Method and system for detecting abnormity of service calling mode of dispatching automation system

Abstract

The invention discloses a method and a system for detecting abnormity of a business calling mode of a dispatching automation system, which are used for comprehensively analyzing and modeling a public service interface and a calling chain relation in the system by combining static code analysis, knowledge graph construction and a graph convolutional neural network technology. By extracting service calling information in software, entities including service interfaces, processes, functions and the like and a knowledge graph associated with the entities are constructed. Meanwhile, through collection and analysis of call chain data, a service call chain is associated with a knowledge graph, a graph convolutional neural network is used to encode a service sub-graph, a weighted aggregation and mean aggregation mechanism is designed, and the accuracy of feature expression is improved. The method also combines Softmax classification and an anomaly detection mechanism to automatically mark abnormal or unknown nodes, and finally, through iterative optimization of the model, the anomaly detection and service analysis capabilities of the system are continuously improved.

Description

Technical Field

[0001] The present invention relates to the technical field of power grid dispatching automation, and in particular to a method and system for detecting abnormality in a dispatching automation system service call mode. Background Art

[0002] With the deepening of the integrated operation of power grids, the business scope of power grid dispatching and control automation has been expanding, and the number of systems, applications, and services involved has gradually increased, forming a complex multi-level architecture. In this context, the number of application deployments has exploded, covering various types of software, services, and application processes from infrastructure management, real-time monitoring to data analysis and optimization. The interactions between these systems are becoming more frequent and complex, and the business call relationships that depend on each other have become difficult to track and manage, forming a huge call chain.

[0003] At the same time, with the expansion of the scale of power grid dispatching and control systems, the amount of call data is also increasing dramatically. Faced with huge amounts of data, traditional manual analysis methods have become inadequate and it is difficult to extract truly valuable information from massive logs and monitoring data in a timely manner. How to efficiently mine patterns in call data through intelligent means, automatically identify potential abnormal call patterns and new business call paths, and then optimize dispatching decisions has become a technical challenge that needs to be solved urgently.

[0004] To address these issues, the industry urgently needs an intelligent and efficient business call chain monitoring and analysis solution. Summary of the invention

[0005] In order to solve the above problems, the present invention provides a method for detecting abnormality in a service call mode of a scheduling automation system, which is characterized by comprising the following steps:

[0006] Step 1: Build a knowledge graph of the scheduling automation system software call relationship;

[0007] Step 2: Analyze and extract key information in the call chain data, including timestamp, tracking identifier, span identifier, parent span identifier, caller name, called interface name, and call parameter information;

[0008] Step 3: The key information of the business call is formed into a business call subgraph;

[0009] Step 4: Apply graph convolutional neural network to perform feature encoding and representation learning on the business call subgraph;

[0010] Step 5: Based on the encoded business call subgraph, identify abnormalities in the business call pattern.

[0011] Furthermore, the specific process of constructing the knowledge graph described in step 1 is as follows:

[0012] S1.1 Based on the source terminal file of the public service, extract the public service interface with public permissions, and use the service interface name as the entity name in the knowledge graph; associate and store the service process name, service port number and the application to which the service belongs as the attribute information of the entity;

[0013] S1.2 Analyze the process source code contained in the source terminal file through a static code analysis tool, and extract the interactive information of the public service interface described in S1.1 by accessing it; use the function name in the process source code as the entity name in the knowledge graph, and use the process name and the application to which it belongs as the attributes of the entity, and for each interactive information, establish a directed relationship with the S1.1 public service interface entity in the knowledge graph;

[0014] S1.3 Based on the power grid dispatching application information table and the process information table of the power grid dispatching system, other entities and relationships in the graph are supplemented and constructed, including: application entity, process entity, the relationship between application entity and process entity, the relationship between process entity and public service interface entity, and the relationship between process entity and process function entity.

[0015] Furthermore, the analysis and extraction of key information in the call chain data described in step 2 has the following specific process:

[0016] S2.1 loads the call chain data from the specified data source, performs preliminary screening and cleaning on the data, and removes irrelevant or redundant rows that do not contain call information;

[0017] S2.2 parses each call chain data, extracts the timestamp, trace identifier trace_id, span identifier span_id, parent span identifier parent_span_id, caller name, called interface name, and call parameter information.

[0018] Furthermore, the business call subgraph is formed as described in step 3, and the specific process is as follows:

[0019] S3.1 For the call chain data obtained in S2.2, multiple groups of span identifiers span_id and parent span identifier parent_span_id with the same trace identifier trace_id are sorted by timestamp, and the parent span identifier parent_span_id points to the span identifier span_id to form a relationship on the call chain graph;

[0020] S3.2 associates the call chain graph formed in S3.1 with the call relationship knowledge graph formed in step 1, and each single business call forms a subgraph.

[0021] Furthermore, the feature encoding and representation learning described in step 4 has the following specific process:

[0022] S4.1 Mark multiple services in the dispatch automation system;

[0023] S4.2 adds an auxiliary node n to the business subgraph and adds the aggregation function sum; the auxiliary node establishes undirected edges with other nodes in the subgraph, and the edge attribute is weight;

[0024] S4.3 For the key auxiliary node n in the subgraph, a weighted aggregation function based on node importance is used for processing;

[0025] S4.4 uses the mean aggregation function to process other nodes in the subgraph;

[0026] S4.5 sends the node features obtained after processing in S4.3 and S4.4 to the graph convolutional neural network layer for deep processing. The network layer gradually refines and transforms the node information into a d-dimensional feature vector representation through multiple layers of nonlinear transformation;

[0027] S4.6 introduces the softmax function for predicting and outputting the category probability for the feature vector of auxiliary node n;

[0028] S4.7 Iteratively optimize the model.

[0029] Furthermore, the weighted aggregation function based on node importance described in S4.3 determines the weight by calculating the similarity, distance or other custom metrics between nodes, and aggregates the feature information of neighbor nodes in a weighted sum manner. The complete weighted aggregation function formula is:

[0030]

[0031] Where N(n) represents the set of auxiliary node n and its neighbor node i, h n and h i They represent the feature vectors of auxiliary node n and neighbor node i respectively, and f is the function for calculating similarity or influence.

[0032] Furthermore, the mean aggregation function described in S4.4 averages the feature information of all neighboring nodes of any node m except the auxiliary node. The formula of the mean aggregation function is:

[0033]

[0034] Among them, h(m) is the new feature representation of node m, |N(m)| is the number of neighbor nodes of node m, that is, the degree of m, N(m) represents the set of neighbor nodes j of auxiliary node m, and h j Represents the feature vector of neighbor node j.

[0035] Furthermore, the softmax function described in S4.6 is defined as

[0036]

[0037] Among them, Z n，c represents the score of auxiliary node n for category C, Represents the probability of auxiliary node n for category C; for each auxiliary node n, predict its final category y according to the maximum probability output by softmax n , the formula is

[0038]

[0039] Furthermore, the specific process of identifying the abnormality of the call mode in step 5 is as follows:

[0040] S5.1 sets the confidence threshold according to the probability distribution of the softmax output to distinguish between high-confidence classification results and low-confidence classification results;

[0041] S5.2 Design an abnormality score calculation mechanism, quantify the possibility of a node belonging to an abnormal or unknown category according to the entropy value of the probability distribution, and normalize the entropy value to obtain the abnormality score of the node. The entropy value calculation formula of the probability distribution is:

[0042]

[0043] in, is the entropy value of auxiliary node n, indicating the uncertainty of the category of auxiliary node n, is the probability that auxiliary node n belongs to category C.

[0044] S5.3 compares the anomaly score of the node with the set threshold. If the anomaly score exceeds the threshold, the node is marked as abnormal or unknown category; otherwise, its category is determined according to the probability distribution of the softmax output.

[0045] The present invention also provides a dispatching automation system service call mode abnormality detection system, characterized in that it includes:

[0046] The knowledge graph construction module is used to construct the knowledge graph of the scheduling automation system software call relationship;

[0047] Monitoring indicator building module, used to analyze and extract key information from call chain data;

[0048] A subgraph forming module, used to form a business call pattern subgraph from key information of business calls;

[0049] The deep learning module is used to apply graph convolutional neural networks to perform feature encoding and representation learning on the business call pattern subgraph, and continuously optimize and iterate;

[0050] The anomaly detection module is used to detect anomalies in the business call pattern based on the encoded business call pattern subgraph.

[0051] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a method for detecting abnormal business call patterns in a dispatching automation system. By closely combining call chain data with the system topology structure, the entire process of business calls can be fully monitored, which can not only grasp the overall operating status of the system from a macro level, but also deeply analyze the details of each node and call relationship from a micro level. Using the knowledge graph subgraph classification method, complex call chains are mapped into graph structure models that are easy to analyze and process, and different business call patterns are efficiently classified through algorithms. This is an intelligent method for detecting abnormal business call patterns.

[0052] The present invention provides a dispatching automation system business call mode anomaly detection system, which can perform all-round real-time monitoring of each link in the business process, has the ability to extract key information from massive data and identify abnormal behaviors, and ensures the stable operation of the power grid dispatching system in a complex environment. It is an efficient business call mode anomaly detection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 The invention discloses a flow chart of a method for detecting abnormality in a business call mode of a scheduling automation system. DETAILED DESCRIPTION

[0054] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0055] A method for detecting abnormal business call patterns in a dispatching automation system, the process is as follows Figure 1 As shown, the specific steps are as follows:

[0056] Step 1: Construct a knowledge graph of the software call relationships of the dispatching automation system. By analyzing the call relationships between software services, modules, and components in the dispatching automation system, a comprehensive knowledge graph of call relationships is constructed. This graph integrates service interactions at different levels and can dynamically reflect the architecture and operating status of the software system. The specific measures for this step are:

[0057] S1.1 Collect the public service interfaces in the system. Based on the source terminal files of the public services, extract the public service interfaces with public permissions, and use the service interface names as the entity names in the knowledge graph. At the same time, associate and store the service process name, service port number, and the application to which the service belongs as the attribute information of the entity.

[0058] S1.2 extracts service call relationships based on software source code. Use static code analysis tools to scan each process source code and extract the interactive information of the public service interface collected by S1.1 through direct or indirect calls. Use the function name in the process source code as the entity name in the knowledge graph, and use the process name and the application to which it belongs as the attributes of the entity. For each interactive information, establish a directed relationship with the S1.1 public service interface entity in the knowledge graph.

[0059] S1.3 Supplement other entities and relationships in the construction graph. Specifically, it includes: constructing application entities according to the power grid dispatching application information table, where the entity name is the application name; supplementing process entities according to the process information table of the power grid dispatching system, where the entity name is the process name; supplementing the relationship between application entities and process entities according to the process information table of the power grid dispatching system, where the application entity contains the process entity.

[0060] Supplement the construction of the relationship between the process entity and the public service interface entity. The process entity contains the public service interface entity. Specifically, when the name of the process entity is the same as the service process name attribute in the public service interface entity, an inclusion relationship is established between the process entity and the public service interface entity.

[0061] Supplement the relationship between the process entity and the process function entity. The process entity contains the process function entity. Specifically, when the name of the process entity is the same as the process name attribute in the process function entity, an inclusion relationship is established between the process entity and the process function entity.

[0062] Step 2: Analyze and extract key information from the call chain data, and extract key indicators and related features from the huge call chain log data. This includes identifying the time delay, error rate, response time, etc. of the call path, so as to provide a high-quality data foundation for subsequent pattern recognition and anomaly analysis; Step 2 specifically includes:

[0063] S2.1 Call chain data collection and preprocessing. Load call chain data from the specified data source, perform preliminary screening and cleaning on the data, and remove irrelevant or redundant rows that do not contain call information.

[0064] S2.2 parses each call chain data, extracts the timestamp, trace identifier trace_id, span identifier span_id, parent span identifier parent_span_id, caller name, called interface name, and call parameter information.

[0065] Step 3: Form a business call subgraph; through clustering and screening, the key parts of the business call are formed into a subgraph. This subgraph can simplify the complexity of the call relationship and centrally display the call details of a specific business process, which is convenient for further analysis and optimization. Specifically, it includes:

[0066] S3.1 builds a single business call chain structure. Multiple groups of span identifiers span_id and parent span identifier parent_span_id of the same trace identifier trace_id are sorted by timestamp, and the parent span identifier parent_span_id points to the span identifier span_id to form a relationship on the call chain graph.

[0067] S3.2 forms a single business call subgraph. Associate the call chain graph formed in S3.1 with the call relationship knowledge graph formed in step 1. Specifically, the caller name is associated with the process entity in the call relationship graph, and the called interface name is associated with the service interface entity. The call duration and call parameter information are used as attributes of the relationship. Each single business call forms a subgraph.

[0068] Step 4: Use graph convolutional neural network to encode the business call subgraph. When processing the business call subgraph, apply graph convolutional neural network to encode its features and learn its representation. Graph convolutional neural network can further reveal the potential rules in the business call pattern by capturing the node and edge relationships in the graph structure. Step 4 specifically includes the following:

[0069] S4.1 marks multiple services such as browsing wiring diagrams, alarm query, formula calculation, remote control operation, etc.

[0070] S4.2 adds an auxiliary node n to the business subgraph and adds the aggregation function sum. The auxiliary node establishes undirected edges with other nodes in the subgraph, and the edge attribute is weight.

[0071] S4.3 Weighted aggregation mechanism design. For the key auxiliary node n in the subgraph, the present invention introduces a weighted aggregation function based on node importance. The function first evaluates the influence of each neighbor node on the auxiliary node n, and determines the weight by calculating the similarity, distance or other custom metrics between nodes. Subsequently, the feature information of the neighbor nodes is aggregated in a weighted sum manner to accurately capture their specific influence on the auxiliary node n. This mechanism effectively avoids information loss and noise interference, and improves the accuracy and robustness of embedded coding.

[0072] First, for each neighbor node i∈N(n), where N(n) represents the set of auxiliary node n and its neighbor node i, calculate the weight α n,i , to measure its impact on the auxiliary node n; secondly, the general calculation method can be expressed as:

[0073] α n,i =f(h n +h i )

[0074] Among them, h n and h i denote the feature vectors of auxiliary node n and neighbor node i respectively, and f is a function that calculates similarity or influence. To ensure that the sum of weights is 1, the softmax function is usually used to normalize the weights.

[0075] Finally, by assigning different weights to neighbor nodes, information loss and noise interference can be effectively reduced, thereby improving the accuracy and robustness of node embedding representation. The complete weighted aggregation function formula is:

[0076]

[0077] S4.4 Application of mean aggregation mechanism. For non-auxiliary nodes in the subgraph, the present invention adopts a concise and efficient mean aggregation function. This function averages the feature information of all neighboring nodes of each node to ensure balanced propagation of information among nodes. Although this processing method sacrifices some specific information, it can effectively reduce the computational complexity and retain the overall structural characteristics of the graph.

[0078] For non-auxiliary nodes in the subgraph, the idea of ​​mean aggregation is that any node m except auxiliary nodes obtains information from its neighbor nodes N(m) and averages the information. In this way, the feature vector of the node will contain the overall features of all its neighbors without being significantly biased towards a specific neighbor.

[0079] The formula for the mean aggregation function is

[0080]

[0081] Among them, h(m) is the new feature representation of node m, |N(m)| is the number of neighbor nodes of node m, that is, the degree of m, N(m) represents the set of neighbor nodes j of auxiliary node m, and h j Represents the feature vector of neighbor node j. This mean aggregation function can reasonably transfer the information of neighbor nodes to the target node while keeping the calculation simple, thereby retaining the overall information of the graph structure.

[0082] S4.5 Deep graph convolutional neural network layer. The node features processed by the above aggregation mechanism are sent to a series of graph convolutional neural network layers for deep processing. These network layers gradually refine and transform the node information into a d-dimensional feature vector representation through multiple layers of nonlinear transformation.

[0083] In the graph convolutional neural network, the node features after mean aggregation or weighted aggregation will be further sent to the multi-layer graph convolutional network for deep processing. Through this process, the node features will be refined layer by layer, gradually combining local information with the global graph structure to generate a high-dimensional node embedding representation with rich expression capabilities. The key steps of this process can be summarized as follows:

[0084] First, the node adjacency information and node features are combined to diffuse neighbor information through the normalized adjacency matrix;

[0085] Secondly, when updating node features at each layer, the features of the current node and its neighboring nodes are linearly transformed through the weight matrix, and the expression ability of the network is enhanced through the activation function;

[0086] Finally, multiple layers of convolution are stacked to extract the local and global features of the nodes layer by layer to obtain a d-dimensional node embedding representation, which contains the complex association information between the nodes and the graph structure.

[0087] This process not only retains the original attribute information of the node, but also deeply integrates its position in the graph structure and the association information with surrounding nodes, thereby generating node embeddings with high representation capabilities.

[0088] S4.6 Softmax classification output. Finally, for the feature vector of auxiliary node n, the present invention introduces the softmax function to predict and output the category probability. In a specific embodiment of the present invention, the softmax function is used to classify the feature vector of auxiliary node n and output the probability distribution of the node belonging to different categories. This method converts the high-dimensional feature vector of the node into a probability value for category prediction, which is suitable for supervised classification tasks and can also be extended to unsupervised tasks through further optimization methods. The application steps of Softmax are as follows:

[0089] Assume that the feature vector of auxiliary node n is a d-dimensional vector obtained after processing by a multi-layer graph convolutional neural network. This feature vector contains the original information of the node, its position relationship in the graph, and the association information with surrounding nodes.

[0090] Before performing Softmax classification, the feature vector of the node is mapped to the dimension of the category space through a linear transformation. Let the number of categories be C and introduce a weight matrix, Wc∈R d*c and the bias term b c ∈Rd*c Perform a linear transformation. The softmax function converts the above unnormalized score Z n Converted to a probability value, indicating the probability that auxiliary node n belongs to each category. The definition of the Softmax function is as follows:

[0091]

[0092] Among them, Z n,c Represents the score of auxiliary node n for category C. Represents the probability of auxiliary node n for category C. For auxiliary node n, its final category is predicted according to the maximum probability of softmax output:

[0093]

[0094] That is, the category with the highest probability is selected as the predicted category of the node.

[0095] The Softmax function can map the feature vector of a node into a series of probability values, indicating the possibility that the node belongs to each category. This process makes the technology of the present invention not only applicable to unsupervised graph embedding tasks, but also can be flexibly extended to supervised classification, prediction and other scenarios.

[0096] S4.7 Model training optimization. According to the labeling results, the model is iteratively optimized, and the graph embedding and classification parameters are adjusted to improve the accuracy of anomaly and unknown category detection. At the same time, through the feedback mechanism, the newly discovered anomaly or unknown category information is used to expand the training data set to further improve the generalization ability of the model.

[0097] Step 5: Discover abnormal business call patterns, based on the encoded business call subgraph, combined with the anomaly detection algorithm, identify possible abnormal patterns in business calls. This can help discover abnormal behaviors or potential problems in advance, thereby optimizing system performance and improving system stability and security, including:

[0098] S5.1 Constructing a confidence threshold: According to the probability distribution of the softmax output, a confidence threshold is set to distinguish between high-confidence classification results and low-confidence classification results.

[0099] S5.2 Calculate anomaly score. Design an anomaly score calculation mechanism, such as an entropy value based on probability distribution, a distance measure with other node feature vectors, etc., to quantify the probability that a node belongs to an anomaly or unknown category.

[0100] Specifically, the entropy value based on probability distribution is used to measure the uncertainty of the category distribution of the auxiliary node n. If the distribution of the node in the known category is highly uncertain, it indicates that the node may belong to an abnormal or unknown category. The entropy calculation formula is:

[0101]

[0102] in, is the entropy value of auxiliary node n, which indicates the uncertainty of the category of auxiliary node n. is the probability that auxiliary node n belongs to category C. The higher the entropy value, the more uniform the category distribution of the node is, and the more uncertain the model is about the classification of the node, so it may be an abnormal node or belong to an unknown category.

[0103] Normalize the entropy value and get the normalized entropy value by dividing the entropy value by the maximum possible entropy value log(C)

[0104]

[0105] in,

[0106] The anomaly score of auxiliary node n can be defined as the normalized entropy value The anomaly score S itself, because it quantifies the distribution uncertainty of the node belonging to each category. n Defined as:

[0107]

[0108] The anomaly score ranges from 0 to 1, with higher scores indicating that the node is more likely to belong to the anomaly or unknown category.

[0109] S5.3 Classification and labeling. Compare the anomaly score of the node with the set threshold. If the anomaly score exceeds the threshold, the node is marked as abnormal or unknown category; otherwise, its category is determined according to the probability distribution of the softmax output.

[0110] The present invention significantly improves the processing capability of call chain data, so that the dispatching automation system can timely discover abnormal call patterns and provide real-time abnormal warnings and optimization suggestions for the power grid dispatching automation system. In addition, with the help of the structured representation and correlation analysis of the knowledge graph, the present invention can not only identify a single abnormal call, but also identify abnormal correlations across services and applications, providing more comprehensive fault diagnosis and root cause analysis functions.

[0111] Through this invention, the operation of the dispatching automation system can be more stable, and it can respond and adjust more quickly when faced with a complex and dynamic power grid environment, providing strong technical support for the optimization, upgrading and intelligent development of the power grid.

Claims

1. A method for detecting abnormality in a dispatching automation system service call mode, characterized in that: The following steps are involved: Step 1: Build a knowledge graph of the scheduling automation system software call relationship; Step 2: Analyze and extract key information from the business call pattern chain data in the existing data source, wherein the key information includes timestamp, tracking identifier, span identifier, parent span identifier, caller name, called interface name, and call parameter information; Step 3: Form a business call pattern subgraph with key information; Step 4: Apply graph convolutional neural network to perform feature encoding on the business call pattern subgraph; Step 5: Based on the feature-encoded service call pattern subgraph, detect whether the service call pattern of the dispatching automation system is abnormal.

2. The method for detecting abnormal business call patterns according to claim 1, characterized in that: The specific process of constructing the knowledge graph described in step 1 is as follows: S1.1 Based on the source terminal file of the public service, extract the public service interface with public permissions, and use the service interface name as the entity name in the knowledge graph; associate and store the service process name, service port number and the application to which the service belongs as the attribute information of the entity; S1.2 Analyze the process source code contained in the source terminal file through a static code analysis tool, and extract the interactive information obtained by accessing the public service interface described in S1.1; use the function name in the process source code as the entity name in the knowledge graph, and use the process name and the application to which it belongs as the attributes of the entity. For each interactive information, establish a directed relationship with the S1.1 public service interface entity in the knowledge graph; S1.3 Based on the power grid dispatching application information table and the process information table of the power grid dispatching system, other entities and relationships in the graph are supplemented and constructed, including: application entity, process entity, the relationship between application entity and process entity, the relationship between process entity and public service interface entity, and the relationship between process entity and process function entity.

3. The method for detecting abnormal business call patterns according to claim 2, characterized in that: Step 2 analyzes and extracts key information from the call chain data. The specific process is as follows: S2.1 loads call chain data from existing data sources, performs preliminary screening and cleaning of the call chain data, and removes irrelevant or redundant rows that do not contain call information; S2.2 parses each call chain data, extracts the timestamp, trace identifier trace_id, span identifier span_id, parent span identifier parent_span_id, caller name, called interface name, and call parameter information.

4. The method for detecting abnormal business call patterns according to claim 3, characterized in that: Step 3 forms a business call mode subgraph, and the specific process is as follows: S3.1 For the call chain data obtained in S2.2, multiple groups of span identifiers span_id and parent span identifier parent_span_id with the same trace identifier trace_id are sorted by timestamp, and the parent span identifier parent_span_id points to the span identifier span_id to form a relationship on the call chain graph; S3.2 associates the call chain graph formed in S3.1 with the call relationship knowledge graph formed in step 1, and each single business call pattern forms a subgraph.

5. The method for detecting abnormal business call patterns according to claim 4, characterized in that: The specific process of feature encoding and representation learning described in step 4 is as follows: S4.1 Mark multiple services in the dispatch automation system; S4.2 Add an auxiliary node n to the business call pattern subgraph and add the aggregation function sum; the auxiliary node establishes an undirected edge with other nodes in the subgraph, and the attribute on the edge is the weight; S4.3 For the auxiliary node n in the subgraph, a weighted aggregation function based on the node importance is used for processing; S4.4 uses the mean aggregation function to process other nodes in the subgraph; S4.5 sends the node features obtained after processing in S4.3 and S4.4 to the graph convolutional neural network layer for deep processing. The network layer gradually refines and transforms the node information into a d-dimensional feature vector representation through multiple layers of nonlinear transformation; S4.6 introduces the softmax function for predicting and outputting the category probability for the feature vector of auxiliary node n; S4.7 Iteratively optimize the model.

6. The method for detecting abnormal business call patterns according to claim 5, characterized in that: The weighted aggregation function based on node importance described in S4.3 determines the weight by calculating the similarity, distance or other custom metrics between nodes, and aggregates the feature information of neighbor nodes in a weighted sum manner. The complete weighted aggregation function formula is: Where N(n) represents the set of neighbor nodes i of auxiliary node n, h n and h i They represent the feature vectors of auxiliary node n and neighbor node i respectively, and f is the function for calculating similarity or influence.

7. The method for detecting abnormal business call patterns according to claim 5, characterized in that: S4.4 The mean aggregation function averages the feature information of all neighboring nodes of any node m except the auxiliary node. The formula of the mean aggregation function is: Among them, h(m) is the new feature representation of node m, |N(m)| is the number of neighbor nodes of node m, that is, the degree of m, N(m) represents the set of neighbor nodes j of auxiliary node m, and h j Represents the feature vector of neighbor node j.

8. The method for detecting abnormal business call patterns according to claim 5, characterized in that: S4.6 The softmax function is defined as Among them, Z n,c represents the probability of auxiliary node n for category C, Z n,k represents the probability of auxiliary node n for each category, L is the embedding representation of auxiliary node n, represents the probability of auxiliary node n for category C; For auxiliary node n, predict its final category y according to the maximum probability of softmax output n , the formula is 9. The method for detecting abnormal business call patterns according to claim 1, characterized in that: The specific process of identifying the abnormality of the call mode in step 5 is as follows: S5.1 sets the confidence threshold according to the probability distribution of the softmax output to distinguish between high-confidence classification results and low-confidence classification results; S5.2 Design an abnormality score calculation mechanism, quantify the possibility of a node belonging to an abnormal or unknown category according to the entropy value of the probability distribution, and normalize the entropy value to obtain the abnormality score of the node. The entropy value calculation formula of the probability distribution is: in, is the entropy value of auxiliary node n, indicating the uncertainty of the category of auxiliary node n, is the probability that auxiliary node n belongs to category C. S5.3 compares the node's anomaly score with the set confidence threshold. If the anomaly score exceeds the threshold, the node is marked as an anomaly or unknown category; otherwise, its category is determined based on the probability distribution of the softmax output.

10. A dispatching automation system service call mode abnormality detection system, characterized in that: include: The knowledge graph construction module is used to construct the knowledge graph of the scheduling automation system software call relationship; Monitoring indicator building module to analyze and extract key information from call chain data; A subgraph forming module, used to form a business call pattern subgraph from the key information of the business call; A deep learning module that uses graph convolutional neural networks to perform feature encoding and representation learning on the business call pattern subgraph, and continuously optimizes and iterates; The anomaly detection module is used to detect anomalies in the business call pattern based on the encoded business call pattern subgraph.

Images