Industrial data exception attribution method and device, equipment, storage medium and product

Abstract

The invention discloses an industrial data exception attribution method, device and equipment, a storage medium and a product, is applied to a smart power plant data platform, and relates to the technical field of exception detection. The method comprises the following steps: acquiring multi-source industrial data in real time; performing standardization processing on the multi-source industrial data to generate a standardized data stream in a unified format; performing anomaly detection on the standardized data through a pre-trained integrated learning model, and identifying an abnormal mode in the data; and in response to the detected abnormal mode, performing multi-dimensional attribution analysis on the abnormal mode based on an association rule constructed by a data topic and a data mart, and determining a root cause of the abnormality. Through progressive processing of data integration, intelligent detection and business attribution, a complete closed loop from data perception to intelligent decision is realized, and mass data is converted into high-value decision information for directly driving business optimization.

Description

Technical Field

[0001] This application relates to the technical field of anomaly detection, and more particularly to a method, apparatus, device, storage medium, and product for attributing industrial data anomalies. Background Technology

[0002] With the advent of Industry 4.0 and the deepening of digital transformation, smart power plants, as the core carriers of intelligent upgrading in the energy industry, are increasingly relying on data platforms to achieve real-time monitoring, optimization, and decision support for the production process. Industrial data platforms, based on technologies such as cloud computing, the Internet of Things, big data, and artificial intelligence, integrate multi-source data from equipment, production lines, and factories, aiming to improve operational efficiency, reduce costs, and ensure safety through data-driven approaches. In this context, industrial data anomaly attribution has become a crucial link, helping enterprises quickly pinpoint the root causes of production anomalies, thereby achieving precise operation and maintenance and intelligent decision-making.

[0003] Currently, attribution of industrial data anomalies typically employs methods based on statistical process control, single machine learning models, or rule engines. These methods often rely on training with historical data or pre-set thresholds to identify anomalies through simple association rules or outlier detection, and attempt to perform causal analysis.

[0004] However, in existing technologies, smart power plants suffer from insufficient accuracy and comprehensiveness in anomaly detection and attribution when using data platforms for anomaly detection and attribution, as well as a disconnect between root cause identification and business context.

[0005] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] The main objective of this application is to provide a method, apparatus, device, storage medium, and product for attributing industrial data anomalies, aiming to solve the technical problems of insufficient accuracy and comprehensiveness in anomaly detection, as well as the disconnect between root cause location and business context.

[0007] To achieve the above objectives, this application proposes an industrial data anomaly attribution method, the method comprising: Real-time acquisition of multi-source industrial data; The multi-source industrial data is standardized to generate a standardized data stream in a unified format; Anomaly detection is performed on the standardized data using a pre-trained ensemble learning model to identify anomalous patterns in the data. In response to the detection of the abnormal pattern, a multi-dimensional attribution analysis is performed on the abnormal pattern based on the association rules constructed from the data topic and the data mart to determine the root cause of the anomaly.

[0008] In one embodiment, the multi-source industrial data includes at least one or more of equipment operating parameters, process control data, and environmental monitoring data.

[0009] In one embodiment, the step of standardizing the multi-source industrial data to generate a standardized data stream with a unified format includes: The missing points are filled using linear interpolation, and outliers are identified and removed using statistical methods to achieve data cleaning of the multi-source industrial data; Based on the unified time-series service of the data platform, the multi-source industrial data after data cleaning is timestamped to generate a data sequence with unified time granularity. An adaptive min-max normalization method is used to normalize the data sequence with uniform time granularity to obtain a time-aligned standardized data stream.

[0010] In one embodiment, the pre-trained ensemble learning model combines the Isolation Forest algorithm, temporal convolutional autoencoder, and a type of support vector machine base detector, and the step of training and updating it using historical data and real-time data streams includes: The normalized data stream is processed using the isolated forest algorithm through a first base detector to detect outliers with a globally sparse distribution; and / or; The normalized data stream is processed by a temporal convolutional autoencoder using a second base detector, and complex local temporal anomaly patterns in the data are identified by calculating its reconstruction error; and / or; The standardized data stream is processed by a third-base detector and a support vector machine. Based on the classification boundary established by historical normal data, anomalies deviating from the normal operation mode are identified. The outputs of the first base detector, the second base detector, and the third base detector are received and combined to form an ensemble learning model.

[0011] In one embodiment, the step of performing anomaly detection on the standardized data using a pre-trained ensemble learning model to identify anomalous patterns in the data includes: The outputs of at least three base detectors are fused using a dynamic weighted fusion strategy of the pre-trained ensemble learning model to generate the final anomaly determination result.

[0012] In one embodiment, the step of performing multi-dimensional attribution analysis on the abnormal pattern based on association rules constructed from data topics and data marts in response to detecting the abnormal pattern, and determining the root cause of the anomaly, includes: Based on the data lineage graph and business knowledge graph constructed within the data platform, a multi-dimensional set of association rules is formed. The abnormal patterns are mapped to the multi-dimensional association rule set, and the data lineage and business associations are traced to locate the potential root causes of the abnormal patterns. Calculate the root cause contribution of each potential root cause to the anomalous pattern; The potential root causes are ranked according to their contribution to the root cause, and the potential root cause with the highest ranking is determined as the ultimate root cause of the anomaly.

[0013] Furthermore, to achieve the above objectives, this application also proposes an industrial data anomaly attribution device, which includes: The data acquisition module is used to acquire multi-source industrial data in real time. The data governance module is used to standardize the multi-source industrial data and generate a standardized data stream in a unified format. An anomaly detection module is used to perform anomaly detection on the standardized data using a pre-trained ensemble learning model, and to identify abnormal patterns in the data. The root cause determination module is used to, in response to the detection of the abnormal pattern, perform multi-dimensional attribution analysis on the abnormal pattern based on the association rules constructed from the data topic and the data mart, and determine the root cause of the abnormality.

[0014] Furthermore, to achieve the above objectives, this application also proposes an industrial data anomaly attribution device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the industrial data anomaly attribution method described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the industrial data anomaly attribution method described above.

[0016] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the industrial data anomaly attribution method described above.

[0017] One or more technical solutions proposed in this application have at least the following technical effects: This application acquires multi-source industrial data in real time; standardizes the multi-source industrial data to generate a standardized data stream with a unified format; performs anomaly detection on the standardized data using a pre-trained ensemble learning model to identify abnormal patterns in the data; and, in response to the detection of the abnormal patterns, performs multi-dimensional attribution analysis on the abnormal patterns based on association rules constructed from data themes and data marts to determine the root cause of the anomalies. This application achieves a complete closed loop from data perception to intelligent decision-making through progressive processing of data integration, intelligent detection, and business attribution, transforming massive amounts of data into high-value decision information that directly drives business optimization. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating an embodiment of the industrial data anomaly attribution method of this application; Figure 2 This is a flowchart illustrating Embodiment 2 of the industrial data anomaly attribution method of this application; Figure 3 This is a flowchart illustrating Embodiment 3 of the industrial data anomaly attribution method of this application; Figure 4 This is a schematic diagram of the module structure of the industrial data anomaly attribution device according to an embodiment of this application; Figure 5 This is a schematic diagram of the equipment structure of the hardware operating environment involved in the industrial data anomaly attribution method in this application embodiment.

[0021] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0023] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0024] Existing technologies suffer from insufficient accuracy and comprehensiveness in anomaly detection, as well as technical issues related to the disconnect between root cause localization and business context.

[0025] This application provides a solution for real-time acquisition of multi-source industrial data. A data governance module standardizes the multi-source industrial data, generating a standardized data stream in a unified format. An anomaly detection method is used to identify abnormal patterns in the standardized data through a pre-trained ensemble learning model. In response to the detected abnormal patterns, a multi-dimensional attribution analysis is performed on the abnormal patterns based on association rules constructed from data themes and data marts to determine the root cause of the anomalies. This application achieves a complete closed loop from data perception to intelligent decision-making through progressive processing of data integration, intelligent detection, and business attribution, transforming massive amounts of data into high-value decision information that directly drives business optimization.

[0026] Based on this, embodiments of this application provide a method for attributing industrial data anomalies, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the industrial data anomaly attribution method of this application.

[0027] In this embodiment, the industrial data anomaly attribution method includes steps S10 to S40: Step S10: Acquire multi-source industrial data in real time; It should be noted that a data middle platform refers to a platform architecture that provides enterprises with unified data service capabilities. It sits between the underlying, dispersed data sources and the upper-layer business applications, aiming to achieve data aggregation, governance, assetization, and service provision. Multi-source industrial data refers to various types of data generated during the production and operation of smart power plants, originating from different systems, equipment, and environments. Its characteristics include diverse sources, heterogeneous formats, massive volume, and high generation frequency.

[0028] In one possible implementation, the data acquisition module supports directly acquiring sensor time-series data via IoT protocols, connecting to management information systems via API interfaces, and standardizing the multi-source industrial data using log parsing tools to generate a standardized data stream in a unified format. Step S20: Standardize the multi-source industrial data to generate a standardized data stream in a unified format; It should be noted that standardization processing refers to a series of data processing procedures aimed at transforming raw, multi-source industrial data into a form that conforms to predetermined standards and specifications. A standardized data stream with a unified format refers to outputting a structured data sequence that maintains consistency in data patterns, encoding, units, and precision.

[0029] Step S30: Anomaly detection is performed on the standardized data using a pre-trained ensemble learning model to identify abnormal patterns in the data; It should be noted that the pre-trained ensemble learning model refers to a composite machine learning model composed of multiple base detectors, trained offline using historical data. Anomaly patterns refer to special states, trends, or events in the data that deviate from normal behavior or expected patterns; their manifestations are complex and diverse.

[0030] In one possible implementation, the ensemble learning model employs a dynamic weighted fusion strategy, fusing the outputs of three base detectors: the Isolation Forest algorithm, the temporal convolutional autoencoder, and a first-class support vector machine. The Isolation Forest algorithm excels at detecting globally sparse outliers; the temporal convolutional autoencoder, by calculating reconstruction errors, is adept at identifying complex local temporal anomaly patterns; and the first-class support vector machine, based on classification boundaries established from historical normal data, excels at identifying anomalies deviating from normal operating patterns.

[0031] Step S40: In response to the detection of the abnormal pattern, a multi-dimensional attribution analysis is performed on the abnormal pattern based on the association rules constructed from the data topic and the data mart to determine the root cause of the abnormality.

[0032] It's important to clarify that a data topic refers to a logical unit that categorizes and organizes data according to business domains, such as "equipment health status topic" or "economic operation indicator topic." A data mart refers to a topic-oriented data collection built for a specific analytical scenario; it is the physical manifestation of a data topic. Association rules refer to logical statements or knowledge describing the inherent connections and dependencies between different data entities and business indicators. Multi-dimensional attribution analysis refers to exploring the causal chain of anomalies from multiple business perspectives, including operation, equipment, environment, and management. The root cause refers to the initial and deepest event or state that triggers the chain reaction of anomalies.

[0033] In addition, the construction of association rules is based on data lineage graphs and business knowledge graphs. Data lineage graphs describe the complete flow path and dependencies of data from source to consumption; business knowledge graphs encapsulate domain expert knowledge and describe the business logic relationships between equipment, systems, and process parameters.

[0034] In one possible implementation, the attribution analysis process further includes calculating the root cause contribution of each potential root cause to the current anomalous pattern, ranking them according to their contribution, and identifying the cause with the highest ranking as the final root cause.

[0035] This application's embodiments transform previously isolated and raw multi-source industrial data into root cause analysis results that are accurately located, highly interpretable, and directly actionable through a progressive process of standardized integration, intelligent detection, and business-oriented attribution. This not only significantly improves the speed and accuracy of anomaly response but also fundamentally enhances enterprises' insight and control over complex production systems, achieving efficient transformation of data assets into business value. Ultimately, it drives the evolution of production operations towards intelligence, refinement, and predictability, realizing an overall advancement from data perception to intelligent decision-making.

[0036] Furthermore, the multi-source industrial data includes at least one or more of equipment operating parameters, process control data, and environmental monitoring data.

[0037] It should be noted that equipment operating parameters refer to various physical quantities that directly reflect the working state of physical equipment, such as vibration, temperature, pressure, speed, current, and voltage. These are typically collected directly by sensors installed on the equipment and used to assess the real-time health status and performance of the equipment. Process control data refers to the variables and setpoints used to control, regulate, or record the process flow during production, such as set temperature, valve opening, control loop output, and material flow rate. These reflect the operating strategy and stability of the production system. Environmental monitoring data refers to physical quantities that describe the external environmental conditions of the equipment or production system, such as ambient temperature, humidity, and atmospheric pressure. This data is crucial for analyzing equipment anomalies affected by environmental factors.

[0038] This embodiment integrates data from three key dimensions—the equipment itself, the control logic, and the external environment—to construct a three-dimensional and complete data view for subsequent anomaly detection and attribution analysis. This avoids missing data dimensions and lays a solid data foundation for accurately locating complex coupling anomalies across equipment, processes, and even the environment.

[0039] Furthermore, referring to Figure 2 The second embodiment of the industrial data anomaly attribution method of this application provides a flowchart, based on the above. Figure 2 The illustrated embodiment further refines the step S20, "standardizing the multi-source industrial data to generate a standardized data stream in a unified format," by including steps A201-A203: Step A201 involves filling missing points using linear interpolation and identifying and removing outliers using statistical methods to achieve data cleaning of the multi-source industrial data. It should be noted that linear interpolation is a method that estimates the value of missing points based on the assumption that the changes of adjacent known data points follow a linear relationship. Statistical methods here specifically refer to identification techniques based on data distribution characteristics, such as Z-score calculation based on a sliding window. Data cleaning refers to processing raw data to correct and remove unreliable or erroneous data, thereby improving data quality. The aim is to address the problems of incomplete data and noise in the original data.

[0040] Step A202: Based on the unified time-series service of the data platform, the timestamps of the cleaned multi-source industrial data are aligned to generate a data sequence with a unified time granularity. It should be noted that the unified time-series service of the data platform refers to the standardized, high-performance data processing capabilities provided by the data platform for processing timestamped data (i.e., time-series data), including data storage, querying, and aggregation. Timestamp alignment refers to the process of unifying data collected at different points in time to the same time reference point through data processing methods. Unified time granularity refers to the fixed time interval common to all data sequences after alignment processing.

[0041] This application embodiment solves the problem that multi-source industrial data cannot be correlated and analyzed on the same time dimension due to different sampling frequencies by generating a data set in which all data points are strictly synchronized on the time axis.

[0042] Step A203: The data sequence with uniform time granularity is normalized using an adaptive minimum-maximum normalization method to obtain a time-aligned standardized data stream.

[0043] It should be noted that the adaptive min-max normalization method is a data scaling technique, distinct from traditional fixed-range normalization. Its key feature is that its minimum and maximum values ​​are dynamically calculated based on data within a sliding time window, rather than the historical extreme values ​​of the entire dataset. Normalization refers to the process of scaling data of different dimensions and numerical ranges proportionally to fall within a specific interval (e.g., [0, 1]). Time-aligned standardized data streams refer to continuous data that is synchronized in time, uniform in dimensions, and clean in quality.

[0044] The embodiments of this application adopt an adaptive strategy instead of a globally fixed extreme value, which can better adapt to the non-stationary characteristics of industrial process data, that is, the normal operating range of the process may drift slowly over time or under different operating conditions.

[0045] Therefore, this embodiment systematically solves the three core pain points commonly found in industrial data—data missing and noise, asynchronous time series, and inconsistent units—through three interconnected steps: data cleaning, timestamp alignment, and adaptive normalization, significantly improving the detection accuracy and robustness of the model.

[0046] Furthermore, the step of combining the pre-trained ensemble learning model with the isolated forest algorithm, temporal convolutional autoencoder, and a base detector of a type of support vector machine includes: The normalized data stream is processed using the isolated forest algorithm through a first base detector to detect outliers with a globally sparse distribution; and / or; The normalized data stream is processed by a temporal convolutional autoencoder using a second base detector, and complex local temporal anomaly patterns in the data are identified by calculating its reconstruction error; and / or; The standardized data stream is processed by a third-base detector and a support vector machine. Based on the classification boundary established by historical normal data, anomalies deviating from the normal operation mode are identified. The outputs of the first base detector, the second base detector, and the third base detector are received and combined to form an ensemble learning model.

[0047] It should be noted that the base detector refers to the basic, functionally independent anomaly detection algorithm unit that constitutes the ensemble learning model of this application. The Isolation Forest algorithm is an unsupervised algorithm based on decision tree ensembles. It isolates data points by randomly partitioning the feature space; outliers, due to the sparseness of their feature values, can usually be isolated by shorter paths. The Temporal Convolutional Autoencoder is a deep learning model that combines the local feature extraction capabilities of convolutional neural networks with the reconstruction idea of ​​autoencoders. It encodes, compresses, and then decodes the input temporal data, using the magnitude of the reconstruction error to determine anomalies. Support Vector Machines (SVMs) are a typical single-classification model. Their core principle is to find a minimum hyperspherical boundary in a high-dimensional feature space that can enclose the vast majority of normal data points; points falling outside this boundary are considered anomalies.

[0048] This application's embodiments employ three algorithms to specifically detect three common and highly dangerous anomaly types in industrial data: global point anomalies, local context anomalies, and global pattern anomalies. This overcomes the inherent limitations of a single model's detection perspective, thereby achieving high recall, high precision, and high robustness in anomaly detection as a whole.

[0049] Furthermore, the step of performing anomaly detection on the standardized data using a pre-trained ensemble learning model to identify anomalous patterns in the data includes: The outputs of at least three base detectors are fused using a dynamic weighted fusion strategy of the pre-trained ensemble learning model to generate the final anomaly determination result.

[0050] It should be noted that the dynamic weighted fusion strategy refers to a decision-making mechanism adopted by the ensemble learning model in this application. This mechanism does not simply average or vote on the outputs of each base detector, but rather assigns a weight coefficient to each base detector. Furthermore, this weight coefficient is not fixed but can be adjusted according to real-time conditions. The output result refers to each base detector's judgment on whether the current data point or data sequence is abnormal and its confidence level. The final anomaly determination result refers to a unified, quantified anomaly probability or binarized judgment derived by the ensemble learning model after integrating the weighted opinions of all base detectors.

[0051] In one possible implementation, the dynamic weighted fusion strategy assigns weights based on the historical performance of each base detector for the current data's operating condition type, or adjusts them based on the real-time confidence level of each base detector's output.

[0052] This application embodiment uses a dynamic weighting method, which can adaptively evaluate the "voice" of each base detector under different operating conditions or when facing different types of anomalies.

[0053] Furthermore, referring to Figure 3 The third embodiment of the industrial data anomaly attribution method of this application provides a flowchart, based on the above. Figure 3 The embodiment shown further refines the step S40, "in response to detecting the abnormal pattern, performing multi-dimensional attribution analysis on the abnormal pattern based on the association rules constructed from the data topic and data mart to determine the root cause of the anomaly," including steps A301 to A304: Step A301: Based on the data lineage graph and business knowledge graph constructed within the data platform, a multi-dimensional association rule set is formed; It should be noted that, in this embodiment of the application, the data lineage graph refers to a technical graph that describes the complete flow path, dependencies, and evolution of data from its source to processing and consumption in the form of a graph structure; the business knowledge graph refers to a knowledge base formed by structurally modeling entities, concepts, attributes, and their complex relationships in a business domain. The multi-dimensional association rule set refers to a set of logical rules extracted based on the above two types of graphs that can reflect the inherent causal and dependency relationships between data and between businesses.

[0054] Step A302: Map the abnormal pattern to the multi-dimensional association rule set, trace along data lineage and business association, and locate the potential root causes that triggered the abnormal pattern. It should be noted that mapping refers to the process of matching the specific data metrics or business entities involved in the detected abnormal patterns with nodes in a multi-dimensional association rule set. Tracing along data lineage and business relationships means starting from the mapped node, tracing back to the data source direction indicated by the data lineage graph, and simultaneously conducting a diffusion search along the causal relationship chain defined by the business knowledge graph. Potential root causes refer to data anomalies or business events discovered through the above tracing process that are upstream in the causal chain and may have caused the current anomaly.

[0055] Step A303: Calculate the root cause contribution of each potential root cause to the abnormal pattern; It should be noted that root cause contribution refers to a numerical metric used to quantify the extent to which each potential root cause has an impact on the current abnormal pattern, and is designed to distinguish the importance of different causes.

[0056] In one possible implementation, the root cause contribution is calculated by comprehensively weighting the probability of the potential cause co-occurring with the current anomaly pattern in historical anomaly data, the proximity of their occurrence times, and the strength of their relationship in the business knowledge graph.

[0057] Step A304: Sort the potential root causes according to their contribution to the root cause, and determine the potential root cause with the highest ranking as the final root cause of the anomaly.

[0058] It's important to note that ranking refers to arranging all potential root causes from highest to lowest or lowest to highest based on the calculated root cause contribution values. The final root cause refers to the root cause(s) determined by the system to be the most likely and influential after ranking; it is the final output of the entire attribution analysis process. Based on quantified contribution, the most convincing conclusion is drawn from among many possibilities.

[0059] This application's embodiments construct an automated root cause localization system driven by dual graphs (data lineage graph and business knowledge graph) and quantitative contribution assessment. Through graph association, it builds deep business reasoning capabilities, enabling attribution analysis to move beyond shallow data matching and achieve intelligent tracing within a rich semantic network. Furthermore, by introducing a root cause contribution calculation and ranking mechanism, the attribution results are elevated from "probabilistic listing" to "probabilistic decision-making," achieving the differentiation and precise adjudication of multiple potential causes. The final output is an interpretable, actionable, and clearly prioritized root cause conclusion, greatly improving the efficiency and accuracy of operational decisions.

[0060] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the industrial data anomaly attribution method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0061] This application also provides an industrial data anomaly attribution device; please refer to... Figure 4 The industrial data anomaly attribution device includes: Data acquisition module 10 is used to acquire multi-source industrial data in real time; The data governance module 20 is used to standardize the multi-source industrial data and generate a standardized data stream in a unified format. Anomaly detection module 30 is used to perform anomaly detection on the standardized data using a pre-trained ensemble learning model and identify abnormal patterns in the data. The root cause determination module 40 is used to, in response to the detection of the abnormal pattern, perform multi-dimensional attribution analysis on the abnormal data points based on the association rules constructed by the data topic and the data mart, and determine the root cause of the abnormality.

[0062] The industrial data anomaly attribution device provided in this application, employing the industrial data anomaly attribution method in the above embodiments, can solve the technical problems of insufficient accuracy and comprehensiveness in anomaly detection, as well as the disconnect between root cause localization and business context. Compared with the prior art, the beneficial effects of the industrial data anomaly attribution device provided in this application are the same as those of the industrial data anomaly attribution method provided in the above embodiments, and other technical features in the industrial data anomaly attribution device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0063] This application provides an industrial data anomaly attribution device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the industrial data anomaly attribution method in Embodiment 1 above.

[0064] The following is for reference. Figure 5The diagram illustrates a structural schematic suitable for implementing an industrial data anomaly attribution device according to embodiments of this application. The industrial data anomaly attribution device in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The industrial data anomaly attribution device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0065] like Figure 5 As shown, the industrial data anomaly attribution device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the industrial data anomaly attribution device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the industrial data anomaly attribution device to communicate wirelessly or wiredly with other devices to exchange data. While the figures show industrial data anomaly attribution devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0066] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0067] The industrial data anomaly attribution device provided in this application, employing the industrial data anomaly attribution method in the above embodiments, can solve the technical problems of insufficient accuracy and comprehensiveness in anomaly detection, as well as the disconnect between root cause localization and business context. Compared with the prior art, the beneficial effects of the industrial data anomaly attribution device provided in this application are the same as those of the industrial data anomaly attribution method provided in the above embodiments, and other technical features in this industrial data anomaly attribution device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0068] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0069] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0070] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the industrial data anomaly attribution method in the above embodiments.

[0071] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0072] The aforementioned computer-readable storage medium may be included in the industrial data anomaly attribution device; or it may exist independently and not assembled into the industrial data anomaly attribution device.

[0073] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the industrial data anomaly attribution device, the industrial data anomaly attribution device performs the following actions: acquires multi-source industrial data in real time through the data acquisition module of the data platform; performs standardization processing on the multi-source industrial data based on the data governance module of the data platform to generate a standardized data stream in a unified format; performs anomaly detection on the standardized data through a pre-trained ensemble learning model to identify anomaly patterns in the data; and, in response to the detection of the anomaly pattern, performs multi-dimensional attribution analysis on the anomaly pattern based on association rules constructed from data topics and data marts to determine the root cause of the anomaly.

[0074] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0075] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0076] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0077] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described industrial data anomaly attribution method. This addresses the technical problems of insufficient accuracy and comprehensiveness in anomaly detection, as well as the disconnect between root cause localization and business context. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the industrial data anomaly attribution method provided in the above embodiments, and will not be elaborated upon here.

[0078] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the industrial data anomaly attribution method described above.

[0079] The computer program product provided in this application can solve the technical problems of insufficient accuracy and comprehensiveness in anomaly detection, as well as the disconnect between root cause localization and business context. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the industrial data anomaly attribution method provided in the above embodiments, and will not be repeated here.

[0080] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. An industrial data anomaly attribution method, applied to a smart power plant data platform, characterized in that, The industrial data anomaly attribution method includes: Real-time acquisition of multi-source industrial data; The multi-source industrial data is standardized to generate a standardized data stream in a unified format; Anomaly detection is performed on the standardized data using a pre-trained ensemble learning model to identify anomalous patterns in the data. In response to the detection of the abnormal pattern, a multi-dimensional attribution analysis is performed on the abnormal pattern based on the association rules constructed from the data topic and the data mart to determine the root cause of the anomaly.

2. The industrial data anomaly attribution method as described in claim 1, characterized in that, The multi-source industrial data includes at least one or more of the following: equipment operating parameters, process control data, and environmental monitoring data.

3. The industrial data anomaly attribution method as described in claim 2, characterized in that, The step of standardizing the multi-source industrial data to generate a standardized data stream with a unified format includes: The missing points are filled using linear interpolation, and outliers are identified and removed using statistical methods to achieve data cleaning of the multi-source industrial data; Based on the unified time-series service of the data platform, the multi-source industrial data after data cleaning is timestamped to generate a data sequence with unified time granularity. An adaptive min-max normalization method is used to normalize the data sequence with uniform time granularity to obtain a time-aligned standardized data stream.

4. The industrial data anomaly attribution method as described in claim 3, characterized in that, The steps of combining the pre-trained ensemble learning model with the isolated forest algorithm, temporal convolutional autoencoder, and a base detector of a support vector machine include: The normalized data stream is processed using the isolated forest algorithm through a first base detector to detect outliers with a globally sparse distribution; and / or; The normalized data stream is processed by a temporal convolutional autoencoder using a second base detector, and complex local temporal anomaly patterns in the data are identified by calculating its reconstruction error; and / or; The standardized data stream is processed by a third-base detector and a support vector machine. Based on the classification boundary established by historical normal data, anomalies deviating from the normal operation mode are identified. The outputs of the first base detector, the second base detector, and the third base detector are received and combined to form an ensemble learning model.

5. The industrial data anomaly attribution method as described in claim 4, characterized in that, The step of detecting anomalies in the standardized data and identifying anomalous patterns in the data using a pre-trained ensemble learning model includes: The outputs of at least three base detectors are fused using a dynamic weighted fusion strategy of the pre-trained ensemble learning model to generate the final anomaly determination result.

6. The industrial data anomaly attribution method as described in claim 5, characterized in that, The step of responding to the detection of the abnormal pattern by performing multi-dimensional attribution analysis on the abnormal pattern based on association rules constructed from data topics and data marts to determine the root cause of the anomaly includes: Based on the data lineage graph and business knowledge graph constructed within the data platform, a multi-dimensional set of association rules is formed. The abnormal patterns are mapped to the multi-dimensional association rule set, and the data lineage and business associations are traced to locate the potential root causes of the abnormal patterns. Calculate the root cause contribution of each potential root cause to the anomalous pattern; The potential root causes are ranked according to their contribution to the root cause, and the potential root cause with the highest ranking is determined as the ultimate root cause of the anomaly.

7. An industrial data anomaly attribution device, characterized in that, The industrial data anomaly attribution device includes: The data acquisition module is used to acquire multi-source industrial data in real time. The data governance module is used to standardize the multi-source industrial data and generate a standardized data stream in a unified format. An anomaly detection module is used to perform anomaly detection on the standardized data using a pre-trained ensemble learning model, and to identify abnormal patterns in the data. The root cause determination module is used to, in response to the detection of the abnormal pattern, perform multi-dimensional attribution analysis on the abnormal pattern based on the association rules constructed from the data topic and the data mart, and determine the root cause of the abnormality.

8. An industrial data anomaly attribution device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the industrial data anomaly attribution method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the industrial data anomaly attribution method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the industrial data anomaly attribution method as described in any one of claims 1 to 6.

Images