Power data communication network alarm log sequence pattern prediction method and related system

Abstract

The present invention belongs to the field of alarm log data processing, and discloses a method and a related system for predicting the sequence pattern of an alarm log of an electric power data communication network. The present invention can unify the standard of alarm data, reduce redundant information, and make subsequent analysis more efficient by preprocessing and weighting the alarm data. The dynamic time warping algorithm can capture the time dependency in the alarm data and identify the deep-level associations between alarm events. The present invention constructs a dependency matrix and uses a graph neural network for modeling, which can effectively capture the association between devices and identify the alarm impact range of key equipment. The present invention provides an accurate foundation for subsequent alarm pattern mining through feature extraction and dependency modeling. The present invention performs sequence pattern mining through the PrefixSpan algorithm, which can extract high-frequency patterns and key features from massive alarm data and accurately identify truly important alarm information.

Description

Technical Field

[0001] The present invention belongs to the field of alarm log data processing, and in particular relates to a method for predicting an alarm log sequence pattern in a power data communication network and a related system. Background Art

[0002] With the rapid development of information technology and network communication technology, the scale and complexity of modern power data communication networks have increased significantly. The diversification of network devices and their services has led to the generation of a large amount of heterogeneous alarm log data. These alarm logs are an indispensable part of network management, and they provide real-time feedback on the status and potential problems of the network. However, due to the large number and diverse sources of alarm logs, their data format and quality are often uneven, which poses a huge challenge to effective data processing and fault prediction.

[0003] Traditional alarm management systems mainly rely on preset rules and thresholds to process alarms, which works well in simple and predefined situations. However, in large-scale, highly dynamic network environments, these traditional methods often fail to effectively identify truly critical information from massive amounts of alarm data, and it is difficult to make accurate predictions about future alarm events. In addition, traditional technologies often ignore the temporal relationship and pattern between alarms, and fail to fully understand the deep connections between alarm data. Summary of the invention

[0004] The purpose of the present invention is to overcome the above-mentioned deficiency that the truly critical information cannot be effectively identified from the massive alarm data, and to provide a method and a related system for predicting the sequence pattern of alarm logs in a power data communication network.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] In a first aspect, the present invention provides a method for predicting a sequence pattern of an alarm log of a power data communication network, comprising the following steps:

[0007] Obtaining the alarm log in the power data communication network and collecting the alarm data in the alarm log;

[0008] Pre-process the alarm data to obtain standardized and unified alarm data;

[0009] Performing weighted processing on the pre-processed alarm data to obtain weighted alarm data;

[0010] The weighted alarm data is processed using a dynamic time warping algorithm to obtain the time dependency in the alarm data;

[0011] Construct a dependency matrix based on the time dependency in the alarm data;

[0012] Based on the dependency matrix, graph neural network is used for modeling to obtain feature extraction and device dependency model;

[0013] Based on feature extraction and device dependency model, the PrefixSpan algorithm is used to mine sequence patterns to obtain the required data features;

[0014] Mining the alarm patterns with the required frequency of occurrence according to the required data features to form multi-dimensional data;

[0015] Extract warning features from multidimensional data;

[0016] Classify the alarm features and predict the alarm time of different categories based on the classified alarm features.

[0017] A further improvement of the present invention is that the alarm data includes a timestamp, a device ID, an alarm type and a severity.

[0018] A further improvement of the present invention is that the standard unified alarm data is weighted, and the specific method of obtaining the weighted alarm data is as follows:

[0019]

[0020] in, is the weighted alarm data, T is the current time, λ is the time attenuation coefficient, t is the historical time, Time2Vec( t ) is the Time2Vec model.

[0021] A further improvement of the present invention is that a dynamic time warping algorithm is used to process the weighted alarm data, and a specific method for obtaining the time dependency relationship in the alarm data is as follows:

[0022]

[0023] in, is the time dependency in the alarm data, S1 is the alarm data, S2 is the data time, d is the distance measure between the alarm data and the data time, is the data length of the alarm data, is the location index of the alarm data, The time index for the data time.

[0024] A further improvement of the present invention is that, according to the time dependency relationship in the alarm data, a specific method of constructing a dependency matrix is ​​as follows:

[0025]

[0026] in, is the dependency matrix, is the alarm event time difference between device i and device j, The frequency of simultaneous alarms of device i and device j.

[0027] A further improvement of the present invention is that based on the dependency matrix, a graph neural network is used for modeling, and the specific method for obtaining the feature extraction and device dependency model is as follows:

[0028]

[0029] in, For equipment In the The characteristics of the layer, is the activation function, For equipment The neighbor device set, is the normalization coefficient between neighboring devices, is the weight coefficient, For equipment In the The characteristics of the layer, is the bias coefficient, The number of layers.

[0030] A further improvement of the present invention is that based on feature extraction and device dependency model, the PrefixSpan algorithm is used to mine sequence patterns. The specific method for obtaining the required data features is as follows:

[0031]

[0032] Among them, Support(S) is the required data feature, and min_support is the minimum support threshold.

[0033] A further improvement of the present invention is that the data features are analyzed to obtain the alarm mode with a frequency higher than the threshold, and the specific method of forming multi-dimensional data is as follows:

[0034] The required data is transformed into features to obtain:

[0035]

[0036] in, is the alarm occurrence time, is the device ID, is the alarm type, is the severity of the alert, For the alarm description, It is the location index of the alarm data;

[0037] Mining the data features after feature conversion to obtain the required alarm pattern set with the required frequency of occurrence:

[0038]

[0039] in, is the alarm mode set, is the sequence of alarm events, For warning events;

[0040] According to the alarm pattern set with the required frequency of occurrence, multi-dimensional data is obtained:

[0041]

[0042] in, For multidimensional data, Enhance features for sequential patterns.

[0043] A further improvement of the present invention is that the alarm features are classified, and the specific method for predicting the alarm time of different categories according to the classified alarm features is as follows:

[0044] The cross entropy loss function is used to classify the alarm features. The specific method is as follows:

[0045]

[0046] in, is the classified alarm feature, is the actual alarm type label, is the location index of the alarm data, which is converted into a numerical value through the category code. is the predicted probability after calculation by the softmax function, and n is the total number of samples;

[0047] The classified alarm features are used for time prediction, and the regression model is used to predict the time when future alarm events will occur.

[0048] In a second aspect, the present invention provides a power data communication network alarm log sequence pattern prediction system, comprising:

[0049] An alarm data acquisition module is used to obtain the alarm log in the power data communication network and collect the alarm data in the alarm log;

[0050] A preprocessing module is used to preprocess the alarm data to obtain standard and unified alarm data;

[0051] The data weighting module is used to perform weighted processing on the standard unified alarm data to obtain weighted alarm data;

[0052] A dependency acquisition module is used to process the weighted alarm data using a dynamic time warping algorithm to obtain the time dependency in the alarm data;

[0053] A dependency matrix building module is used to build a dependency matrix according to the time dependency relationship in the alarm data;

[0054] The dependency model building module is used to model the dependency matrix using a graph neural network to obtain feature extraction and device dependency models;

[0055] Data feature mining module, which is used to mine sequence patterns based on feature extraction and device dependency model using PrefixSpan algorithm to obtain required data features;

[0056] A multi-dimensional data generation module is used to analyze data features, obtain alarm patterns with a frequency higher than a threshold, and form multi-dimensional data;

[0057] Feature extraction module, used to extract alarm features from multi-dimensional data;

[0058] The classification warning module is used to classify the alarm features and predict the alarm time of different categories based on the classified alarm features.

[0059] In a third aspect, the present invention provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of a method for predicting a sequence pattern of an alarm log of a power data communication network when executing the computer program.

[0060] In a fourth aspect, the present invention provides a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of a method for predicting a sequence pattern of an alarm log of a power data communication network.

[0061] Compared with the prior art, the present invention has the following beneficial effects:

[0062] The present invention can unify the standards of alarm data, reduce redundant information, and make subsequent analysis more efficient by preprocessing and weighting the alarm data. The dynamic time warping algorithm can capture the time dependency in the alarm data and identify the deep association between alarm events. The present invention constructs a dependency matrix and uses a graph neural network for modeling, which can effectively capture the association between devices and identify the alarm impact range of key devices. The present invention provides an accurate basis for subsequent alarm pattern mining through feature extraction and dependency modeling. The present invention mines sequence patterns through the PrefixSpan algorithm, which can extract high-frequency patterns and key features from massive alarm data and accurately identify truly important alarm information. The present invention adopts a multidimensional data analysis method to more comprehensively reflect alarm features and improve the accuracy and practicality of analysis results. The present invention can extract and classify alarm features in multidimensional data, which helps to analyze different categories of alarm behaviors in a more detailed manner. The present invention predicts based on the classified features, which can effectively improve the accuracy of future alarm event predictions and provide a basis for taking countermeasures in advance. The present invention has a strong processing capability for massive alarm data, can efficiently extract effective information from it, and reduces the sensitivity of traditional methods to data scale. In the power data communication network, facing complex and changeable alarm events, this method has stronger adaptability and robustness. The present invention uses accurate alarm pattern mining and prediction results to provide reliable support for the operation and maintenance of the power system. By predicting key alarm events in advance, the configuration of operation and maintenance resources can be optimized, and the accident rate and operation and maintenance costs can be reduced. In summary, the present invention can not only mine valuable information from massive alarm data, but also effectively predict future alarm events, significantly improving the operation safety and maintenance efficiency of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 is a flow chart of Example 1;

[0064] Figure 2 is a system diagram of Example 2;

[0065] Figure 3 This is a system diagram of Example 13. DETAILED DESCRIPTION

[0066] In order to further understand the content of the present invention, the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the embodiments are only for explaining the present invention and are not intended to limit it.

[0067] Embodiment 1:

[0068] See also Figure 1 , a method for predicting a sequence pattern of an alarm log in a power data communication network comprises the following steps:

[0069] S1, obtaining the alarm log in the power data communication network, and collecting the alarm data in the alarm log.

[0070] S2, pre-processing the alarm data to obtain standardized and unified alarm data.

[0071] S3, weighted processing is performed on the standard unified alarm data to obtain weighted alarm data.

[0072] S4, using the dynamic time warping algorithm to process the weighted alarm data to obtain the time dependency in the alarm data,

[0073] S5, constructing a dependency matrix according to the time dependency in the alarm data.

[0074] S6, based on the dependency matrix, uses graph neural network for modeling to obtain feature extraction and device dependency model.

[0075] S7, based on feature extraction and device dependency model, uses the PrefixSpan algorithm to mine sequence patterns and obtain the required data features.

[0076] S8, analyzing the data features to obtain the alarm mode with a frequency higher than the threshold, and forming multi-dimensional data.

[0077] S9, extracting warning features from multidimensional data.

[0078] S10, classifying the alarm features, and predicting the alarm times of different categories according to the classified alarm features.

[0079] This embodiment can effectively identify the time dependency in the alarm data by standardizing, weighting and applying the dynamic time warping algorithm to the alarm log data. By using graph neural network modeling, building dependencies between devices, and using the PrefixSpan algorithm to mine sequence patterns, important patterns hidden in a large amount of alarm data can be discovered. This method can identify high-frequency alarm patterns and classify and predict alarms by analyzing data features and extracting alarm features from multidimensional data, thereby helping users accurately predict the time when the alarm will occur. This effectively solves the problem that traditional methods cannot filter out truly critical information when processing massive alarm data. Through accurate alarm prediction, potential problems can be identified in advance, the security and stability of the power communication network can be improved, the occurrence of failures can be reduced, and the operation and maintenance efficiency can be improved.

[0080] Embodiment 2:

[0081] See also Figure 2 , a power data communication network alarm log sequence pattern prediction system, comprising:

[0082] An alarm data acquisition module is used to obtain the alarm log in the power data communication network and collect the alarm data in the alarm log;

[0083] A preprocessing module is used to preprocess the alarm data to obtain standard and unified alarm data;

[0084] The data weighting module is used to perform weighted processing on the standard unified alarm data to obtain weighted alarm data;

[0085] A dependency acquisition module is used to process the weighted alarm data using a dynamic time warping algorithm to obtain the time dependency in the alarm data;

[0086] A dependency matrix building module is used to build a dependency matrix according to the time dependency relationship in the alarm data;

[0087] The dependency model building module is used to model the dependency matrix using a graph neural network to obtain feature extraction and device dependency models;

[0088] Data feature mining module, which is used to mine sequence patterns based on feature extraction and device dependency model using PrefixSpan algorithm to obtain required data features;

[0089] A multi-dimensional data generation module is used to analyze data features, obtain alarm patterns with a frequency higher than a threshold, and form multi-dimensional data;

[0090] Feature extraction module, used to extract alarm features from multi-dimensional data;

[0091] The classification warning module is used to classify the alarm features and predict the alarm time of different categories based on the classified alarm features.

[0092] Embodiment 3:

[0093] The specific method of obtaining the alarm log in the power data communication network and collecting the alarm data in the alarm log is as follows:

[0094] The data acquisition module obtains alarm log data in the power data communication network in real time, and collects alarm logs from multi-source heterogeneous devices (such as routers from different manufacturers). The data includes timestamp, device ID, alarm type, severity, etc.

[0095] Embodiment 4:

[0096] The specific method for preprocessing the alarm data to obtain standardized and unified alarm data is as follows:

[0097] All data are standardized to form a unified format. The collected data is preliminarily processed, including outlier detection and removal, and the division of training and test sets. Furthermore, the dynamic time window technology is used to automatically adjust the size of the time window according to the changes in the network status to ensure that important time information is retained during processing.

[0098] Embodiment 5:

[0099] The specific method of weighting the pre-processed alarm data to obtain the weighted alarm data is as follows:

[0100] Time-weighted processing is performed on the alarm data sequence to strengthen the dependency in the time dimension. Through time weighting, different weights can be assigned to each time point in the sequence, with the most recent time point having a higher weight and the historical time point having a lower weight. The Time2Vec model is further introduced to perform complex encoding of time through embedded functions to enhance the model's ability to capture periodic time patterns. The time weighting formula is:

[0101]

[0102] in, is the weighted alarm data, T is the current time, λ is the time attenuation coefficient, t is the historical time, Time2Vec( t ) is the Time2Vec model.

[0103] Embodiment 6:

[0104] The specific method of using the dynamic time warping algorithm to process the weighted alarm data and obtain the time dependency relationship in the alarm data is as follows:

[0105] Use the Dynamic Time Warping (DTW) algorithm to analyze the time dependencies in the alarm log. DTW aligns alarm events that occur at different times to ensure that the data remains consistent in the time dimension. DTW can handle the alignment problem between time series and is particularly suitable for alarm data with time misalignment. DTW can be expressed as:

[0106]

[0107] in, is the time dependency in the alarm data, S1 is the alarm data, S2 is the data time, and d represents the distance measure between the alarm data and the data time. is the data length of the alarm data, is the location index of the alarm data, The time index for the data time.

[0108] This embodiment uses dynamic time warping (DTW) and graph neural network (GNN) to process complex dependencies between devices: Dynamic time warping technology is used to optimize the feature extraction of time series data, solve the problem of time misalignment of alarm events, and enhance the model's ability to capture time dependencies. At the same time, graph neural networks are introduced to process complex dependencies between devices and improve the model's ability to adapt to dynamic changes in network structure.

[0109] Embodiment 7:

[0110] According to the time dependency in the alarm data, the specific method of constructing the dependency matrix is ​​as follows:

[0111] To capture the alarm dependencies between different devices, we construct a dependency matrix for each pair of devices. , which describes the alarm dependency strength between device i and device j. The calculation of the matrix is ​​based on the time difference and frequency of alarm events between devices, and the formula is:

[0112]

[0113] in, is the dependency matrix, is the alarm event time difference between device i and device j, The frequency of simultaneous alarms of device i and device j.

[0114] Embodiment 8:

[0115] Based on the dependency matrix, the specific method of using graph neural network for modeling and obtaining feature extraction and device dependency model is as follows:

[0116] Based on the dependency matrix, a graph neural network (GNN) is used for modeling. GNN can learn the alarm dependency relationship between devices through the graph structure constructed by the dependency matrix and update the alarm features of the devices layer by layer. The formula of GNN can be expressed as:

[0117]

[0118] in, For equipment In the The characteristics of the layer, is the activation function, For equipment The neighbor device set, is the normalization coefficient between neighboring devices, is the weight coefficient, For equipment In the The characteristics of the layer, is the bias coefficient, The number of layers.

[0119] Embodiment 9:

[0120] Based on feature extraction and device dependency model, the PrefixSpan algorithm is used to mine sequence patterns. The specific method to obtain the required data features is as follows:

[0121] After feature extraction and device dependency modeling, the PrefixSpan algorithm is used to mine sequence patterns. PrefixSpan can mine frequently occurring patterns from alarm sequences. The support calculation formula is:

[0122]

[0123] Among them, support represents the frequency of pattern sequence S in the entire sequence, and min_support is the minimum support threshold to ensure that the mined pattern has sufficient statistical significance.

[0124] Embodiment 10:

[0125] The specific method of analyzing the data characteristics and obtaining the alarm mode with a frequency higher than the threshold to form multi-dimensional data is as follows:

[0126] Convert the required data feature format to:

[0127]

[0128] in, is the alarm occurrence time, is the device ID, is the alarm type, is the severity of the alert, For the alarm description, The location index of the alarm data.

[0129] The frequently occurring alarm patterns mined can be expressed as ,in, is the alarm mode set, is a sequence of alarm events. For warning events.

[0130] The final input is multidimensional data, which is composed of:

[0131]

[0132] in, For multidimensional data, Enhance features for sequence patterns, indicating whether the alarm event conforms to the high-frequency patterns previously mined. Multidimensional data As the input sequence of the Transformer model, the model captures the correlation between warning events through the self-attention mechanism. The input data sequence is:

[0133]

[0134] Embodiment 11:

[0135] The specific method for extracting alarm features from multidimensional data is as follows:

[0136] Use the self-attention mechanism to extract features from the alarm log and calculate the dependencies between each event in the input sequence. The formula for the self-attention mechanism is:

[0137]

[0138] Among them, Q is the query vector, K is the key vector, and V is the value vector. is the dimension of the key vector, and the self-attention mechanism is used to capture the global dependencies between warning events.

[0139] Since Transformer does not have its own time series information, a position code is added to each input sequence position. , to characterize the time sequence:

[0140]

[0141] in, A code that represents the sequence of events.

[0142] Embodiment 12:

[0143] The specific method of classifying the alarm features and predicting the alarm time of different categories according to the classified alarm features is as follows:

[0144] Using the features extracted by Transformer, the classifier is used to predict the future alarm type. In order to measure the difference between the alarm type predicted by the model and the actual alarm type, the cross entropy loss function is used:

[0145]

[0146] in, is the classified alarm feature, is the actual alarm type label, It is the location index of the alarm data, which is converted into a numerical value through the category code. is the predicted probability after calculation by the softmax function, and n is the total number of samples.

[0147] The features extracted by Transformer are used for time prediction, and the regression model is used to predict the time when future alarm events will occur. In order to measure the error between the predicted alarm occurrence time and the actual alarm time, the mean square error (MSE) is used as the loss function:

[0148]

[0149] In order to simultaneously classify alarms and predict alarm times, a total loss function for multi-task learning is constructed, combining classification tasks and regression tasks:

[0150]

[0151] in, is the classified alarm feature, is the loss of the alarm time prediction task, and α and β are used to adjust the weights between the classified alarm features and the loss of the alarm time prediction task to ensure that the model optimizes these two tasks simultaneously.

[0152] During the training process, the model uses the Adam optimizer to automatically adjust the learning rate to speed up convergence. At the same time, the model dynamically adjusts the model weights based on the real-time update of the alarm log. Through the feedback mechanism, the model can continuously learn new alarm patterns and optimize prediction performance.

[0153] Embodiment 13:

[0154] See also Figure 3 As shown, the present invention also provides an electronic device 100 for predicting a method for predicting a sequence pattern of an alarm log of a power data communication network; the electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0155] The memory 101 can be used to store the computer program 103, and the processor 102 implements the steps of the power data communication network alarm log sequence pattern prediction method described in Example 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101. The memory 101 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data (such as audio data) created according to the use of the electronic device 100, etc. In addition, the memory 101 can include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

[0156] The at least one processor 102 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor, etc. The processor 102 is the control center of the electronic device 100, and uses various interfaces and lines to connect various parts of the entire electronic device 100.

[0157] The memory 101 in the electronic device 100 stores a plurality of instructions to implement a method for predicting a sequence pattern of an alarm log of a power data communication network. The processor 102 may execute the plurality of instructions to implement:

[0158] Obtaining the alarm log in the power data communication network and collecting the alarm data in the alarm log;

[0159] Pre-process the alarm data to obtain standardized and unified alarm data;

[0160] Perform weighted processing on standard unified alarm data to obtain weighted alarm data;

[0161] The weighted alarm data is processed using a dynamic time warping algorithm to obtain the time dependency in the alarm data;

[0162] Construct a dependency matrix based on the time dependency in the alarm data;

[0163] Based on the dependency matrix, graph neural network is used for modeling to obtain feature extraction and device dependency model;

[0164] Based on feature extraction and device dependency model, the PrefixSpan algorithm is used to mine sequence patterns to obtain the required data features;

[0165] Analyze the data features to obtain the alarm patterns with a frequency higher than the threshold, forming multi-dimensional data;

[0166] Extract warning features from multidimensional data;

[0167] Classify the alarm features and predict the alarm time of different categories based on the classified alarm features.

[0168] Embodiment 14:

[0169] If the module / unit integrated in the electronic device 100 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the process in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory and read-only memory (ROM, Read-Only Memory).

[0170] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0171] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0172] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0173] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for predicting a sequence pattern of an alarm log in a power data communication network, characterized in that: The following steps are involved: Obtaining the alarm log in the power data communication network and collecting the alarm data in the alarm log; Pre-process the alarm data to obtain standardized and unified alarm data; Perform weighted processing on standard unified alarm data to obtain weighted alarm data; The weighted alarm data is processed using a dynamic time warping algorithm to obtain the time dependency in the alarm data; According to the time dependency in the alarm data, a dependency matrix is ​​constructed; Based on the dependency matrix, graph neural network is used for modeling to obtain feature extraction and device dependency model; Based on feature extraction and device dependency model, the PrefixSpan algorithm is used to mine sequence patterns to obtain the required data features; Analyze the data features to obtain the alarm patterns with a frequency higher than the threshold, forming multi-dimensional data; Extract warning features from multidimensional data; Classify the alarm features and predict the alarm time of different categories based on the classified alarm features.

2. The method for predicting a sequence pattern of an alarm log of a power data communication network according to claim 1, characterized in that: Alarm data includes timestamp, device ID, alarm type and severity.

3. The method for predicting a sequence pattern of an alarm log of a power data communication network according to claim 1, characterized in that: The specific method of weighting the standard unified alarm data to obtain the weighted alarm data is as follows: in, is the weighted alarm data, T is the current time, λ is the time attenuation coefficient, t is the historical time, Time2Vec( t ) is the Time2Vec model.

4. The method for predicting a sequence pattern of an alarm log of a power data communication network according to claim 1, characterized in that: The specific method of using the dynamic time warping algorithm to process the weighted alarm data and obtain the time dependency relationship in the alarm data is as follows: in, is the time dependency in the alarm data, S1 is the alarm data, S2 is the data time, d is the distance measure between the alarm data and the data time, is the data length of the alarm data, is the location index of the alarm data, The time index for the data time.

5. The method for predicting a sequence pattern of an alarm log of a power data communication network according to claim 1, characterized in that: According to the time dependency in the alarm data, the specific method of constructing the dependency matrix is ​​as follows: in, is the dependency matrix, is the alarm event time difference between device i and device j, The frequency of simultaneous alarms of device i and device j.

6. The method for predicting a sequence pattern of an alarm log of a power data communication network according to claim 1, characterized in that: Based on the dependency matrix, the specific method of using graph neural network for modeling and obtaining feature extraction and device dependency model is as follows: in, For equipment In the The characteristics of the layer, is the activation function, For equipment The neighbor device set, is the normalization coefficient between neighboring devices, is the weight coefficient, For equipment In the The characteristics of the layer, is the bias coefficient, The number of layers.

7. The method for predicting a sequence pattern of an alarm log of a power data communication network according to claim 1, characterized in that: Based on feature extraction and device dependency model, the PrefixSpan algorithm is used to mine sequence patterns. The specific method to obtain the required data features is as follows: Among them, Support(S) is the required data feature, and min_support is the minimum support threshold.

8. The method for predicting a sequence pattern of an alarm log of a power data communication network according to claim 1, characterized in that: The specific method of analyzing the data characteristics and obtaining the alarm mode with a frequency higher than the threshold to form multi-dimensional data is as follows: The required data is transformed into features to obtain: in, is the alarm occurrence time, is the device ID, is the alarm type, is the severity of the alert, For the alarm description, It is the location index of the alarm data; Mining the data features after feature conversion to obtain the required alarm pattern set with the required frequency of occurrence: in, is the alarm mode set, is the sequence of alarm events, For warning events; According to the alarm pattern set with the required frequency of occurrence, multi-dimensional data is obtained: in, For multidimensional data, Enhance features for sequential patterns.

9. The method for predicting a sequence pattern of an alarm log of a power data communication network according to claim 1, characterized in that: The specific method of classifying the alarm features and predicting the alarm time of different categories according to the classified alarm features is as follows: The cross entropy loss function is used to classify the alarm features. The specific method is as follows: in, is the classified alarm feature, is the actual alarm type label, It is the location index of the alarm data, which is converted into a numerical value through the category code. is the predicted probability after calculation by the softmax function, and n is the total number of samples; The classified alarm features are used for time prediction, and the regression model is used to predict the time when future alarm events will occur.

10. Power data communication network alarm log sequence pattern prediction system, characterized in that: include: An alarm data acquisition module is used to obtain the alarm log in the power data communication network and collect the alarm data in the alarm log; A preprocessing module is used to preprocess the alarm data to obtain standard and unified alarm data; The data weighting module is used to perform weighted processing on the standard unified alarm data to obtain weighted alarm data; A dependency acquisition module is used to process the weighted alarm data using a dynamic time warping algorithm to obtain the time dependency in the alarm data; A dependency matrix building module is used to build a dependency matrix according to the time dependency relationship in the alarm data; The dependency model building module is used to model the dependency matrix using a graph neural network to obtain feature extraction and device dependency models; Data feature mining module, which is used to mine sequence patterns based on feature extraction and device dependency model using PrefixSpan algorithm to obtain required data features; A multi-dimensional data generation module is used to analyze data features, obtain alarm patterns with a frequency higher than a threshold, and form multi-dimensional data; Feature extraction module, used to extract alarm features from multi-dimensional data; The classification warning module is used to classify the alarm features and predict the alarm time of different categories based on the classified alarm features.

11. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for predicting a sequence pattern of an alarm log of a power data communication network according to any one of claims 1 to 9 are implemented.

12. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for predicting a sequence pattern of an alarm log of a power data communication network according to any one of claims 1 to 9 are implemented.

Images