 specific steps include:

[0107] Step one: real-time log preprocessing

[0108] According to the pre-defined preprocessing rules (remove structured information, regularize dynamic content, word segmentation processing) in S1, standardize the real-time log to ensure consistency with the format of historical templates.

[0109] Step two: fast filtering of parse tree

[0110] Based on the fixed-depth parse tree constructed in S1, the following rules are used to quickly locate the candidate template:

[0111] (1) Length matching: Select the first layer branch of the parse tree according to the number of log words.

[0112] (2) Leading word matching: Match the parse tree node with the first N words of the log (N is the tree depth), and automatically match the wildcard "*" node for dynamic words (numbers / IP, etc.).

[0113] (3) Leaf node candidate set acquisition: Reach the leaf node and extract all candidate templates under the node.

[0114] Step three: Dynamic similarity calculation and threshold determination

[0115] Similarity calculation: Based on the word-by-word comparison in S1, introduce dynamic weights, give higher weights to key positions (operation words, error codes), and improve the accuracy of core semantic matching.

[0116] Adaptive threshold adjustment: Dynamically adjust the matching threshold according to the operation state of the power system (peak / maintenance period), balance the matching efficiency, and avoid missing key exceptions.

[0117] Step four: Online learning for unmatched logs

[0118] Parse tree and template library update: Only for unmatched logs, trigger the template generation process of S1, and enter the cycle waiting, and perform matching with the template library again.

[0119] Temporary template cache: New templates are marked as "to be judged" before being judged, and their participation in matching is limited until the large model completes the judgment and updates the template library in real time.

[0120] Online learning and threshold feedback: The logs and their context information that fail to match are used as input for online learning to continuously optimize the template library. At the same time, record and analyze the frequency and mode of matching failure, if the failure rate is consistently high in a certain operating state, automatically trigger the correction of the adaptive threshold model (coefficient adjustment), form a feedback loop, and improve the system's adaptability to new patterns.

[0121] Step five: Abnormal label output

[0122] If the matching is successful, there is no need to repeat the analysis, and the pre-judgment label (normal / abnormal) for the template in S3 is directly inherited. After associating the abnormal label with the log, it is pushed to the alarm system in real time.

[0123] Among them, the specific steps of S5 include:

[0124] Step one: Dynamic prompt word construction

[0125] First, the real-time logs marked as "abnormal" in S3 are grouped by matching template ID. The number of occurrences of each type of abnormal template in the recent time window is counted. The dynamic fields in the logs are extracted, and the high-frequency values or abnormal values are counted. The template ID, abnormal number, high-frequency parameter, and occurrence number are recorded as auxiliary data. Combined with device topology information, abnormal logs from the same device or multiple devices with direct upstream and downstream relationships are associated and incorporated into log context information. Some dynamic fields (such as the same IP address, task ID, session identifier, etc.) are obtained through regular matching, and abnormal logs containing the same dynamic fields are associated and incorporated into log context information. For each abnormal log, the system will dynamically select and construct the prompt word template according to its type (such as network layer log, SCADA system log, etc.). The auxiliary data related to the log and the fixed number of log data before the log are used as context, which is input into the corresponding prompt template together with the original log text. In some cases, increase the template abnormal weight coefficient (based on the historical abnormal rate of the template in S3), guide the model to focus on high-frequency abnormal templates. The following is the structure of the single abnormal log information combination used:

[0126] "Abnormal log {serial number} {log timestamp} {log information}

[0127] Log category template: {log template content}; Log source: {log type}; This type of abnormality has occurred {number of abnormalities} times recently, with {high-frequency parameter} appearing {number of high-frequency parameters} times.

[0128] Before this abnormality, the following logs appeared:

[0129] {log context information}".

[0130] Step two: multi-angle collaborative abnormal analysis

[0131] After accumulating a certain amount or time of abnormal logs, the abnormal logs combined with relevant information are embedded in the prompt word as follows:

[0132] "The following is the potential abnormal log information in the power automation system in recent times. Please determine whether there is an abnormality in the power automation system in recent times based on the provided information, and analyze the most likely cause of the abnormal log from the {dimension} level.

[0133] {Log 1 information}

[0134] {Log 2 information}

[0135] {...}

[0136] Please output in the following format:

[0137] Time span: [Year-Month-Day Time:Minute:Second - Time:Minute:Second]

[0138] Power automation system status: [Abnormal / Normal]

[0139] Abnormal reason: According to [log content and information], it can be seen that [device] has [fault dimension], and the reason is [abnormal reason]."

[0140] Where {dimension} is (device failure, network failure, application failure, etc.). Then, the system extracts the key entities in the abnormal log (such as device name, IP address, task ID, etc.) as query conditions, and retrieves detailed domain knowledge related to these entities in the vector knowledge base constructed in S2. The retrieved knowledge (for example, the common failure mode of a certain device, the function description of a certain application module, etc.) is integrated with the summarized abnormal log information into the prompt word. The prompt word is input into the model in parallel, and the conclusion corresponding to the analysis dimension is obtained. These conclusions are summarized and spliced into the following prompt words:

[0141] "The following is the potential abnormal log information in the power automation system in recent times. Please judge and analyze whether there is an abnormality in the power automation system according to the provided related information and multiple aspects of the abnormality. Summarize and analyze the most likely causes of the abnormal log.

[0142] {Log1 information}

[0143] {Log2 information}

[0144] {...}

[0145] ## Device failure dimension analysis conclusion:

[0146] {Analysis conclusion of device failure model}

[0147] ## Network failure dimension analysis conclusion:

[0148] {Analysis conclusion of network failure model} ...

[0149] {...}

[0150] Please output in the following format:

[0151] Time span: [Year-Month-Day Time:Minute:Second - Time:Minute:Second]

[0152] Power automation system status: [Abnormal / Normal]

[0153] Abnormal reason: According to [log content and information], it can be seen that [device] has [fault dimension], and the reason is [abnormal reason]."

[0154] In another embodiment, the multi-dimensional analysis is broken down into two-stage prompts:

[0155] The first stage is rapid anomaly classification, which uses lightweight cue words. The cue words only include key fields from the anomaly log (device name, IP address, task ID) and related domain knowledge retrieved from the vector knowledge base. The second stage is deep root cause analysis to enhance cue words, which include context and multi-dimensional evidence.

[0156] The prompts are input into the large model again, which then summarizes and derives the final analysis results. When the large model detects a misjudgment of a certain type of anomaly through dynamic prompts (such as misjudging "network latency jitter" as "device failure"), it automatically generates template correction instructions.

[0157] Add a semantic note (such as "Network / device context needs to be distinguished") to the log template in the S1 template library.

[0158] Add context validation rules to the template matching stage of S4. This upgrades template matching from the syntax level to the semantic level.

[0159] Step 3: Output of Exception Report

[0160] Key information is extracted from the output of the large model according to a predefined format, including the time when potential anomaly logs appear, the assessed status of the power automation system, the abnormal equipment and the cause of the anomaly. The extracted structured data is then merged with the original output of the large model to form an anomaly report and stored to remind and assist maintenance personnel in troubleshooting.

[0161] like Figure 3 In one embodiment shown, Figure 3 This is an architecture diagram of a method for detecting log anomalies in a power dispatch automation system according to the present invention. To solve the above-mentioned technical problems, the present invention provides a method for detecting log anomalies in a power dispatch automation system based on intelligent templates and large-scale model knowledge enhancement, the architecture of which is as follows: Figure 3 As shown, by maintaining and updating the domain vector knowledge-enhanced big model, anomalies are judged and analyzed in the logs of the power dispatch automation system. The real-time updated intelligent log template matching method is used to make preliminary judgments on log anomalies, which improves the detection speed while taking into account the detection accuracy.

[0162] Figure 3The core idea and workflow of the application are illustrated in detail. The whole system is constructed around the power dispatch automation log analysis large model and is divided into offline preparation and online operation two stages. The offline preparation stage mainly carries out model and knowledge preprocessing. On the one hand, template extraction is carried out from historical logs to form a log template library, and the large model completes the abnormal annotation work. On the other hand, the power dispatch knowledge is vectorized and constructed into a power dispatch vector knowledge base. The knowledge base injects professional domain knowledge into the central large model through retrieval enhancement. The online operation stage carries out real-time processing of business logs. After the real-time log enters the system, it is first matched with the log template library. If the matching is successful, it means that there may be an event of a known mode, and the system will trigger the abnormal log analysis process, and finally generate a structured analysis report through deep interaction with the power dispatch operation and maintenance knowledge base. Otherwise, it means that a new log mode appears, and the system will generate a new template, thereby realizing online learning and self-adaptation of unknown modes.

[0163] In the present embodiment, the application specifically comprises:

[0164] 1. Log template library construction

[0165] In this step, first, historical log data in the power automation system is collected, including the running state of the equipment, alarm information, maintenance logs, system events, etc., to ensure that the data contains log modes under different running scenarios. In order to ensure the accuracy of template matching and abnormal detection, the collected data covers the performance of the system under different running conditions, and the historical data collection period is one week. During data collection, data preprocessing is performed, including removing redundant information, standardizing the format, and correcting the timestamp, to provide a high-quality data basis for subsequent template generation and abnormal detection. The specific operation includes removing structured information such as timestamp, hostname, log level, etc., using natural language processing tools to split the log message into word, symbol sequences, and using regular expressions to replace predefined dynamic parts (such as IP address, number converted to

IP

NUM

[0166] 2. Domain knowledge base construction

[0167] Collect domain knowledge such as device operation manuals, historical fault cases, and operation and maintenance guidelines to prepare for the construction of the knowledge base. Process the collected and sorted domain knowledge documents, convert them to vectors through text embedding technology, and store them in a vector database. This knowledge base supports efficient semantic retrieval and provides domain knowledge support for subsequent large model analysis.

[0168] 2. Abnormality judgment based on templates and knowledge enhancement

[0169] For each log template extracted in the first stage, the system will first use its semantic content to search for relevant background knowledge in the constructed vector knowledge base. Integrate the log template and the retrieved domain knowledge into a prompt and input it into the pre-trained large language model. The model determines whether the log event represented by the template is "normal" or "abnormal" based on this information. Attach an abnormality label to each template and store it. At the same time, introduce an artificial verification and feedback correction mechanism to optimize the accuracy of the model's judgment. The abnormality result is labeled and stored, providing a reference for subsequent log matching.

[0170] 3. Real-time log matching and online learning

[0171] When the system is running, real-time logs will go through the same preprocessing process as historical data. Then, use the constructed parse tree for quick screening and calculate the similarity with the candidate templates. On this basis, the system uses an adaptive threshold strategy (initially set to 0.4, when the log exceeds 5 / s, the threshold decreases by 0.1 for every 5 logs, and the threshold is at least 0.1) to dynamically adjust the matching threshold, avoiding false positives and false negatives during peak periods. If the real-time log is successfully matched to a template, it will directly inherit the template's existing "normal" or "abnormal" label. For logs that fail to match, the system will trigger the new template generation process and temporarily cache them as "to be judged" status, waiting for subsequent cycles to be judged.

[0172] 4. Dynamic prompt word construction

[0173] The present step aims to dynamically generate prompt templates according to different types of logs and analysis requirements, so as to improve the pertinence and accuracy of large model analysis. The logs marked as abnormal are first submitted to the large model combined with the knowledge base for preliminary judgment. The model can automatically identify the type of log according to the source and content of the log, and call the pre-set dynamic prompt template, for example, the network layer analysis template for network layer logs and the application layer template for SCADA system. The prompt template contains variable parameters, which will be filled according to real-time log information (such as log template content, abnormal times, high-frequency parameters, etc.). When performing multi-dimensional collaborative analysis, the prompt template will be dynamically adjusted according to the analysis dimensions (such as device failure, network failure, application failure, etc.), guiding the large model to perform attribution analysis from a specific angle. At the same time, the system will query the key information of the log template or abnormal log in the vector knowledge base to retrieve related domain knowledge, and integrate the retrieved knowledge and original log information into the prompt to enhance the analysis ability of the large model.

[0174] 5. Large model collaborative analysis and report generation

[0175] The system groups the logs marked as "abnormal" in recent time according to their template ID, and counts the key information, including: the number of occurrences of this type of abnormality in a specific time window, the high-frequency dynamic parameter values in the log, and the context log information before the abnormality occurs. Before performing in-depth analysis, the system extracts the key information (device name, task ID, etc.) in the abnormal log, retrieves related domain knowledge in the vector knowledge base. Then, the original abnormal log, the aggregated statistical data, the context information and the domain knowledge retrieved from the knowledge base are integrated into the structured prompt template. The above enhanced prompt is input into the large model to guide it to perform attribution analysis from multiple dimensions such as device failure and network problem, and to summarize the conclusions of each dimension, finally to obtain a comprehensive and most likely abnormal reason. The system automatically extracts key information (fault time, affected device, root cause, etc.) according to the final output of the large model, generates a structured abnormal report, and pushes it to the operation and maintenance personnel in real time, providing support for rapid troubleshooting and decision-making.

[0176] The power dispatching automation system log abnormality detection method based on intelligent template and large model knowledge enhancement provided by the present application combines efficient template matching technology with deep reasoning ability of large model injected with domain knowledge, which brings qualitative improvement to the accuracy and intelligence level of power system log monitoring.

[0177] The core innovation and advantage is:

[0178] ①Intelligent template-driven rapid abnormal log detection: The core of the present application is "analyze the template first, then match the log". The system completes the analysis and qualitative of the log template in the offline stage, and only needs to perform efficient template matching to inherit the prediction result in real-time monitoring. This architecture decouples the high-cost reasoning of large models and the high-demand real-time detection, and when facing a large amount of real-time data generated by power dispatching automation systems, it guarantees the efficiency and real-time response capability of the detection.

[0179] ②High-precision abnormality judgment based on power dispatching domain knowledge base: To solve the problem of low accuracy of general large models due to lack of domain knowledge, the present application introduces a power dispatching automation domain knowledge base. When pre-judging the log template, the large model is no longer analyzed independently, but will first retrieve relevant domain knowledge (such as device specifications, normal working conditions, historical faults, etc.) from the knowledge base, and then make a comprehensive judgment combined with these accurate context information. This knowledge enhancement mechanism makes the model's judgment have a basis, greatly improving the understanding depth and judgment accuracy of power professional logs.

[0180] ③Deep aggregation and multi-dimensional analysis based on large models: In the final abnormality analysis stage, the present application again enhances the knowledge base and log context. By aggregating the context information of abnormal logs and retrieving relevant device details and historical behavior patterns from the knowledge base, the large model can perform more in-depth, multi-dimensional collaborative analysis. This enables it not only to discover abnormalities, but also to provide a logically rigorous and highly reliable root cause analysis report, providing precise decision support for operation and maintenance personnel.

[0181] ④Online adaptive capability: The system has a perfect online learning mechanism. For new logs that cannot be matched, the generation and update process of new templates is automatically triggered. At the same time, the adaptive threshold matching strategy introduced can dynamically adjust the matching sensitivity according to the system running load, effectively dealing with log volume fluctuations and ensuring the stability and continuous adaptability of the method in complex and variable actual operating environments.

[0182] The present application is not limited to the above-mentioned embodiments, and any changes in shape or material composition are within the scope of the present application. Any structure provided by the present application is a variation of the present application and should be considered within the scope of the present application.

Claims

1. A method for detecting log anomalies in power dispatch automation systems, characterized by, The method comprises the following steps: A fixed-depth parsing tree is constructed through historical log data, and a log template is extracted based on word segmentation similarity; Domain knowledge in the power dispatching field is converted into a vector and stored in a knowledge base; The knowledge base associated with the log template is searched, a large model is inputted for abnormality judgment and template labeling, a prompt word containing the content of the log template is constructed, the knowledge base is searched based on the template semantics, the associated domain knowledge is embedded into the prompt word and inputted into the large model; The normal or abnormal label and confidence are outputted and stored; After real-time log preprocessing, the template library is matched through the parsing tree and the template label is inherited through the adaptive threshold strategy, and the online template update is triggered for the unmatched log; The context and high-frequency parameters of the abnormal log are aggregated, the dynamic prompt word is constructed based on the search results and template feature weight, the prompt word template is automatically selected according to the log type, the network layer log adopts the network layer analysis template, the application layer template is used for the system log, the high-frequency parameter value and the number of abnormalities are embedded into the prompt word template, the context log information and the template abnormal weight coefficient, the associated domain knowledge is enhanced through the search vector knowledge base, the large model is inputted for multi-dimensional root cause analysis, and the prompt word driving template mechanism is optimized; when the large model identifies the misjudgment through the dynamic prompt word, the semantic note is added in the template library, and the context verification rule is added in the template matching stage.

2. The method of claim 1, wherein the method further comprises: The input large model for abnormality judgment and template labeling specifically comprises: introducing artificial checking, optimizing the judgment accuracy of the large model according to the feedback, and automatically generating template correction instructions including adding semantic notes and increasing context verification rules if the large model identifies the misjudgment mode, and upgrading the template matching to the semantic layer.

3. The method of claim 1 or 2, wherein the method further comprises: The dynamic prompt word constructed based on the search results and the template feature weight specifically comprises: adding a template abnormal weight coefficient in the prompt word template, the coefficient is calculated based on the historical abnormal rate, and the large model is guided to preferentially analyze the high-frequency abnormal template.

4. The method of claim 3, wherein the method further comprises: The online template update comprises: triggering the new template generation process for the unmatched log, caching it as a to-be-judged state, and limiting the matching frequency; the parsing tree and the template library are updated through the timing cycle matching, and the matching failure mode is recorded to automatically correct the adaptive threshold model.

5. The method of claim 4, wherein the method further comprises: The multi-dimensional root cause analysis specifically comprises: using a two-stage hierarchical architecture, including a rapid classification stage and a depth analysis stage; the rapid classification stage comprises using a lightweight prompt word for preliminary analysis, embedding the key fields of the abnormal log and the search results of the knowledge base, and outputting a preliminary abnormal classification by the large model; the depth analysis stage comprises aggregating abnormal logs according to template IDs, counting the number of abnormalities and high-frequency dynamic parameters within a time window, associating context log sequences of the same device or task, constructing a multi-dimensional prompt word structured output instruction, searching the domain knowledge associated with the key entity, injecting the prompt word and analyzing the root causes of each dimension in parallel, summarizing the conclusions of each dimension, and inputting the large model to generate a comprehensive fault report.

6. The method of claim 1, wherein the method further comprises: The fixed-depth parsing tree constructed through historical log data specifically comprises: preprocessing the historical log data, replacing dynamic content with a uniform identifier through a regular expression, constructing a parsing tree based on the number of word segmentation and the leading word, and storing candidate templates in the leaf nodes.

7. The method of claim 1, wherein the method further comprises: The parsed tree matching template library specifically comprises: selecting a parsed tree first layer corresponding branch according to the number of words after preprocessing of the real-time log; matching nodes layer by layer according to the first several words of the log, and automatically matching a wildcard node for a dynamic word; after reaching a leaf node, extracting all candidate templates stored under the node.

8. The method of claim 7, wherein the method further comprises: The word similarity specifically comprises: comparing each word position of the log message and the candidate template, for the total number of words after preprocessing of the log message, comparing position by position from the first word position to the last word position, at each position, checking whether the log word is equal to the template word: if equal, assigning a contribution value 1 to the position; if not equal, assigning a contribution value 0 to the position; calculating the sum of the contribution values of all positions, dividing the sum by the total number of words to obtain a similarity value, the value ranges between 0 and 1, wherein 0 represents complete mismatch and 1 represents complete match.

9. The method of claim 1 or 7, wherein the method further comprises: The adaptive threshold strategy comprises: setting an initial similarity threshold value to 0.4, when the real-time log generation rate exceeds 5 per second, reducing the threshold value by 0.1 for each increase of 5 per second, the minimum threshold value is not less than 0.1, and the sensitivity is dynamically adjusted according to the system running load.

Images