An abnormality diagnosis method, device and medium for multi-modal operation and maintenance data
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-27
- Publication Date
- 2026-05-29
AI Technical Summary
In existing technologies, the process of troubleshooting operational anomalies relies on human judgment, which is inefficient. Furthermore, the lack of effective deep integration of multi-source heterogeneous data at the algorithm level leads to unclear fault propagation paths.
By acquiring multimodal operation and maintenance data, extracting unified timestamp features, constructing a dynamic operation and maintenance knowledge graph, conducting fault propagation analysis, determining node impact scores, locating the root causes of operation and maintenance anomalies, and generating anomaly analysis reports.
It enables automated root cause localization of operational anomalies, reduces reliance on human judgment, and improves anomaly diagnosis efficiency.
Smart Images
Figure CN122111725A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of electrical digital processing technology, and in particular to a method, device and medium for anomaly diagnosis of multimodal operation and maintenance data. Background Technology
[0002] In recent years, with the popularization of cloud computing and microservice architectures, the scale and complexity of modern IT systems have experienced explosive growth, and operations and maintenance (O&M) have entered a new stage centered on data-driven approaches. Enterprises deploy a wide variety of monitoring tools to continuously collect multi-dimensional and heterogeneous O&M data, including system performance metrics, application logs, and trace data, in order to achieve a comprehensive understanding of the system's operational status. Currently, for the processing and analysis of this data, existing technologies often rely on independent monitoring systems to process metrics, logs, and traces separately, or on building a unified log platform for centralized storage and keyword retrieval.
[0003] When operational anomalies occur, operations engineers need to manually correlate alarm information from different data sources and rely on personal experience to troubleshoot within complex service dependency graphs to deduce the root cause of the failure. This presents the following problems: First, the troubleshooting process heavily relies on human judgment, resulting in low efficiency; second, the lack of effective, algorithm-level deep integration between multi-source heterogeneous data makes it impossible to automatically and clearly display the propagation path of the failure within the system dependency chain. Summary of the Invention
[0004] This application provides a method, device, and medium for diagnosing anomalies in multimodal operation and maintenance data, which solves the technical problems in the prior art where the process of troubleshooting operation and maintenance anomalies relies on human judgment and the propagation path is unclear.
[0005] In a first aspect, embodiments of this application provide a method for anomaly diagnosis of multimodal operation and maintenance data. The method includes: acquiring multimodal operation and maintenance data and extracting features from the multimodal operation and maintenance data using a unified timestamp to obtain a multimodal feature set; determining a dynamic operation and maintenance knowledge graph based on the multimodal feature set through dynamic attribute injection of feature graphs; obtaining anomaly state embedding vectors through fault propagation analysis based on the dynamic operation and maintenance knowledge graph; performing node state difference analysis on the dynamic operation and maintenance knowledge graph to determine node influence scores; and performing root cause localization of operation and maintenance anomalies based on the anomaly state embedding vectors and node influence scores to obtain an operation and maintenance data anomaly analysis report.
[0006] In one implementation of this application, the multimodal operation and maintenance data includes: performance indicator data, log data, and trace data. The multimodal operation and maintenance data undergoes unified timestamp feature extraction to obtain a multimodal feature set. Specifically, this includes: performing sliding window standard processing on the performance indicator data to obtain a time-series feature vector; calculating the window occurrence frequency of the log data using templates to determine the log event vector; aggregating the trace data and performing service status analysis on the aggregated trace data to obtain a service link vector; wherein, the service status analysis includes: calculating the average response time, calculating the error rate, and extracting the service call path; and unifying the timestamps of the time-series feature vector, log event vector, and service link vector to obtain the multimodal feature set.
[0007] In one implementation of this application, a dynamic operation and maintenance knowledge graph is determined based on a multimodal feature set and through dynamic attribute injection of the feature graph. Specifically, this includes: obtaining a static topology graph of the system and constructing an initial knowledge graph based on the static topology graph of the system; and injecting graph nodes into the initial knowledge graph according to the multimodal feature set to obtain the dynamic operation and maintenance knowledge graph.
[0008] In one implementation of this application, an abnormal state embedding vector is obtained based on a dynamic operation and maintenance knowledge graph and through fault propagation analysis. Specifically, this includes: embedding operation and maintenance message transmission nodes into the dynamic operation and maintenance knowledge graph to determine message transmission nodes; obtaining simulated potential fault propagation paths by updating the aggregated states of neighboring nodes based on message transmission nodes; acquiring historical root cause nodes and configuring their embedding representations to determine monitoring signals; and obtaining the abnormal state embedding vector based on the embedding differences between the simulated potential fault propagation paths and the monitoring signals.
[0009] In one implementation of this application, a node state difference analysis is performed on the dynamic operation and maintenance knowledge graph to determine the node influence score. Specifically, this includes: performing a node state anomaly analysis on the dynamic operation and maintenance knowledge graph to determine the node behavior deviation; performing a node topology analysis on the dynamic operation and maintenance knowledge graph to determine the node topology centrality; and calculating the node influence score by weighted average based on the node behavior deviation and the node topology centrality.
[0010] In one implementation of this application, the root cause localization of operational anomalies is performed on the abnormal state embedding vector and node influence scores to obtain an operational data anomaly analysis report. Specifically, this includes: sorting the node influence scores, selecting nodes with influence scores greater than a preset threshold after sorting to determine a candidate root cause set; performing contribution relationship analysis on the candidate root cause set of neighboring nodes to obtain the fault propagation path; and integrating the candidate root cause set and the fault propagation path to obtain the operational data anomaly analysis report.
[0011] In one implementation of this application, the contribution relationship analysis of the candidate root cause set of neighboring nodes is performed to obtain the fault propagation path. Specifically, this includes: extracting attention weights from the candidate root cause set to obtain the attention coefficients between neighboring nodes; determining the influence contribution of neighboring nodes to candidate nodes based on the attention coefficients and through node anomaly analysis; and obtaining the fault propagation path by recursively tracing the node contributions according to the influence contribution.
[0012] In one implementation of this application, after performing root cause localization of operational anomalies on the abnormal state embedding vector and node influence score to obtain an operational data anomaly analysis report, the method further includes: visualizing the operational data anomaly analysis report to obtain an operational data anomaly root cause map.
[0013] Secondly, embodiments of this application also provide an anomaly diagnosis device for multimodal operation and maintenance data, characterized in that the device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: acquire multimodal operation and maintenance data, and perform unified timestamp feature extraction on the multimodal operation and maintenance data to obtain a multimodal feature set; determine a dynamic operation and maintenance knowledge graph based on the multimodal feature set through dynamic attribute injection of feature graphs; obtain an abnormal state embedding vector based on the dynamic operation and maintenance knowledge graph through fault propagation analysis; perform node state difference analysis on the dynamic operation and maintenance knowledge graph to determine the node influence score; and perform root cause localization of operation and maintenance anomalies on the abnormal state embedding vector and node influence score to obtain an operation and maintenance data anomaly analysis report.
[0014] Thirdly, embodiments of this application also provide a non-volatile computer storage medium for anomaly diagnosis of multimodal operation and maintenance data, storing computer-executable instructions. The computer-executable instructions are characterized by: acquiring multimodal operation and maintenance data, and extracting features from the multimodal operation and maintenance data using a unified timestamp to obtain a multimodal feature set; determining a dynamic operation and maintenance knowledge graph based on the multimodal feature set through dynamic attribute injection of feature graphs; obtaining anomaly state embedding vectors through fault propagation analysis based on the dynamic operation and maintenance knowledge graph; performing node state difference analysis on the dynamic operation and maintenance knowledge graph to determine node influence scores; and performing root cause localization of operation and maintenance anomalies based on the anomaly state embedding vectors and node influence scores to obtain an operation and maintenance data anomaly analysis report.
[0015] This application provides a method, device, and medium for diagnosing anomalies in multimodal operation and maintenance data. By constructing a dynamic operation and maintenance knowledge graph, analyzing node status differences, and locating the root cause of operation and maintenance anomalies, it solves the technical problems of relying on human judgment and unclear propagation paths in the existing technology for troubleshooting operation and maintenance anomalies. It realizes the root cause location of operation and maintenance, reduces reliance on human judgment, and improves the efficiency of operation and maintenance anomaly diagnosis. Attached Figure Description
[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating an anomaly diagnosis method for multimodal operation and maintenance data provided in this application embodiment; Figure 2 This is a schematic diagram of the internal structure of an anomaly diagnosis device for multimodal operation and maintenance data provided in an embodiment of this application. Detailed Implementation
[0017] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0018] This application provides a method, device, and medium for diagnosing anomalies in multimodal operation and maintenance data. By constructing a dynamic operation and maintenance knowledge graph, analyzing node status differences, and locating the root cause of operation and maintenance anomalies, it solves the technical problems of relying on human judgment and unclear propagation paths in the existing technology for troubleshooting operation and maintenance anomalies. It realizes the root cause location of operation and maintenance, reduces reliance on human judgment, and improves the efficiency of operation and maintenance anomaly diagnosis.
[0019] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.
[0020] Figure 1 A flowchart illustrating a method for anomaly diagnosis of multimodal operation and maintenance data provided in this application embodiment. Figure 1 As shown in the figure, the anomaly diagnosis method for multimodal operation and maintenance data provided in this application embodiment specifically includes the following steps: Step 101: Obtain multimodal operation and maintenance data, and extract features from the multimodal operation and maintenance data using a unified timestamp to obtain a multimodal feature set.
[0021] Specifically, multimodal operation and maintenance data includes: performance indicator data, log data, and trace data. Features are extracted from the multimodal operation and maintenance data using a unified timestamp to obtain a multimodal feature set. This includes: performing sliding window standard processing on performance indicator data to obtain a time-series feature vector; calculating the frequency of window occurrences in templated log data to determine log event vectors; aggregating trace data and performing service status analysis on the aggregated trace data to obtain service link vectors. The service status analysis includes: calculating average response time, error rate, and extracting service call paths. The time-series feature vectors, log event vectors, and service link vectors are then unified with timestamps to obtain the multimodal feature set.
[0022] In one embodiment, the raw operation and maintenance data stream within a 5-minute time window before and after the failure occurs includes: time-series performance metrics such as the CPU utilization and memory usage of the API gateway, unstructured log text, and complete distributed tracing data.
[0023] First, time-series alignment is performed to assign a uniform timestamp to all incoming data. For performance metrics, the system uses sliding window time-series feature extraction to calculate the mean, standard deviation, slope of change, and outliers identified through IQR within each window, forming a comprehensive numerical feature vector.
[0024] For log text, the core is log template and event quantification. The original log is summarized into a finite number of event templates through parsing algorithms, and the frequency of occurrence of each template within the time window is counted to generate log event vectors.
[0025] For trace data, service link performance is aggregated, and the average response time, P95 / P99 latency and error rate are calculated for each service node to produce a service health vector.
[0026] Finally, all feature vectors are aligned and packaged according to a uniform timestamp to obtain a multimodal feature set.
[0027] Step 102: Based on the multimodal feature set, determine the dynamic operation and maintenance knowledge graph through dynamic attribute injection of feature map.
[0028] Specifically, based on a multimodal feature set, a dynamic operation and maintenance knowledge graph is determined through dynamic attribute injection of the feature graph. This includes: obtaining a static topology graph of the system and constructing an initial knowledge graph based on the static topology graph; and injecting graph nodes into the initial knowledge graph according to the multimodal feature set to obtain the dynamic operation and maintenance knowledge graph.
[0029] In one embodiment, the microservice static topology graph exported from the CMDB defines the service nodes and the call dependency edges between them using graph structure data, and includes a multimodal feature set of abnormal characteristics of each service node.
[0030] By using service name identifiers, vectors from the multimodal feature set are dynamically bound to corresponding nodes in the graph. High error log frequency, thread utilization, and operation and maintenance response time data from the operation and maintenance data are injected as real-time attributes of the nodes; at the same time, metrics such as high IO wait time and slow query count are injected into the node attributes.
[0031] Step 103: Based on the dynamic operation and maintenance knowledge graph, obtain the abnormal state embedding vector through fault propagation analysis.
[0032] Specifically, based on the dynamic operation and maintenance knowledge graph, an abnormal state embedding vector is obtained through fault propagation analysis, including: embedding operation and maintenance message transmission nodes into the dynamic operation and maintenance knowledge graph to determine message transmission nodes; obtaining simulated potential fault propagation paths through the aggregation state update of neighbor nodes based on message transmission nodes; acquiring historical root cause nodes and configuring the embedding representation of historical root cause nodes to determine monitoring signals; and obtaining the abnormal state embedding vector based on the embedding differences between the simulated potential fault propagation paths and the monitoring signals.
[0033] In one embodiment, a graph neural network is used for message passing and node embedding in a dynamic operations and maintenance knowledge graph. Each node updates its own representation by aggregating the state features of its neighboring nodes to simulate potential propagation paths of faults in the call chain.
[0034] During the training phase, historically identified root cause node labels are used as supervision information. The goal of the GNN model is to learn to cause a significant change in its embedding representation when a node fails.
[0035] Step 104: Perform node state difference analysis on the dynamic operation and maintenance knowledge graph to determine the node influence score.
[0036] Specifically, a node state difference analysis is performed on the dynamic operation and maintenance knowledge graph to determine the node influence score, including: a node state anomaly analysis is performed on the dynamic operation and maintenance knowledge graph to determine the node behavior deviation; a node topology analysis is performed on the dynamic operation and maintenance knowledge graph to determine the node topology centrality; and a node influence score is determined by weighted average calculation based on the node behavior deviation and the node topology centrality.
[0037] In one embodiment, a node influence score is defined. For each node, the difference between its current embedding and the normal state embedding is calculated, and combined with its centrality index across the entire graph, to obtain a comprehensive anomaly score.
[0038] State anomaly degree requires determining the GNN output embedding vector of the node in the current fault time window and the baseline embedding vector of the node in the historical normal state. The difference between the current embedding and the normal baseline embedding can be calculated by cosine similarity, and the selected difference metric result is normalized by Min-Max and mapped to the interval [0, 1] to obtain the state anomaly degree.
[0039] Node topological centrality requires betweenness centrality and proximity centrality analysis of the static topological graph. Betweenness centrality is determined by the ratio of the number of nodes traversed by the shortest path to the total number of shortest paths, and proximity centrality is determined by the ratio of the total number of nodes in the graph to the sum of the distances of the shortest paths.
[0040] Finally, a weighted average of the node behavior deviation and the node topological centrality is calculated to obtain the node influence score.
[0041] Step 105: Locate the root cause of operational anomalies by analyzing the abnormal state embedding vector and node impact score to obtain an operational data anomaly analysis report.
[0042] Specifically, the root cause localization of operational anomalies is performed on the abnormal state embedding vector and node influence scores to obtain an operational data anomaly analysis report. This includes: sorting the node influence scores, selecting nodes with influence scores greater than a preset threshold after sorting to determine the candidate root cause set; analyzing the contribution relationship between neighboring nodes of the candidate root cause set to obtain the fault propagation path; and integrating the candidate root cause set and the fault propagation path to obtain the operational data anomaly analysis report.
[0043] Furthermore, the contribution relationship analysis of neighboring nodes is performed on the candidate root cause set to obtain the fault propagation path. Specifically, this includes: extracting attention weights from the candidate root cause set to obtain the attention coefficients between neighboring nodes; based on the attention coefficients, determining the influence contribution of neighboring nodes to candidate nodes through node anomaly analysis; and obtaining the fault propagation path by recursively tracing node contributions based on the influence contribution.
[0044] Furthermore, after performing root cause localization of operational anomalies by analyzing the abnormal state embedding vector and node influence scores to obtain an operational data anomaly analysis report, the method also includes: visualizing the operational data anomaly analysis report to obtain an operational data anomaly root cause map.
[0045] In one embodiment, firstly, based on the list of node influence scores, one or a few nodes with the highest scores are automatically selected using a predefined threshold or sorting strategy and marked as candidate root cause nodes. Subsequently, to explain why these candidate nodes achieved high scores, interpretable AI technology is invoked to analyze the attention weight data within the model, quantifying the contribution of other nodes and connecting edges in the graph to the high scores of the candidate nodes.
[0046] By identifying the most contributing connections and recursively tracing these high-weight connections, the system automatically constructs key influence paths from potential sources to core candidate nodes.
[0047] Finally, a structured interpretability analysis report is generated, which represents the key impact paths in the form of a graph and associates the original feature data of each node on the path as evidence.
[0048] The above are embodiments of the method proposed in this application. Based on the same inventive concept, embodiments of this application also provide a device, the structure of which is as follows: Figure 2 As shown.
[0049] Figure 2 This is a schematic diagram of the internal structure of a device provided in an embodiment of this application. Figure 2 As shown, the device includes: At least one processor 201; And a memory 202 that is communicatively connected to at least one processor; The memory 202 stores instructions executable by at least one processor, which are executed by at least one processor 201 to enable at least one processor 201 to: Acquire multimodal operation and maintenance data, and extract features from the multimodal operation and maintenance data using a unified timestamp to obtain a multimodal feature set; based on the multimodal feature set, determine a dynamic operation and maintenance knowledge graph through dynamic attribute injection of feature graphs; based on the dynamic operation and maintenance knowledge graph, obtain abnormal state embedding vectors through fault propagation analysis; perform node state difference analysis on the dynamic operation and maintenance knowledge graph to determine node influence scores; perform root cause localization of operation and maintenance anomalies based on abnormal state embedding vectors and node influence scores to obtain an operation and maintenance data anomaly analysis report.
[0050] Some embodiments of this application provide corresponding to Figure 1 A non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured as follows: Acquire multimodal operation and maintenance data, and extract features from the multimodal operation and maintenance data using a unified timestamp to obtain a multimodal feature set; based on the multimodal feature set, determine a dynamic operation and maintenance knowledge graph through dynamic attribute injection of feature graphs; based on the dynamic operation and maintenance knowledge graph, obtain abnormal state embedding vectors through fault propagation analysis; perform node state difference analysis on the dynamic operation and maintenance knowledge graph to determine node influence scores; perform root cause localization of operation and maintenance anomalies based on abnormal state embedding vectors and node influence scores to obtain an operation and maintenance data anomaly analysis report.
[0051] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for IoT devices and media are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.
[0052] The systems, media, and methods provided in this application are one-to-one correspondences. Therefore, the systems and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the systems and media will not be repeated here.
[0053] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0054] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0055] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0056] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0057] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0058] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0059] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0060] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0061] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. A method for anomaly diagnosis of multimodal operation and maintenance data, characterized in that, The method includes: Acquire multimodal operation and maintenance data, and extract features from the multimodal operation and maintenance data using a unified timestamp to obtain a multimodal feature set; Based on the multimodal feature set, a dynamic operation and maintenance knowledge graph is determined through dynamic attribute injection of feature maps; Based on the dynamic operation and maintenance knowledge graph, anomaly state embedding vectors are obtained through fault propagation analysis; Perform node state difference analysis on the dynamic operation and maintenance knowledge graph to determine the node influence score; The root cause of the operational anomaly is located by analyzing the embedded vector of the abnormal state and the node influence score to obtain an operational data anomaly analysis report.
2. The anomaly diagnosis method for multimodal operation and maintenance data according to claim 1, characterized in that, The multimodal operation and maintenance data includes: performance indicator data, log data, and trace data; The multimodal operation and maintenance data undergoes unified timestamp feature extraction to obtain a multimodal feature set, specifically including: The performance index data is subjected to sliding window standard processing to obtain a time-series feature vector; The frequency of occurrence of templated windows is calculated in the log data to determine the log event vector; The trace data is aggregated, and the service status of the service components is analyzed on the aggregated trace data to obtain the service link vector; wherein, the service status analysis includes: average response time calculation, error rate calculation, and service call path extraction; The time-series feature vector, the log event vector, and the service link vector are timestamped to obtain the multimodal feature set.
3. The anomaly diagnosis method for multimodal operation and maintenance data according to claim 1, characterized in that, Based on the multimodal feature set, a dynamic operation and maintenance knowledge graph is determined through dynamic attribute injection of the feature map, specifically including: Obtain the static topology graph of the system, and construct an initial knowledge graph based on the static topology graph of the system; Based on the multimodal feature set, graph nodes are injected into the initial knowledge graph to obtain the dynamic operation and maintenance knowledge graph.
4. The anomaly diagnosis method for multimodal operation and maintenance data according to claim 1, characterized in that, Based on the dynamic operation and maintenance knowledge graph, anomaly state embedding vectors are obtained through fault propagation analysis, specifically including: Embed the message transmission nodes of the dynamic operation and maintenance knowledge graph to determine the message transmission nodes; Based on the message passing node, the potential propagation path of the simulated fault is obtained through the aggregated state update of the neighboring nodes; Obtain historical root cause nodes and configure embedded representations of the historical root cause nodes to determine supervision signals; The abnormal state embedding vector is obtained based on the potential propagation path of the simulated fault and the embedding difference corresponding to the monitoring signal.
5. The anomaly diagnosis method for multimodal operation and maintenance data according to claim 1, characterized in that, The dynamic operation and maintenance knowledge graph is analyzed for node state differences to determine the node influence score, specifically including: Perform node state anomaly analysis on the dynamic operation and maintenance knowledge graph to determine the deviation of node behavior; Perform node topology analysis on the dynamic operation and maintenance knowledge graph to determine the node topology centrality; Based on the node behavior deviation and the node topological centrality, the node influence score is determined by weighted average calculation.
6. The anomaly diagnosis method for multimodal operation and maintenance data according to claim 1, characterized in that, The root cause of operational anomalies is located by analyzing the abnormal state embedding vector and the node influence score to obtain an operational data anomaly analysis report, specifically including: The node influence scores are sorted, and nodes with influence scores greater than a preset threshold are selected to determine the candidate root cause set. The contribution relationship analysis of neighbor nodes is performed on the candidate root cause set to obtain the fault propagation path; The candidate root cause set and the fault propagation path are integrated to obtain the operation and maintenance data anomaly analysis report.
7. The anomaly diagnosis method for multimodal operation and maintenance data according to claim 6, characterized in that, The contribution relationship analysis of neighbor nodes is performed on the candidate root cause set to obtain the fault propagation path, specifically including: Attention weights are extracted from the candidate root cause set to obtain the attention coefficients between neighboring nodes; Based on the attention coefficient, the influence contribution of neighboring nodes to candidate nodes is determined through node anomaly analysis. Based on the impact contribution, the fault propagation path is obtained by recursively tracing the node contributions.
8. The anomaly diagnosis method for multimodal operation and maintenance data according to claim 1, characterized in that, After performing root cause localization of the operational anomalies on the abnormal state embedding vector and the node influence score to obtain an operational data anomaly analysis report, the method further includes: The operation and maintenance data anomaly analysis report is visualized to obtain the root cause diagram of operation and maintenance data anomalies.
9. An anomaly diagnosis device for multimodal operation and maintenance data, characterized in that, The device includes: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: Acquire multimodal operation and maintenance data, and extract features from the multimodal operation and maintenance data using a unified timestamp to obtain a multimodal feature set; Based on the multimodal feature set, a dynamic operation and maintenance knowledge graph is determined through dynamic attribute injection of feature maps; Based on the dynamic operation and maintenance knowledge graph, anomaly state embedding vectors are obtained through fault propagation analysis; Perform node state difference analysis on the dynamic operation and maintenance knowledge graph to determine the node influence score; The root cause of the operational anomaly is located by analyzing the embedded vector of the abnormal state and the node influence score to obtain an operational data anomaly analysis report.
10. A non-volatile computer storage medium for anomaly diagnosis of multimodal operation and maintenance data, storing computer-executable instructions, characterized in that, The computer-executable instructions are set as follows: Acquire multimodal operation and maintenance data, and extract features from the multimodal operation and maintenance data using a unified timestamp to obtain a multimodal feature set; Based on the multimodal feature set, a dynamic operation and maintenance knowledge graph is determined through dynamic attribute injection of feature maps; Based on the dynamic operation and maintenance knowledge graph, anomaly state embedding vectors are obtained through fault propagation analysis; Perform node state difference analysis on the dynamic operation and maintenance knowledge graph to determine the node influence score; The root cause of the operational anomaly is located by analyzing the embedded vector of the abnormal state and the node influence score to obtain an operational data anomaly analysis report.