Regulation system operation event rule analysis method and device, medium and equipment

Abstract

The disclosure provides a kind of regulation system operation event rule analysis method, it is related to electric power system technical field.This method is carried out data processing by operation alarm data, obtains the characteristic attribute of operating state;According to the feature attribute, graph coloring is carried out on knowledge graph, and colored knowledge graph is generated;According to the subgraph mining algorithm of frequent subgraph, subgraph mining is carried out on colored knowledge graph, and multiple frequent subgraphs are obtained;According to the frequent subgraph, reverse calculation is carried out, and the alarm sequence constituting event is obtained;According to the center degree algorithm, each frequent subgraph is calculated, and the center degree of frequent subgraph is obtained;Based on the center degree of multiple frequent subgraphs, root cause frequent subgraph is obtained;The alarm sequence and root cause frequent subgraph are analyzed, and analysis result is obtained;Based on analysis result and regulation operation procedure requirement, typical event rule is generated.It can realize when facing mass data, saves manpower processing cost, avoids misjudgment, can improve the efficiency of mining event rule.

Description

Technical Field

[0001] This disclosure relates to the field of power system technology, and in particular to a method, apparatus, medium and equipment for analyzing operation event rules of a control system. Background Technology

[0002] As a crucial technical means for power grid enterprises to control grid operation and manage dispatching production, the dispatch control system is a key infrastructure for ensuring the safe operation of the power grid. In recent years, with the expansion of the power grid and the continuous increase in connected objects, the main requirement of monitoring operations has become how to fully explore the event rules in alarms, aggregate scattered alarm signals into logically related events, and transform signal processing into event processing.

[0003] Most existing technical solutions record and store event rules by manually identifying them from massive amounts of historical alarm data and combining them with personal experience. However, it is difficult for humans to process massive amounts of historical data, which can easily lead to misjudgments and omissions, resulting in low efficiency in mining event rules.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this disclosure is to provide a method, apparatus, medium, and equipment for analyzing event rules in a control system, which at least to some extent overcomes the problem of low mining efficiency caused by misjudgment and omission when manually mining event rules.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, a method for analyzing operational event rules of a control system is provided, comprising:

[0008] Obtain runtime alarm data;

[0009] Obtain a knowledge graph of the operational events of the control system;

[0010] The operational alarm data is processed to obtain the characteristic attributes of the operational status;

[0011] The knowledge graph is colored according to the feature attributes to generate a colored knowledge graph.

[0012] The colorized knowledge graph is subgraphed using a frequent subgraph mining algorithm to obtain multiple frequent subgraphs.

[0013] Based on the frequent subgraph, reverse calculation is performed to obtain the alarm sequence that constitutes the event;

[0014] The centrality of each frequent subgraph is calculated according to the centrality algorithm to obtain the centrality of the frequent subgraph;

[0015] Based on the centrality of multiple frequent subgraphs, the root cause frequent subgraphs are obtained;

[0016] The alarm sequence and the root cause frequent subgraph are analyzed to obtain the analysis results;

[0017] Based on the analysis results and the requirements of the control and operation procedures, typical event rules are generated.

[0018] In one embodiment of this disclosure, the step of processing the operational alarm data to obtain characteristic attributes of the operational status includes:

[0019] The alarm data is segmented, understood, and fused according to a natural language processing algorithm to obtain first processed data, wherein the first processed data includes alarm objects and alarm content;

[0020] The first processed data is statistically processed and the alarm frequency is marked to obtain the second processed data;

[0021] The second processed data is filtered to obtain the feature attributes.

[0022] In one embodiment of this disclosure, the step of coloring the knowledge graph according to the feature attributes to generate a colored knowledge graph includes: coloring network elements according to entities and relationships related to the feature attributes to generate a colored knowledge graph.

[0023] In one embodiment of this disclosure, the method further includes:

[0024] Obtain the event nodes in the knowledge graph;

[0025] The knowledge graph is processed based on a graph neural network model to generate feature vector sets corresponding to event nodes;

[0026] The similarity between the feature vectors corresponding to two event nodes in the feature vector set is calculated to obtain the calculation result.

[0027] The rule items of the typical event rule are judged based on the calculation results to obtain the judgment result;

[0028] If the determination result indicates that there are missing or conflicting rule items in the typical event rule, then the rule items will be supplemented and improved.

[0029] In one embodiment of this disclosure, the similarity calculation of the feature vectors corresponding to two event nodes in the feature vector set includes: calculating the similarity of the feature vectors corresponding to two event nodes in the feature vector set based on the cosine similarity algorithm.

[0030] According to another aspect of this disclosure, a system operation event rule analysis apparatus is provided, comprising:

[0031] The first acquisition module is used to acquire runtime alarm data;

[0032] The second acquisition module is used to regulate the knowledge graph of system operation events;

[0033] The data processing module is used to process the operation alarm data to obtain the characteristic attributes of the operation status;

[0034] The graph coloring module is used to color the knowledge graph according to the feature attributes to generate a colored knowledge graph.

[0035] The subgraph mining module is used to perform subgraph mining on the colored knowledge graph according to the frequent subgraph mining algorithm to obtain multiple frequent subgraphs;

[0036] The deduction module is used to perform reverse deduction based on the frequent subgraph to obtain the alarm sequence that constitutes the event;

[0037] The calculation module is used to calculate the centrality of each frequent subgraph according to the centrality algorithm to obtain the centrality of the frequent subgraph.

[0038] The root cause acquisition module is used to obtain the root cause frequent subgraphs based on the centrality of multiple frequent subgraphs;

[0039] The analysis module is used to analyze the alarm sequence and the root cause frequent subgraph to obtain analysis results;

[0040] The generation module is used to generate typical event rules based on the analysis results and the requirements of the control operation procedures.

[0041] In one embodiment of this disclosure, the apparatus further includes:

[0042] The language processing module is used to segment, understand, and fuse the alarm data according to the natural language processing algorithm to obtain first processed data, wherein the first processed data includes alarm objects and alarm content;

[0043] The statistical labeling module is used to perform statistical processing on the first processed data and label the alarm frequency to obtain the second processed data;

[0044] The data filtering module is used to filter the second processed data to obtain the feature attributes.

[0045] In one embodiment of this disclosure, the apparatus further includes:

[0046] A node acquisition module is used to acquire event nodes in the knowledge graph.

[0047] The graph processing module is used to process the knowledge graph based on the graph neural network model to generate feature vector sets corresponding to event nodes;

[0048] The vector calculation module is used to calculate the similarity between the feature vectors corresponding to two event nodes in the feature vector set and obtain the calculation result.

[0049] The determination module is used to determine the rule items of the typical event rule based on the calculation results and obtain the determination result;

[0050] The determination and processing module is used to supplement and improve the rule items if the determination result indicates that there are missing or conflicting rule items in the typical event rule.

[0051] According to another aspect of this disclosure, an electronic device is provided, characterized in that it comprises:

[0052] Processor; and

[0053] Memory for storing the executable instructions of the processor;

[0054] The processor is configured to execute the above-described method for analyzing rules governing system operation events by executing the executable instructions.

[0055] According to another aspect of this disclosure, a computer-readable storage medium is provided, on which a computer program is stored, characterized in that, when the computer program is executed by a processor, it implements the above-described method for analyzing rules governing system operation events.

[0056] The embodiments of this disclosure provide a method for analyzing operational event rules in a control system. This method processes operational alarm data to obtain characteristic attributes of the operational status; it then colors a knowledge graph based on these characteristic attributes to generate a colored knowledge graph; it performs subgraph mining on the colored knowledge graph using a frequent subgraph mining algorithm to obtain multiple frequent subgraphs; it uses reverse inference based on the frequent subgraphs to obtain alarm sequences constituting events; it calculates the centrality of each frequent subgraph using a centrality algorithm; it obtains root cause frequent subgraphs based on the centralities of multiple frequent subgraphs; it analyzes the alarm sequences and root cause frequent subgraphs to obtain analysis results; and it generates typical event rules based on the analysis results and the requirements of the control operation procedures. This approach saves manpower processing costs when dealing with massive amounts of data, avoids misjudgments and omissions, and improves the efficiency of mining event rules.

[0057] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0058] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0059] Figure 1 A flowchart of a method for analyzing rules of operation events in a control system is shown in an embodiment of this disclosure.

[0060] Figure 2 yes Figure 1 Another flowchart of a method for analyzing the operational event rules of a control system.

[0061] Figure 3 yes Figure 1 Another flowchart of a method for analyzing the operational event rules of a control system.

[0062] Figure 4 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0063] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0064] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0065] The exemplary embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0066] Figure 1 A flowchart of a method for analyzing rules of operation events in a control system is shown in an embodiment of this disclosure.

[0067] refer to Figure 1 This is applied to a method for analyzing operational event rules in a control system, including:

[0068] Step S102: Obtain operational alarm data;

[0069] Step S104: Obtain the knowledge graph of the operation events of the control system;

[0070] Step S106: Process the operation alarm data to obtain the characteristic attributes of the operation status;

[0071] Step S108: Color the knowledge graph according to the feature attributes to generate a colored knowledge graph;

[0072] Step S110: Perform subgraph mining on the colored knowledge graph according to the frequent subgraph mining algorithm to obtain multiple frequent subgraphs;

[0073] Step S112: Perform reverse calculation based on the frequent subgraph to obtain the alarm sequence that constitutes the event;

[0074] Step S114: Calculate the centrality of each frequent subgraph according to the centrality algorithm to obtain the centrality of the frequent subgraph;

[0075] Step S116: Obtain the root cause frequent subgraph based on the centrality of the multiple frequent subgraphs;

[0076] Step S118: Analyze the alarm sequence and the root cause frequent subgraph to obtain the analysis results;

[0077] Step S120: Based on the analysis results and the requirements of the control operation procedure, generate typical event rules.

[0078] Specifically, the process involves processing alarm data to obtain characteristic attributes of the operational status; coloring the knowledge graph based on these attributes to generate a colored knowledge graph; performing subgraph mining on the colored knowledge graph using a frequent subgraph mining algorithm to obtain multiple frequent subgraphs; using these frequent subgraphs for reverse inference to obtain the alarm sequence constituting the event; calculating the centrality of each frequent subgraph using a centrality algorithm; obtaining the root cause frequent subgraph based on the centralities of multiple frequent subgraphs; analyzing the alarm sequence and the root cause frequent subgraph to obtain analysis results; and generating typical event rules based on the analysis results and the requirements of the control operation procedures. This approach saves manpower processing costs when dealing with massive amounts of data, avoids misjudgments and omissions, and improves the efficiency of mining event rules.

[0079] The following sections respectively address... Figure 1 The steps in the process will be explained in detail.

[0080] In step S102, the running alarm data is obtained.

[0081] The acquired alarm data may include: alarm level, alarm object, alarm type, alarm scope details, and alarm time. The alarm object may include: device, channel, network link, program, application, and database.

[0082] In step S104, a knowledge graph of the operation events of the control system is obtained.

[0083] By controlling various objects closely related to the operational status of the control system, such as equipment, channels, network links, programs, applications, and databases, entity recognition, knowledge extraction, and knowledge fusion technologies are used to extract entities, attributes, and relationships from the data, and a knowledge graph of the operation events of the control system is constructed.

[0084] In step S106, the running alarm data is processed to obtain the characteristic attributes of the running status.

[0085] refer to Figure 2 Step S106 above may include:

[0086] The alarm data is segmented, understood, and fused according to a natural language processing algorithm to obtain first processed data, wherein the first processed data includes alarm objects and alarm content;

[0087] The first processed data is statistically processed and the alarm frequency is marked to obtain the second processed data;

[0088] The second processed data is filtered to obtain the feature attributes.

[0089] Natural Language Processing (NLP) is a subfield of Artificial Intelligence (AI). Major research areas in NLP include information extraction, text generation, question-answering systems, dialogue systems, text mining, speech recognition, speech synthesis, sentiment analysis, and machine translation. It can extract characteristic attributes that characterize the operational status of a control system from large amounts of raw alarm data. These characteristic attributes can include: the IP address, port, and traffic volume of the alarm device, etc.

[0090] In step S108, the knowledge graph is colored according to the feature attributes to generate a colored knowledge graph.

[0091] Network elements can be colored based on entities and relationships related to the aforementioned feature attributes, generating a colored knowledge graph. For example, based on the alarm time slice and alarm impact range, network elements related to feature attributes can be colored on the knowledge graph. For instance, a time slice can be selected to color the devices that generated abnormal events on the knowledge graph. In the actual implementation using the graph database Neo4j, only a label needs to be added to the corresponding node.

[0092] In step S110, the colorized knowledge graph is subjected to subgraph mining according to the frequent subgraph mining algorithm to obtain multiple frequent subgraphs.

[0093] Frequent subgraph mining algorithms are simple methods that use recursive counting to discover all frequent subgraphs. For example, frequent subgraph mining using support as a metric measures the number of times a subgraph appears in the input graph data, identifying subgraphs that appear more than a preset number of times as frequent subgraphs.

[0094] In step S112, the alarm sequence constituting the event is obtained by reverse calculation based on the frequent subgraph.

[0095] By mining association rules, several sets of frequent subgraphs that repeatedly and co-occur in the operation data of the control system can be obtained. The corresponding system alarms can be deduced from these frequent subgraphs to obtain the alarm sequence that constitutes the event.

[0096] In step S114, the centrality of each frequent subgraph is calculated according to the centrality algorithm to obtain the centrality of the frequent subgraph.

[0097] The Closeness Centrality algorithm calculates the reciprocal of the shortest distance from a node to all other reachable nodes, accumulates these distances, and then normalizes the result. Centrality measures the time it takes for information to travel from a given node to other nodes. The higher a node's Closeness Centrality, the closer it is to the center of the graph; that is, the entity with the highest centrality may correspond to the core alarm of an event, or even the root cause of the entire event.

[0098] In step S116, a root cause frequent subgraph is obtained based on the centrality of the multiple frequent subgraphs.

[0099] By calculating the centrality of each frequent subgraph and sorting the centralities from high to low, the entity with the highest centrality may correspond to the core alarm of the event, or it may be the root cause of the entire event.

[0100] In step S118, the alarm sequence and the root cause frequent subgraph are analyzed to obtain the analysis results.

[0101] The alarm sequence can include at least one alarm event between two IP addresses arranged in chronological order of occurrence. By combining root cause frequency analysis, details of device usage, the scope of device impact, and the cause of device failure can be obtained.

[0102] In step S120, typical event rules are generated based on the analysis results and the requirements of the control operation procedures.

[0103] Based on the analysis results of the event alarm sequence and root cause frequent subgraph, and combined with the requirements of professional operating procedures, the operating events are summarized and refined, and event type names are assigned to form typical event rules for the operation of the control system.

[0104] refer to Figure 3 The method for analyzing the rules of operation events in the control system also includes:

[0105] Step S302: Obtain event nodes in the knowledge graph.

[0106] Step S304: Process the knowledge graph based on the graph neural network model to generate feature vector sets corresponding to event nodes.

[0107] Among them, graph embedding based on graph neural networks is used to transform events in knowledge graphs into low-dimensional dense vectorized representations, while ensuring that the properties of knowledge graph data can also be obtained in vector space, so that computers can compare and calculate the similarity of events.

[0108] Step S306: Calculate the similarity between the feature vectors corresponding to the two event nodes in the feature vector set, and obtain the calculation result.

[0109] The similarity calculation of the feature vectors corresponding to two event nodes in the feature vector set includes: calculating the similarity of the feature vectors corresponding to two event nodes in the feature vector set based on the cosine similarity algorithm.

[0110] Step S308: Determine the rule items of the typical event rule based on the calculation results to obtain the determination result.

[0111] The similarity of events can be evaluated using the cosine of the angle between the corresponding vectors of two events. A cosine similarity of 1 indicates that the two events are most similar, i.e., they are identical events; a cosine similarity of 0 indicates that the two events are completely different. Comparing the cosine similarity of similar events can verify the validation rules. For example, if the calculated cosine similarity of two events is within a preset threshold range, then the rule terms of the typical event rule are not missing or conflicting; if the calculated cosine similarity of two events is not within the preset threshold range, then the rule terms of the typical event rule are missing or conflicting.

[0112] Step S310: If the determination result indicates that there are missing or conflicting rule items in the typical event rule, then the rule items are supplemented and improved.

[0113] Specifically, the knowledge graph is processed using a graph neural network model to generate feature vector sets corresponding to event nodes. Then, the similarity between feature vectors corresponding to two event nodes in the feature vector sets is calculated. Based on the calculation results, the rule items of typical event rules are judged. If the judgment result indicates that the rule items of typical event rules are missing or conflicting, the rule items are supplemented and improved. This allows for the verification of the rule items of typical event rules, identifying missing and conflicting parts, and thus improving the typical event rules.

[0114] A system operation event rule analysis device includes a first acquisition module, a second acquisition module, a data processing module, a graph coloring module, a subgraph mining module, an inference module, a calculation module, a root cause acquisition module, an analysis module, and a generation module.

[0115] The first acquisition module is used to acquire runtime alarm data;

[0116] The second acquisition module is used to regulate the knowledge graph of system operation events;

[0117] The data processing module is used to process the operation alarm data to obtain the characteristic attributes of the operation status;

[0118] The graph coloring module is used to color the knowledge graph according to the feature attributes to generate a colored knowledge graph.

[0119] The subgraph mining module is used to perform subgraph mining on the colored knowledge graph according to the frequent subgraph mining algorithm to obtain multiple frequent subgraphs;

[0120] The deduction module is used to perform reverse deduction based on the frequent subgraph to obtain the alarm sequence that constitutes the event;

[0121] The calculation module is used to calculate the centrality of each frequent subgraph according to the centrality algorithm to obtain the centrality of the frequent subgraph.

[0122] The root cause acquisition module is used to obtain the root cause frequent subgraphs based on the centrality of multiple frequent subgraphs;

[0123] The analysis module is used to analyze the alarm sequence and the root cause frequent subgraph to obtain analysis results;

[0124] The generation module is used to generate typical event rules based on the analysis results and the requirements of the control operation procedures.

[0125] A system operation event rule analysis device further includes a language processing module, a statistical labeling module, and a data filtering module.

[0126] The language processing module is used to segment, understand, and fuse the alarm data according to the natural language processing algorithm to obtain first processed data, wherein the first processed data includes alarm objects and alarm content;

[0127] The statistical labeling module is used to perform statistical processing on the first processed data and label the alarm frequency to obtain the second processed data;

[0128] The data filtering module is used to filter the second processed data to obtain the feature attributes.

[0129] A system operation event rule analysis device further includes a node acquisition module, a graph processing module, a vector calculation module, a judgment module, and a judgment processing module.

[0130] A node acquisition module is used to acquire event nodes in the knowledge graph.

[0131] The graph processing module is used to process the knowledge graph based on the graph neural network model to generate feature vector sets corresponding to event nodes;

[0132] The vector calculation module is used to calculate the similarity between the feature vectors corresponding to two event nodes in the feature vector set and obtain the calculation result.

[0133] The determination module is used to determine the rule items of the typical event rule based on the calculation results and obtain the determination result;

[0134] The determination and processing module is used to supplement and improve the rule items if the determination result indicates that there are missing or conflicting rule items in the typical event rule.

[0135] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0136] The following reference Figure 4 To describe an electronic device 400 according to this embodiment of the present invention. Figure 4 The electronic device 400 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0137] like Figure 4 As shown, the electronic device 400 is manifested in the form of a general-purpose computing device. The components of the electronic device 400 may include, but are not limited to: at least one processing unit 410, at least one storage unit 420, and a bus 430 connecting different system components (including storage unit 420 and processing unit 410).

[0138] The storage unit stores program code that can be executed by the processing unit 410, causing the processing unit 410 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 410 can perform actions such as... Figure 1The steps shown are as follows: S102, acquiring operational alarm data; S104, acquiring a knowledge graph of operational events in the control system; S106, processing the operational alarm data to obtain characteristic attributes of the operational status; S108, coloring the knowledge graph according to the characteristic attributes to generate a colored knowledge graph; S110, performing subgraph mining on the colored knowledge graph using a frequent subgraph mining algorithm to obtain multiple frequent subgraphs; S112, performing reverse inference based on the frequent subgraphs to obtain the alarm sequence constituting the event; S114, calculating the centrality of each frequent subgraph using a centrality algorithm to obtain the centrality of the frequent subgraph; S116, obtaining a root cause frequent subgraph based on the centrality of multiple frequent subgraphs; S118, analyzing the alarm sequence and the root cause frequent subgraph to obtain analysis results; and S120, generating typical event rules based on the analysis results and the requirements of the control operation procedures.

[0139] Storage unit 420 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 4201 and / or cache memory 4202, and may further include a read-only memory (ROM) 4203.

[0140] Storage unit 420 may also include a program / utility 4204 having a set (at least one) program module 4205, such program module 4205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0141] Bus 430 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0142] Electronic device 400 can also communicate with one or more external devices 500 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 400, and / or with any device that enables electronic device 400 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 450. Furthermore, electronic device 400 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 460. As shown, network adapter 460 communicates with other modules of electronic device 400 via bus 430. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0143] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0144] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0145] A program product for implementing the above-described method according to embodiments of the present invention is described. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0146] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0147] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0148] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0149] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0150] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0151] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0152] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0153] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method for analyzing operational event rules of a control system, characterized in that, include: Obtain runtime alarm data; Obtain a knowledge graph of the operational events of the control system; The operational alarm data is processed to obtain the characteristic attributes of the operational status; The characteristic attributes include: the IP address, port, and traffic volume of the alarm device; The knowledge graph is colored according to the feature attributes to generate a colored knowledge graph. The colorized knowledge graph is subgraphed using a frequent subgraph mining algorithm to obtain multiple frequent subgraphs. Based on the frequent subgraph, reverse calculation is performed to obtain the alarm sequence that constitutes the event; The centrality of each frequent subgraph is calculated according to the centrality algorithm to obtain the centrality of the frequent subgraph; Based on the centrality of multiple frequent subgraphs, the root cause frequent subgraphs are obtained; The alarm sequence and the root cause frequent subgraph are analyzed to obtain the analysis results; Based on the analysis results and the requirements of the control and operation procedures, typical event rules are generated. The process of processing the operational alarm data to obtain characteristic attributes of the operational status includes: The alarm data is segmented, understood, and fused according to a natural language processing algorithm to obtain first processed data, wherein the first processed data includes alarm objects and alarm content; The first processed data is statistically processed and the alarm frequency is marked to obtain the second processed data; The second processed data is filtered to obtain the feature attributes; The method further includes: Obtain the event nodes in the knowledge graph; The knowledge graph is processed based on a graph neural network model to generate feature vector sets corresponding to event nodes; The similarity between the feature vectors corresponding to two event nodes in the feature vector set is calculated to obtain the calculation result. The rule items of the typical event rule are judged based on the calculation results to obtain the judgment result; If the determination result indicates that there are missing or conflicting rule items in the typical event rule, then the rule items will be supplemented and improved.

2. The method for analyzing operational event rules of a control system according to claim 1, characterized in that, The step of coloring the knowledge graph according to the feature attributes to generate a colored knowledge graph includes: coloring network elements according to entities and relationships related to the feature attributes to generate a colored knowledge graph.

3. The method for analyzing operational event rules of a control system according to claim 1, characterized in that, The step of calculating the similarity between the feature vectors corresponding to two event nodes in the feature vector set includes: calculating the similarity between the feature vectors corresponding to two event nodes in the feature vector set based on the cosine similarity algorithm.

4. A system operation event rule analysis device, characterized in that, include: The first acquisition module is used to acquire runtime alarm data; The second acquisition module is used to regulate the knowledge graph of system operation events; The data processing module is used to process the operation alarm data to obtain the characteristic attributes of the operation status; The graph coloring module is used to color the knowledge graph according to the feature attributes to generate a colored knowledge graph. The subgraph mining module is used to perform subgraph mining on the colored knowledge graph according to the frequent subgraph mining algorithm to obtain multiple frequent subgraphs; The deduction module is used to perform reverse deduction based on the frequent subgraph to obtain the alarm sequence that constitutes the event; The calculation module is used to calculate the centrality of each frequent subgraph according to the centrality algorithm to obtain the centrality of the frequent subgraph. The root cause acquisition module is used to obtain the root cause frequent subgraphs based on the centrality of multiple frequent subgraphs; The analysis module is used to analyze the alarm sequence and the root cause frequent subgraph to obtain analysis results; The generation module is used to generate typical event rules based on the analysis results and the requirements of the control operation procedures.

5. The system operation event rule analysis device according to claim 4, characterized in that, The device further includes: The language processing module is used to segment, understand, and fuse the alarm data according to the natural language processing algorithm to obtain first processed data, wherein the first processed data includes alarm objects and alarm content; The statistical labeling module is used to perform statistical processing on the first processed data and label the alarm frequency to obtain the second processed data; The data filtering module is used to filter the second processed data to obtain the feature attributes.

6. The system operation event rule analysis device according to claim 4, characterized in that, The device further includes: A node acquisition module is used to acquire event nodes in the knowledge graph. The graph processing module is used to process the knowledge graph based on the graph neural network model to generate feature vector sets corresponding to event nodes; The vector calculation module is used to calculate the similarity between the feature vectors corresponding to two event nodes in the feature vector set and obtain the calculation result. The determination module is used to determine the rule items of the typical event rule based on the calculation results and obtain the determination result; The determination and processing module is used to supplement and improve the rule items if the determination result indicates that there are missing or conflicting rule items in the typical event rule.

7. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the control system operation event rule analysis method according to any one of claims 1 to 3 by executing the executable instructions.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for analyzing the rules of operation events of the control system as described in any one of claims 1 to 3.

Images