Supply chain sales anomaly detection and root cause analysis system and method based on knowledge graph fusion

Abstract

The application provides a supply chain sales anomaly detection and root cause analysis system and method fused with a knowledge graph, comprising a demand collection and preprocessing module, which is used for connecting an order system, a supply chain system, a customer relationship management system and an external data source, and completing data cleaning, entity analysis and feature extraction; a supply chain knowledge graph construction module, which is used for defining entity types and relationship types; a real-time anomaly detection module, which is used for accessing sales index data flow, combining a lightweight filter and a graph neural network model to perform anomaly detection and calculate node and global anomaly scores; and a visual report generation module, which is used for automatically generating a visual report. The application constructs a dynamic supply chain knowledge graph and applies a graph neural network, deeply fuses multi-source heterogeneous data, effectively captures complex dependency relationships between entities, significantly improves the accuracy and timeliness of sales anomaly detection, realizes automatic positioning of anomaly root causes and evidence chain tracing, and greatly improves analysis efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent management and abnormality diagnosis of supply chain, and in particular to a supply chain sales abnormality detection and root cause analysis system and method fusing a knowledge graph. BACKGROUND

[0002] With the increasing complexity and digitalization of global supply chains, enterprises have higher requirements for real-time monitoring and intelligent decision-making capabilities of supply chain operations. Sales orders, as the end of the supply chain, directly reflect their abnormal fluctuations (such as sudden drop in sales, order fulfillment delay), which are often a signal of problems in the upstream of the supply chain (such as supplier delay, logistics interruption, inventory anomaly, market competition change). Timely and accurate detection of sales abnormalities and rapid identification of their root causes are crucial for enterprises to ensure customer satisfaction, reduce losses, and optimize supply chain resilience.

[0003] Currently, there are still some drawbacks in the mainstream methods and technologies in the field of sales abnormality detection and root cause analysis. Traditional abnormality detection methods usually model based on a single data source (such as only order system data). However, sales abnormalities are often the result of complex interactions of multiple factors (suppliers, logistics, inventory, customers, market activities, etc.). Existing methods cannot effectively integrate heterogeneous data from order systems, supply chain systems (suppliers, inventory, logistics), customer relationship management systems, and external environments (such as competitors, weather), cannot capture complex relationships and dependencies between entities, resulting in narrow coverage and low accuracy of abnormality detection. Once an abnormality is detected, the root cause is mainly located by manual experience, but manual investigation is time-consuming and labor-intensive, and relies on expert experience, with poor reproducibility, lack of standardized and automated analysis processes, leading to inconsistent conclusions and difficulty in promotion.

[0004] In summary, there are some drawbacks in the traditional field of abnormality detection and root cause analysis, including data silos, lack of relevance, low efficiency of root cause analysis, and strong subjectivity. In order to solve these problems, there is an urgent need for an abnormality detection and analysis technology that can deeply integrate multi-source heterogeneous data, model complex relationships and dependencies between entities using graph structures, and achieve automation.

[0005] To solve the above problems, the existing patent document with the application number CN202411429220.6 proposes a phased anomaly detection method for ultra-large-scale industrial software supply chain. This scheme divides the detection into a "fast pollution stage" (uses a simple model to screen candidate abnormal nodes / areas) and a "precise detection stage" (uses a complex model to confirm abnormalities). Its innovation lies in using the "chaos degree" concept in chaos theory and the fast-smoothing characteristics of graph neural networks to simulate abnormal propagation. However, the graph structure of this method may only reflect software component dependencies, lacking the ability to model key elements in the entity supply chain (such as supplier-product-warehouse-customer relationships) and their rich attributes.

[0006] The existing patent document with the application number CN202410574090.9 proposes a supply chain visualization method based on big data. This scheme emphasizes data collection, integration, cleaning, and preprocessing, and presents supply chain data through graphical means, aiming to improve transparency and implementation efficiency. However, this method is focused on data visualization rather than deep analysis and interpretation of data, and does not have automated anomaly detection and root cause positioning capabilities. Users still need to rely on manual observation of charts, experience-based judgment of abnormalities, and guesswork to determine the cause, failing to solve the problem of low efficiency and strong subjectivity in root cause analysis.

[0007] In summary, the existing technology still has some problems, therefore, the present application proposes a supply chain order system sales anomaly detection and root cause analysis method and system fused with a knowledge graph. SUMMARY

[0008] To overcome the shortcomings of the prior art, the present application proposes a supply chain sales anomaly detection and root cause analysis system and method fused with a knowledge graph. This system integrates multi-source heterogeneous data by constructing a dynamic supply chain knowledge graph, achieves high-precision anomaly detection using graph neural networks (GNN), and automatically locates root causes and traces evidence chains by fusing PGExplainer algorithm and business rules, significantly improving anomaly detection efficiency and root cause analysis capability.

[0009] To achieve the above purpose, the present application proposes a supply chain sales anomaly detection and root cause analysis system fused with a knowledge graph, which includes:

[0010] A data acquisition and preprocessing module is used to interface with the order system, supply chain system, customer relationship management system, and external data sources, and performs data cleaning, entity parsing, and feature extraction;

[0011] Entity parsing uses a multi-stage hybrid method:

[0012] The first stage performs accurate matching and fuzzy matching of structured fields based on attribute rule matching, where the fuzzy matching uses the Jaro-Winkler similarity algorithm with a threshold of 0.85;

[0013] The second stage utilizes a random forest model to fuse name semantic similarity, address longitude and latitude distance, and transaction frequency characteristics for entity alignment. The name semantic similarity is obtained by calculating the cosine similarity of FastText word vectors;

[0014] The third stage performs context disambiguation on the conflict entity through a BiLSTM model based on an attention mechanism;

[0015] Feature extraction includes three types of time series features, statistical features, and relationship features. Time series features calculate 7-day moving average and percentage change of order quantity. Statistical features aggregate supplier-level delivery delay rate and its standard deviation in the past 30 days. Relationship features calculate node degree centrality and multi-hop neighbor aggregation attributes based on graph topology;

[0016] A knowledge graph construction module is configured to define entity types and relationship types, and to construct a dynamic supply chain knowledge graph through deep semantic fusion of multi-source heterogeneous data;

[0017] A real-time anomaly detection module is configured to access sales index data streams and calculate node and global anomaly scores using a graph neural network model;

[0018] A root cause analysis module is configured to locate abnormal root cause entities and generate evidence chains in combination with an improved PGExplainer algorithm and predefined business rules;

[0019] A visualization report module is configured to generate interactive reports containing abnormal descriptions, root cause inferences, and graph evidence paths. D3.js is used to render force-directed graphs, with node size proportional to anomaly score and edge thickness proportional to relationship strength. The module supports up to 5-hop path expansion and folding operations.

[0020] Further, the entity types and relationship types in the knowledge graph construction module are as follows:

[0021] The entity types include: supplier entities, containing attributes {supplier ID, name, delivery delay rate, geographic location longitude and latitude};

[0022] Product entities, containing attributes {product SKU, price sensitivity index, inventory turnover rate};

[0023] Warehouse entities, containing attributes {warehouse ID, capacity, temperature control level};

[0024] Customer entities, containing attributes {customer ID, credit rating, purchase frequency};

[0025] Logistics line entities, containing attributes {line ID, average transportation time, on-time rate};

[0026] External event entity, with attributes {event ID, type, impact level};

[0027] The relationship type includes: the "supply" relationship between the supplier and the product, with attributes {supply proportion, minimum order quantity};

[0028] The "inventory located" relationship between the product and the warehouse, with attributes {inventory quantity, safety threshold};

[0029] The "delivery to" relationship between the warehouse and the customer, with attributes {delivery distance, historical compliance rate};

[0030] The "transport to" relationship between the logistics line and the warehouse, with attributes {carrier, cost unit price};

[0031] The "impact" relationship between the external event and the entity, with attributes {impact intensity, duration};

[0032] The BERT-BiLSTM-CRF model is used to identify entities in unstructured text, and the relationship extraction model based on the pre-trained language model RoBERTa is used to classify the relationship type, with a confidence threshold of 0.8; The Apache Kafka stream processing engine is used to capture incremental data, which is converted into Cypher statements and written into the Neo4j graph database to realize incremental update;

[0033] The knowledge graph construction module also includes a consistency check and conflict resolution mechanism: static rule checking based on OWL ontology reasoning, verifying the consistency of the supplier's geographic location and the logistics line coverage area; Dynamic conflict detection based on the TransE model, with entity embedding dimension set to 100, and conflict detection triggered when the embedding vectors of the head entity, relationship, and tail entity meet the distance condition, with a distance threshold of 0.3 according to the supply chain scenario; Design a weighted voting mechanism for multi-source data conflict resolution, with a reliability calculation formula , where is the standardized score of structured data source, is the confidence score of NLP extraction result, is the time decay score of historical record, and the weight coefficient is set based on the reliability of each data source.

[0034] Further, the graph neural network model in the real-time anomaly detection module is as follows:

[0035] The graph neural network model is a 3-layer graph attention network, with dimensions of 128, 64, and 32 respectively, and the node attribute features and knowledge graph adjacency matrix are fused through the spatio-temporal graph convolution layer, and the node embedding update adopts the neighbor aggregation mechanism;

[0036] The contrast loss function is used to optimize the model parameters:

[0037] ;

[0038] where , are the embedding vectors of anchor nodes and positive sample nodes respectively, are the embedding vectors of all nodes in the batch, denotes the cosine similarity function, is a temperature hyperparameter used to control the smoothness of the distribution, and N is the batch size;

[0039] A double-layer anomaly scoring mechanism is defined, and the node anomaly score ,

[0040] where is the embedding vector of node v after GNN encoding, is the cluster centroid of historical normal node embedding, denotes the L2 norm;

[0041] The global anomaly score , where V is the set of all active nodes at the current time,

[0042] is the node weight based on degree centrality;

[0043] An adaptive threshold is set , where and are the mean and standard deviation of historical normal scores in the sliding window, respectively, is a sensitivity coefficient, updated every hour;

[0044] The training process of the real-time anomaly detection module specifically includes:

[0045] A training set containing 90% historical normal sales data and 10% synthetic anomaly data is constructed, and the synthetic anomaly includes three types of point anomaly, contextual anomaly and collective anomaly;

[0046] A negative sampling strategy is adopted, with a positive to negative sample ratio of 1:3, and a batch size of 256;

[0047] An AdamW optimizer is used, with an initial learning rate of 0.001 and a weight decay coefficient of 0.01;

[0048] The model is trained for 100 epochs, and evaluated on the validation set every 10 epochs to prevent overfitting.

[0049] Further, the root cause analysis module improves the PGExplainer algorithm as follows:

[0050] The loss function is designed by adding a business relationship weight term to the original mutual information maximization objective:

[0051] ;

[0052] wherein is the mutual information between the anomaly label Y and the explanation subgraph G_S, is the edge set of the subgraph, is the pre-defined edge is the business importance coefficient (the "supply" relationship is set to 0.9, the "transport to" relationship is set to 0.8, and other relationships are set to 0.5), is the edge mask weight to be learned, is a balance hyperparameter;

[0053] The business rule base adopts version management, and the frequent rule set with a support degree greater than 0.3 is mined through the Apriori algorithm, and a rule weight time decay function is set:

[0054] wherein is the initial weight of the rule, is the time (days) after the rule is created, = 90 days is the half-life;

[0055] A root cause confidence calculation formula of multi-source fusion is designed wherein is the historical accuracy rate of the rule, K≤3 is the number of key nodes, is the normalized rule weight coefficient satisfying , is the importance score of the node output by the PGExplainer;

[0056] The specific process of extracting the 3-hop subgraph of the abnormal node by the root cause analysis module includes:

[0057] Taking the abnormal node as the starting point, all reachable nodes within 3 hops are extracted by breadth-first search;

[0058] The edge relationship and its attributes between all nodes in the subgraph are retained;

[0059] The size of the subgraph is limited to within 500 nodes, and when it exceeds, it is truncated in descending order of node anomaly score.

[0060] The supply chain sales anomaly detection and root cause analysis method of the fusion knowledge graph is suitable for the supply chain sales anomaly detection and root cause analysis system of the fusion knowledge graph, and includes the following steps:

[0061] Step S1: data acquisition and preprocessing, specifically including:

[0062] S11: Collect transaction data of the order system, inventory and logistics data of the supply chain system, customer behavior data of the customer relationship management system, and market and environmental data of external APIs in real time through a unified data interface, with a collection frequency of every 5 minutes;

[0063] S12: Perform data cleaning, including removing duplicate records, filling missing values, and correcting outliers, where missing values are filled using the forward filling method, and outliers are identified by the 3 standard deviation principle and replaced with the median;

[0064] S13: Perform three-stage entity resolution, the first stage is to accurately match the key attributes of entities, the second stage is to calculate multi-dimensional similarity for fuzzy matching, and the third stage is to use context information to eliminate ambiguity, generating a unified entity ID mapping table;

[0065] S14: Extract three types of features: timing, statistics, and relationships, and store them in the feature database, with timing features updated every hour, statistical features updated daily, and relationship features updated when the graph structure changes;

[0066] Step S2: Build a dynamic supply chain knowledge graph, specifically including:

[0067] S21: Based on the entity ID mapping table in step S13, create six types of entity nodes in the graph database, each node is assigned a corresponding attribute value;

[0068] S22: Create five types of relationship edges according to business logic and data association, calculate and store relationship attributes;

[0069] S23: Perform entity recognition and relationship extraction on unstructured text, and add triples with a confidence level greater than 0.8 to the graph;

[0070] S24: Receive real-time data streams through Kafka message queues, generate incremental update Cypher statements, and write them in batches to Neo4j, with an update delay controlled within 30 seconds;

[0071] Step S3: Perform real-time anomaly detection, specifically including:

[0072] S31: Extract the current time graph snapshot from the knowledge graph every 5 minutes, including the feature matrix and adjacency matrix of all active nodes;

[0073] S32: Input the feature matrix and adjacency matrix into the trained 3-layer graph attention network, and calculate the 32-dimensional embedding vector of each node through forward propagation;

[0074] S33: A double-layer anomaly scoring mechanism calculates node anomaly scores and global anomaly scores;

[0075] S34: Compare the anomaly score with the adaptive threshold value, and when the node or global anomaly score exceeds the corresponding threshold value, add the abnormal node to the anomaly queue;

[0076] Step S4: Locate the abnormal root cause, triggered when the anomaly is detected in step S34, specifically including:

[0077] S41: For each node in the anomaly queue, extract a 3-hop subgraph centered on the node through Neo4j's graph traversal query;

[0078] S42: Input the subgraph into the improved PGExplainer model, and optimize the edge mask through gradient ascent of the loss function. After 50 iterations, output the importance score of each node and edge;

[0079] S43: Select the top 3 nodes with the highest importance score as candidate root causes;

[0080] Step S5: Verify the root cause and generate the evidence chain, specifically including:

[0081] S51: Query the candidate root cause node for its matching rules in the rule library;

[0082] S52: Perform rule condition verification. The supplier node checks whether the delivery delay rate exceeds the historical mean plus 2 times the standard deviation. The competitor node checks whether the promotion intensity has increased by more than 50%. The logistics node checks whether the on-time rate is less than 90%;

[0083] S53: For the root cause node that passes the verification, use Dijkstra's algorithm to search for the shortest path from the abnormal node in the knowledge graph. All nodes and edges on the path constitute the evidence chain;

[0084] S54: Calculate the comprehensive confidence according to the confidence formula. When the confidence is greater than 0.7, it is confirmed as an effective root cause;

[0085] Step S6: Generate a visual report, specifically including:

[0086] S61: Use D3.js force-directed algorithm to render the graph structure of the evidence chain. Abnormal nodes are marked in red, root cause nodes are marked in orange, and evidence paths are highlighted with thick lines;

[0087] S62: Create a detail panel for each root cause node, showing its historical trend chart and related raw data;

[0088] S63: Generate a PDF report containing four parts: abnormal event description, root cause analysis conclusion, evidence chain visualization, and improvement suggestions, and automatically send it to the relevant responsible person.

[0089] Further, the improved PGExplainer optimization process in step S42 specifically includes:

[0090] Initialize the edge mask as a full 1 matrix;

[0091] In each iteration, calculate the mutual information between the prediction result under the current mask and the real abnormal label;

[0092] Update the edge mask value through the mask gradient, and the learning rate is set to 0.01;

[0093] Apply the sigmoid function to constrain the mask value in the interval [0, 1]; when the loss change of 5 consecutive iterations is less than 0.001, terminate early.

[0094] Further, the multi-path processing mechanism of the evidence chain in step S53 includes:

[0095] When there are multiple equal-length shortest paths, calculate the service relevance score of each path;

[0096] The service relevance score is equal to the sum of the service importance coefficients of all edges on the path;

[0097] Keep the top 3 paths with the highest scores as parallel evidence chains;

[0098] If the overlap degree of the evidence chain nodes of multiple root causes exceeds 60%, merge them into a composite root cause.

[0099] Further, it also includes the online updating steps of the model and the rules:

[0100] Select the abnormal cases confirmed by manual from the historical detection results every week;

[0101] Add new cases to the training set and update the GNN model parameters using incremental learning;

[0102] Statistical accuracy of each rule, automatically adjust the rule weight according to the time decay function;

[0103] When the accuracy of a certain rule is less than 50% for a month, mark it as a rule to be eliminated.

[0104] Further, the real-time performance is guaranteed by the following mechanisms:

[0105] Optimize the index of the graph database, and control the query time of the 3-hop subgraph within 100 milliseconds;

[0106] GNN inference uses model quantization and batch processing, and the single batch inference time is not more than 200 milliseconds;

[0107] Rule matching uses memory caching and parallel computing, and the matching time is controlled within 50 milliseconds;

[0108] The total time of end-to-end anomaly detection to root cause positioning is not more than 5 seconds.

[0109] Compared with the prior art, the present application has the following advantages:

[0110] 1. The present application provides a supply chain sales anomaly detection and root cause analysis system and method integrated with a knowledge graph. By constructing a dynamic supply chain knowledge graph and applying GNN, the order system, supply chain system, customer relationship management system, and external data sources are deeply integrated to effectively capture complex dependency relationships between entities, significantly improving the accuracy and timeliness of sales anomaly detection. The limitations of traditional threshold methods are overcome, and structured data extraction and natural language processing techniques are combined to dynamically extract entity relationships from unstructured text, construct a knowledge graph with rich semantic associations, and use a graph database to realize continuous incremental updates based on real-time data streams, breaking through the data silo limitations of traditional methods.

[0111] 2. The present application provides a supply chain sales anomaly detection and root cause analysis system and method integrated with a knowledge graph. Combined with the PGExplainer algorithm and business rule engine, automatic positioning and evidence chain tracing of abnormal root causes are realized, quickly identifying supply chain disruptions, competition impacts, and other issues, significantly improving analysis efficiency and reducing manual dependence.

[0112] 3. The present application provides a supply chain sales anomaly detection and root cause analysis system and method integrated with a knowledge graph. A collaborative mechanism of lightweight filtering and GNN detection is adopted to ensure real-time performance while reducing computational resource consumption. Through continuous incremental updates of the knowledge graph, data timeliness and analysis reliability are ensured.

[0113] 4. The present application provides a supply chain sales anomaly detection and root cause analysis system and method integrated with a knowledge graph. Through dynamic correlation of visual graph evidence paths with supporting data such as logistics records and quality inspection reports, decision-makers can intuitively understand the causes of anomalies, shorten fault diagnosis and response time, and optimize supply chain collaboration management capabilities. BRIEF DESCRIPTION OF DRAWINGS

[0114] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed in the specific embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0115] Figure 1 is a system flowchart of the present application;

[0116] Figure 2 is a supply chain order system sales anomaly detection and root cause analysis system architecture diagram;

[0117] Figure 3 is a dynamic supply chain knowledge graph construction and update flowchart;

[0118] Figure 4 is an abnormality detection and root cause analysis collaborative workflow chart. DETAILED DESCRIPTION

[0119] The technical solutions of the present application will be described more clearly and completely by combining the drawings and the description of the preferred embodiments of the present application.

[0120] Term explanation:

[0121] NLP: Natural Language Processing, used to extract entity and relationship information from unstructured text

[0122] API: Application Programming Interface;

[0123] SQL: Structured Query Language, used for database queries;

[0124] Cypher: Query language for Neo4j graph database;

[0125] Apache Kafka: Distributed stream processing platform, used for real-time data stream collection and transmission;

[0126] GNN: Graph Neural Network, a deep learning model for processing graph-structured data

[0127] BERT: Pre-trained language model;

[0128] BiLSTM: Bidirectional Long Short-Term Memory Network;

[0129] CRF: Conditional Random Field, used for sequence labeling tasks;

[0130] RoBERTa: Improved BERT model;

[0131] FastText: Word vector training tool developed by Facebook;

[0132] TransE: A knowledge graph embedding algorithm for entity and relationship vector representation;

[0133] AdamW: Adam optimizer with weight decay;

[0134] D-STGCN: Dynamic Spatio-Temporal Graph Convolutional Network;

[0135] PGExplainer: Algorithm for explaining graph neural network prediction results;

[0136] Jaro-Winkler: String similarity algorithm, commonly used for fuzzy matching;

[0137] Apriori: association rule mining algorithm used to discover frequent itemsets;

[0138] Dijkstra: shortest path algorithm, used to find the shortest path between two points in a graph;

[0139] L2 norm: Euclidean distance, used to calculate vector length

[0140] Neo4j: Graph Database Management System

[0141] OWL: Web Ontology Language, used to define ontologies and inference rules;

[0142] D3.js - JavaScript visualization library.

[0143] SKU: Stock Keeping Unit, used to identify a specific product

[0144] Delivery delay rate: The proportion of suppliers who fail to deliver on time

[0145] Inventory turnover rate: an indicator of how quickly inventory is updated

[0146] Fulfillment rate: the proportion of orders completed on time

[0147] Safety threshold: minimum safe level of inventory

[0148] Degree centrality: A measure of node importance in graph theory, based on the number of connections between nodes

[0149] Confidence: The degree of confidence in the model prediction or rule matching

[0150] Mutual information: an indicator in information theory that measures the degree of mutual dependence between two variables

[0151] Contrastive loss function: loss function for learning similarity in deep learning

[0152] Temperature parameter: a hyperparameter that controls the smoothness of the probability distribution

[0153] like Figure 1 The figure shows the complete architectural process of the sales anomaly detection and root cause analysis system of the supply chain order system, including six core layers from data source to final report generation.

[0154] The top layer is the data source layer, which includes four main data sources: the order system provides sales transaction data, the supply chain system provides operational data such as inventory and logistics, the customer relationship management system provides information on customer behavior and preferences, and other external data includes competitive product information, weather data, and other environmental factors. This multi-source heterogeneous data provides a comprehensive information foundation for the system.

[0155] The second layer is the demand collection and preprocessing layer, which is responsible for normalizing the received raw data. The multi-source data cleaning module removes duplicates, fills in missing values, and corrects outliers; the entity relationship analysis module aligns entities across systems through a three-stage hybrid method; and the feature balancing extraction module calculates time-series features, statistical features, and relationship features to prepare standardized inputs for subsequent analysis.

[0156] The third layer is the knowledge graph construction layer, which converts the preprocessed data into a graph structure representation. The entity relationship definition module defines six types of entity nodes and five types of relationship types; the dynamic incremental update module captures data changes in real-time using Kafka and updates the graph; and the graph database establishment module uses Neo4j to store and manage graph data, supporting complex graph query operations.

[0157] The fourth layer is the real-time anomaly detection layer, which continuously monitors sales data streams. The lightweight filtering module quickly filters out normal fluctuation data; the GNN anomaly detection scoring model uses a three-layer graph attention network to calculate node and global anomaly scores; and the trigger root cause analysis signal module automatically initiates the next stage of analysis when an anomaly is detected beyond a threshold value.

[0158] The fifth layer is the root cause analysis layer, which is responsible for locating the deep reasons for anomalies. The PGExplainer algorithm extracts a 3-hop subgraph of the anomaly node and calculates node importance; the pre-defined business rules module contains a rule library for supplier risk, competitive impact, and logistics disruption; the key node positioning module identifies the Top3 key entities; and the evidence chain tracing module constructs a complete evidence chain from the root cause to the anomaly along the graph path.

[0159] The bottom layer is the visualization report generation layer, which converts the analysis results into an easily understandable form. The root cause report generation module automatically prepares a structured report containing anomaly descriptions and root cause conclusions; the evidence path visualization module uses D3.js to render an interactive graph, identifying anomaly nodes, root cause nodes, and propagation paths with different colors; and the data support display module dynamically associates raw evidence such as logistics records and quality inspection reports to provide comprehensive support for decision-making.

[0160] As a specific implementation, a large e-commerce enterprise deployed this system to monitor sales anomalies in its complex supply chain network. The system first automatically collects transaction data from the order system, inventory and logistics data from the supply chain system, customer behavior data from the customer relationship management system, and market competitor promotion information and weather data from external API interfaces every 5 minutes through the data collection and preprocessing module. The raw data collected is cleaned, duplicate records are removed, missing values are filled in using the forward filling method, and outliers beyond 3 times the standard deviation are replaced with the median.

[0161] In the entity resolution phase, the system uses a three-stage hybrid method to handle the entity alignment problem in multi-source data. The first stage performs accurate matching and fuzzy matching based on the Jaro-Winkler algorithm for structured fields such as supplier name and product SKU, with a similarity threshold of 0.85. For example, "Shenzhen Technology Co., Ltd." and "Shenzhen Technology Co., Ltd." are identified as the same entity through fuzzy matching. The second stage uses a random forest model to consider name semantic similarity, address latitude and longitude distance, and historical transaction frequency. The name semantic similarity is obtained by calculating the cosine similarity of FastText word vectors. The third stage uses a BiLSTM model based on attention mechanism to disambiguate entities in the context of ambiguity. Three types of features are extracted: time series features including 7-day moving average and year-on-year change rate of order volume, statistical features including supplier delivery delay rate and its standard deviation in the past 30 days, and relationship features based on graph topology including node degree centrality and multi-hop neighbor aggregation attributes.

[0162] The knowledge graph construction module defines six types of entity nodes and five types of relationship types. Entities include suppliers (including supplier ID, name, delivery delay rate, geographic location latitude and longitude, etc.), products (including product SKU, price sensitivity index, inventory turnover rate), warehouses (including warehouse ID, capacity, temperature control level), customers (including customer ID, credit rating, purchase frequency), logistics lines (including line ID, average transportation time, on-time rate), and external events (including event ID, type, impact level). Relationship types include "supply" relationship between suppliers and products (including supply proportion, minimum order quantity), "inventory located in" relationship between products and warehouses, "delivered to" relationship between warehouses and customers, "transported to" relationship between logistics lines and warehouses, and "impact" relationship between external events and entities. The system uses a BERT-BiLSTM-CRF model to identify entities from unstructured text such as customer service tickets and logistics notifications, and uses a RoBERTa-based relationship extraction model to classify relationship types, with a confidence threshold of 0.8. Through the Apache Kafka stream processing engine, incremental data is captured in real time, converted into Cypher statements, and written in batches to the Neo4j graph database, with an update delay of less than 30 seconds.

[0163] To ensure the quality of the knowledge graph, the system implements a consistency check and conflict resolution mechanism. Based on OWL ontology reasoning, the consistency of supplier geographic location and logistics line coverage area is verified, and the TransE model is used for dynamic conflict detection, with entity embedding dimension set to 100 and distance threshold set to 0.3. When conflicts are detected, a weighted voting mechanism is used for resolution, with structured data weight 0.6, NLP extraction result weight 0.3, and historical record weight 0.1.

[0164] The real-time anomaly detection module deploys a 3-layer graph attention network with layer dimensions of 128, 64, and 32. The model training uses 90% historical normal sales data and 10% synthetic abnormal data, covering point anomalies, contextual anomalies, and collective anomalies. The contrastive loss function is used for optimization, with a temperature parameter of 0.1, AdamW optimizer, initial learning rate of 0.001, and weight decay coefficient of 0.01. The system extracts the current snapshot of the graph from the knowledge graph every 5 minutes and inputs it into the GNN model to calculate 32-dimensional node embedding vectors. The anomaly score uses a double-layer mechanism: the node anomaly score is obtained by calculating the L2 distance between the node embedding and the historical normal cluster centroid, and the global anomaly score is the weighted average of all node anomaly scores, with the weight based on node degree centrality. The adaptive threshold is updated every hour and set to the mean of historical normal scores plus 3 times the standard deviation.

[0165] When an anomaly is detected, the root cause analysis module is immediately started. The system extracts the 3-hop subgraph of the abnormal node, with a size limit of 500 nodes. The improved PGExplainer algorithm adds a business relationship weight term to the original mutual information maximization objective, with a "supply" relationship weight of 0.9, a "transport to" relationship weight of 0.8, and other relationship weights of 0.5. The edge mask is optimized through 50 gradient ascent iterations, outputting the importance scores of nodes and edges, and selecting the top 3 nodes with the highest scores as candidate root causes.

[0166] The business rule base uses versioned management and mines frequent rule sets with a support degree greater than 0.3 using the Apriori algorithm. The rule weight decays over time, with a half-life of 90 days. The candidate root causes are verified by checking whether the delivery delay rate of the supplier node exceeds the historical mean plus 2 times the standard deviation, whether the promotion intensity of the competitor node increases by more than 50%, and whether the on-time rate of the logistics node is lower than 90%. After verification, the Dijkstra algorithm is used to search the shortest path from the abnormal node to construct the evidence chain. The root cause confidence considers the historical accuracy of the rule, the rule weight, and the PGExplainer output score, and when the confidence is greater than 0.7, it is confirmed as an effective root cause.

[0167] The visualization report module uses D3.js to render force-directed graphs, with node size proportional to anomaly score and edge thickness proportional to relationship strength. Abnormal nodes are marked in red, root cause nodes are marked in orange, evidence paths are highlighted with thick lines, and up to 5-hop paths can be expanded and collapsed. When clicking on a root cause node, the sidebar dynamically loads related logistics waybills, quality inspection reports, and other supporting data. The system automatically generates a PDF report containing the description of the abnormal event, the conclusion of the root cause analysis, the visualization of the evidence chain, and suggestions for improvement, and sends it to the relevant responsible person via email.

[0168] In a practical application, the system detects that the order volume of a hot-selling product has decreased by 40% within 2 hours. The GNN model outputs an anomaly score of 0.92 for the product node, triggering root cause analysis. PGExplainer identifies the importance score of key supplier S1 as the highest, and the rule engine verifies that its delivery delay rate has surged from an average of 5% to 35%. Tracing along the knowledge graph, the evidence chain is found: "product P sales decline <- supply delay <- supplier S1 <- typhoon impact on raw material producing area". The system completes the whole-process analysis within 5 seconds, enabling the enterprise to timely start an emergency plan for alternative suppliers and minimize losses.

[0169] Embodiment 1

[0170] The application provides a supply chain order system sales anomaly detection and root cause analysis system based on a knowledge graph, which comprises a data acquisition and preprocessing module, a knowledge graph construction module, a real-time anomaly detection module, a root cause analysis module, and a visualization report module. Figure 2

[0171] The data acquisition and preprocessing module is used to connect the order system, the supply chain system, the customer relationship management system, and external data sources (such as competitor databases and weather APIs), and perform data cleaning, entity analysis, and feature extraction (such as calculating order fulfillment rate and inventory turnover rate).

[0172] The knowledge graph construction module is used to define entity types (such as suppliers, products, warehouses, and customers) and relationship types (such as "supply", "transport to", and "purchase"), construct a dynamic supply chain knowledge graph through structured data extraction and NLP technology, and realize incremental updating based on real-time data streams using a graph database (Neo4j).

[0173] The real-time anomaly detection module is used to access sales indicator data streams (such as minute-level order volume), quickly filter out normal fluctuation data using a lightweight filtering unit, and calculate node and global anomaly scores through a GNN model.

[0174] The root cause analysis module is used to locate abnormal root cause entities by combining the PGExplainer algorithm and pre-defined business rules, and generate evidence chains along the graph relationship path.

[0175] The visualization report module is used to generate interactive reports, dynamically display abnormal event descriptions, root cause inference results, knowledge graph evidence paths (such as "abnormal product <- supply <- delayed supplier" path), and related supporting data (such as logistics delay records).

[0176] ​When the system is working, firstly, the system integrates multi-source heterogeneous data in real time through the data acquisition and preprocessing module, completes entity alignment and feature calculation; then the knowledge graph construction module dynamically updates the graph based on ontology definition, and supplements the relationship extracted from unstructured text; the real-time anomaly detection module continuously monitors the sales data stream, and automatically triggers the root cause analysis process when the anomaly score output by the GNN model exceeds the threshold; the root cause analysis module extracts the local subgraph of the abnormal node, calculates the node importance through PGExplainer and matches the business rule to verify the root cause, and finally aggregates the multi-hop path to form an evidence chain; the visualization report module automatically renders the evidence path and associates the underlying data to generate a decision report.

[0177] As a specific embodiment, the application provides a supply chain order system sales anomaly detection and root cause analysis system integrated with a knowledge graph, based on embodiment 1, the knowledge graph construction module includes an ontology definition unit, a dynamic updating unit and an NLP supplement unit. The ontology definition unit predefines entity types (including attributes, such as the “delivery delay rate” field of the supplier node) and relationship types (such as the “inventory located” relationship of “product-warehouse”). The dynamic updating unit captures incremental data (such as new orders, inventory changes) in real time through a streaming data processing engine (Apache Kafka), converts it into a graph structure and writes it into a graph database. The NLP supplement unit extracts entity relationships (such as extracting the 〈Supplier A, affected event, typhoon〉 triple from “Supplier A is affected by typhoon”) from customer service tickets, news and other unstructured texts, and supplements them to the graph after confidence filtering.

[0178] As a specific embodiment, the application provides a supply chain order system sales anomaly detection and root cause analysis system integrated with a knowledge graph, based on embodiment 1, the real-time anomaly detection module includes a lightweight filtering unit, a GNN anomaly detection unit and a trigger mechanism unit. The lightweight filtering unit quickly filters normal data points based on sliding window statistics (such as the mean of the same period in the past 7 days ± 3 standard deviations), and only inputs suspicious data into the GNN model. The GNN anomaly detection unit adopts a dynamic spatio-temporal graph convolution network (D-STGCN), which can model the spatio-temporal dependence of graph topology and node attributes, and uses the knowledge graph as the topology, integrates node attributes (such as product price sensitivity) and time series features (such as order volume trend), and outputs the abnormal score of each node and the global abnormal score. The trigger mechanism unit sets threshold strategies, such as when the individual node score is greater than 0.8 or the global score is greater than 0.7, the root cause analysis module is automatically called and the abnormal node is locked.

[0179] As a specific embodiment, the application provides a supply chain order system sales anomaly detection and root cause analysis system integrated with a knowledge graph, based on embodiment 1, the root cause analysis module performs the following processes:

[0180] Step S1: Extract subgraph centered at the abnormal node, covering all nodes and edges within its 3-hop relationship range;

[0181] Step S2: Calculate node importance scores within the subgraph by PGExplainer, and identify the top three key entities with the highest scores (e.g., supplier S1 with a score of 0.92, and competitor C1 with a score of 0.85);

[0182] Step S3: Invoke the rule engine unit to match the business rule library. For example, if supplier S1 hits the "supplier risk rule", verify whether its attribute "delivery delay rate" is greater than the historical delivery delay rate; if competitor C1 hits the "competitive impact rule", verify whether its "promotion intensity" attribute has suddenly increased;

[0183] Step S4: Aggregate the evidence chain along the graph path (e.g., "product P sales decline <- supply delay <- supplier S1 <- raw material shortage"), and correlate external data (e.g., raw material procurement order delay records of supplier S1).

[0184] As a specific embodiment, the application provides a supply chain order system sales anomaly detection and root cause analysis system integrating a knowledge graph. Based on embodiment 1, the visualization report module includes a graph path rendering unit and a dynamic evidence correlation unit. The graph path rendering unit highlights the abnormal node, root cause node, and evidence path in different colors, and supports path expansion / folding operations. The dynamic evidence correlation unit realizes bidirectional interaction: when a root cause node (such as supplier S1) is clicked, the side bar dynamically loads its associated logistics order delay list and quality inspection report; when the "transport to" relationship on the evidence path is clicked, a on-time rate trend chart for the line in the past 7 days is displayed.

[0185] The dynamic supply chain knowledge graph construction and updating process is shown in Figure 3 The process starts from the ontology definition at the top, including two parallel modules of entity type definition and relationship type definition, which lay the foundation for the subsequent knowledge graph construction. The data integration section processes three different types of data sources: serialized data is processed through SQL query, real-time data is directly accessed to the system, and unstructured data needs to be processed through NLP to extract useful information. These three data streams converge in the entity relationship extraction module, which is responsible for identifying and extracting entities and their relationships from multiple heterogeneous data sources. After extraction, the system writes this information into the graph database for persistent storage. The bottom of the process is the incremental updating mechanism, including three parallel modules of entity updating, attribute updating, and relationship updating, which ensures that the knowledge graph can dynamically evolve with the arrival of new data, maintaining the timeliness and accuracy of the information.

[0186] The collaborative workflow of anomaly detection and root cause analysis is shown in Figure 4As shown, the whole is divided into two parts. The left side is the anomaly detection process, starting from the sales data flow input, first through lightweight filtering to quickly exclude obviously normal data. The first judgment node evaluates whether the data is abnormal, and the normal data is directly passed, and the abnormal data is put into the GNN model for deep analysis. After the GNN model calculates the abnormal score of each node, the second judgment node checks whether the score exceeds the preset threshold. The data that does not exceed the threshold is determined to be normal and passed, and the data that exceeds the threshold triggers the root cause analysis process on the right side. After receiving the trigger signal, the root cause analysis process on the right side first extracts the jump neighborhood subgraph of the abnormal node to obtain its local network structure. Then the PGExplainer algorithm is used to analyze the importance of each node and edge in the subgraph, and the Top3 key entities are identified. These key entities are verified by the rule engine to confirm their possibility as the root cause. Then the system aggregates the multi-hop path to trace back the propagation path from the root cause to the abnormal performance, and finally generates a complete evidence chain to provide a clear explanation of the cause of the anomaly for the decision maker. The two processes are seamlessly connected through the anomaly threshold judgment, forming an automated anomaly detection and intelligent root cause positioning system.

[0187] The above detailed description only describes the preferred embodiments of the present application, and does not limit the protection scope of the present application. Without departing from the design concept and spirit of the present application, those skilled in the art can make various modifications, substitutions and improvements to the technical solutions of the present application according to the description and drawings provided by the present application, which should all belong to the protection scope of the present application. The protection scope of the present application is determined by the claims.

Claims

1. A supply chain sales anomaly detection and root cause analysis system fused with a knowledge graph, characterized in that, Comprise: A data acquisition and preprocessing module for interfacing with order systems, supply chain systems, customer relationship management systems, and external data sources, performing data cleaning, entity resolution, and feature extraction; Entity resolution uses a multi-stage hybrid method: The first stage is based on attribute rule matching for accurate matching and fuzzy matching of structured fields, where fuzzy matching uses the Jaro-Winkler similarity algorithm with a threshold of 0.85; The second stage uses a random forest model to fuse name semantic similarity, address latitude and longitude distance, and transaction frequency features for entity alignment, with name semantic similarity obtained by calculating the cosine similarity of FastText word vectors; The third stage uses a BiLSTM model based on attention mechanism to resolve context conflicts for conflicting entities; Feature extraction includes three types of time series features, statistical features, and relationship features, time series features calculate 7-day moving average and year-on-year change rate of order quantity, statistical features aggregate supplier-level delivery delay rate and its standard deviation in the past 30 days, relationship features calculate node degree centrality and multi-hop neighbor aggregation attributes based on graph topology; A knowledge graph construction module for defining entity types and relationship types, constructing a dynamic supply chain knowledge graph through deep semantic fusion of multi-source heterogeneous data; A real-time anomaly detection module for accessing sales indicator data streams, using a graph neural network model to calculate node and global anomaly scores; A root cause analysis module for locating abnormal root cause entities and generating evidence chains by combining an improved PGExplainer algorithm and predefined business rules; the improved PGExplainer algorithm of the root cause analysis module is as follows: Add a business relationship weight term to the original mutual information maximization objective to design a loss function: ， wherein is the mutual information between the anomaly label Y and the explanation subgraph G_S, is the set of subgraph edges, is the predefined edge is the business importance coefficient, the "supplies" relationship is set to 0.9, the "transport to" relationship is set to 0.8, and other relationships are set to 0.5, is the edge mask weight to be learned, = 0.5 is the balance hyperparameter; The business rule base uses versioned management, and uses the Apriori algorithm to mine frequent rule sets with a support degree greater than 0.3, and sets a rule weight time decay function: wherein is the initial weight of the rule, is the time since the rule was created, = 90 days is the half-life; Design a root cause confidence calculation formula of multi-source fusion wherein is the historical accuracy rate of the rule, K≤3 is the number of key nodes, is the normalized rule weight coefficient, and satisfies , is the importance score of the node output by PGExplainer; The specific process of the root cause analysis module for extracting a 3-hop subgraph of an abnormal node includes: Starting from the abnormal node, use breadth-first search to extract all reachable nodes within 3 hops; Keep the edge relationships and their attributes between all nodes in the subgraph; Limit the size of the subgraph to within 500 nodes, and if exceeded, sort by node anomaly score in descending order and cut off; A visualization report module for generating interactive reports containing abnormal descriptions, root cause inferences, and graph evidence paths, using D3.js to render force-directed graphs, with node size proportional to anomaly score and edge thickness proportional to relationship strength, supporting up to 5-hop path expansion and folding operations. 2.The supply chain sales anomaly detection and root cause analysis system of the fused knowledge graph according to claim 1, wherein, The entity types and relationship types in the knowledge graph construction module are as follows: The entity types include: Supplier entities with attributes {Supplier ID, Name, Delivery Delay Rate, Geographical Location Latitude and Longitude}; Product entities with attributes {Product SKU, Price Sensitivity Index, Inventory Turnover Rate}; Warehouse entities with attributes {Warehouse ID, Capacity, Temperature Control Level}; Customer entities with attributes {Customer ID, Credit Rating, Purchase Frequency}; Logistics route entities with attributes {Route ID, Average Transportation Time, On-Time Rate}; External event entity, containing attributes {event ID, type, impact level}; The relationship type includes: "supply" relationship between supplier-product, containing attributes {supply proportion, minimum order quantity}; "Inventory located" relationship between product-warehouse, containing attributes {inventory quantity, safety threshold}; "Delivery to" relationship between warehouse-customer, containing attributes {delivery distance, historical compliance rate}; "Transport to" relationship between logistics route-warehouse, containing attributes {carrier, cost unit price}; "Influence" relationship between external event-entity, containing attributes {influence intensity, duration}; The entity in unstructured text is identified by BERT-BiLSTM-CRF model, the relationship type is classified by relationship extraction model based on pre-training language model RoBERTa, and the confidence threshold is set to 0.8; The incremental data is captured by Apache Kafka stream processing engine, converted into Cypher statement and written into Neo4j graph database to realize incremental update; The knowledge graph construction module further comprises a consistency check and conflict resolution mechanism: static rule checking based on OWL ontology reasoning, verifying the consistency of the geographical location of the supplier and the coverage area of the logistics line; dynamic conflict detection based on the TransE model, the entity embedding dimension is set to 100, when the embedding vectors of the head entity, the relationship and the tail entity satisfy the distance condition, the conflict detection is triggered, and the distance threshold is set to 0.3 according to the supply chain scene; a weighted voting mechanism for conflict resolution of multi-source data is designed, and the reliability calculation formula is wherein is the standardized score of the structured data source, is the confidence score of the NLP extraction result, is the time decay score of the historical record, and the weight coefficient is set based on the reliability of each data source.

3. The supply chain sales anomaly detection and root cause analysis system integrating knowledge graph according to claim 1 is characterized in that: The graph neural network model in the real-time anomaly detection module is as follows: The graph neural network model is a 3-layer graph attention network, with dimensions of 128, 64 and 32 respectively, which integrates node attribute features and knowledge graph adjacency matrix through spatio-temporal graph convolution layer, and adopts neighbor aggregation mechanism for node embedding update; The model parameters are optimized by contrast loss function: ； wherein , are embedding vectors of anchor nodes and positive sample nodes, respectively, are embedding vectors of all nodes within a batch, denotes a cosine similarity function, = 0.1 is a temperature hyperparameter used to control the degree of smoothing of the distribution, and N is the batch size. Defining a double layer anomaly scoring mechanism, node anomaly score , wherein is the embedding vector of node v after GNN encoding, is the cluster centroid of historical normal node embeddings, denotes the L2 norm; Global anomaly score where V is the set of all active nodes at the current time instant, a node weight based on degree centrality; Setting adaptive thresholds where and are the mean and standard deviation of the historical normal scores within the sliding window, respectively, = 3 is a sensitivity coefficient, updated every hour. The training process of the real-time anomaly detection module specifically includes: A training set containing 90% historical normal sales data and 10% synthetic abnormal data is constructed, and the synthetic abnormality includes three types of point abnormality, context abnormality and collective abnormality; Negative sampling strategy is adopted, with positive to negative sample ratio of 1:3 and batch size of 256; AdamW optimizer is used, with initial learning rate of 0.001 and weight decay coefficient of 0.01; Train for 100 epochs, evaluate on validation set every 10 epochs, and use early stopping strategy to prevent overfitting.

4. The method for supply chain sales anomaly detection and root cause analysis based on knowledge graph, applicable to the system for supply chain sales anomaly detection and root cause analysis based on knowledge graph according to any one of claims 1-3, characterized in that, The steps include: Step S1: data acquisition and preprocessing, specifically including: S11: real-time acquisition of transaction data of order system, inventory and logistics data of supply chain system, customer behavior data of customer relationship management system and market and environment data of external API through unified data interface, with acquisition frequency of every 5 minutes; S12: perform data cleaning, including removing duplicate records, filling missing values and correcting abnormal values, wherein missing values are filled by forward filling method, and abnormal values are identified by 3 times standard deviation principle and replaced by median; S13: perform three-stage entity resolution, the first stage is to accurately match the key attributes of entities, the second stage is to calculate multi-dimensional similarity for fuzzy matching, and the third stage is to eliminate ambiguity by using context information, and generate a unified entity ID mapping table; S14: extract three types of features, time series, statistics and relationships, and store them in feature database, time series features are updated every hour, statistical features are updated every day, and relationship features are updated when the graph structure changes; Step S2: build dynamic supply chain knowledge graph, specifically including: S21: based on the entity ID mapping table of step S13, create six types of entity nodes in the graph database, and assign corresponding attribute values to each node; S22: Create five types of relationship edges according to business logic and data association, calculate and store relationship attributes; S23: Perform entity recognition and relationship extraction on unstructured text, and add triples with a confidence level greater than 0.8 to the graph; S24: Receive real-time data streams through the Kafka message queue, generate incremental update Cypher statements, and write them in batches to Neo4j, with an update delay of 30 seconds; Step S3: Perform real-time anomaly detection, specifically including: S31: Extract a graph snapshot at the current time from the knowledge graph every 5 minutes, including the feature matrix and adjacency matrix of all active nodes; S32: Input the feature matrix and adjacency matrix into the trained 3-layer graph attention network to calculate the 32-dimensional embedding vector of each node through forward propagation; S33: Calculate node anomaly scores and global anomaly scores using a double-layer anomaly scoring mechanism; S34: Compare the anomaly scores with the adaptive threshold, and when the node or global anomaly score exceeds the corresponding threshold, add the abnormal node to the anomaly queue; Step S4: Locate the root cause, triggered when an anomaly is detected in step S34, specifically including: S41: For each node in the anomaly queue, extract a 3-hop subgraph centered on the node through graph traversal queries in Neo4j; S42: Input the subgraph into the improved PGExplainer model, and optimize the edge mask through the gradient ascent loss function. After 50 iterations, output the importance scores of each node and edge; S43: Select the top 3 nodes with the highest importance scores as candidate root causes; Step S5: Verify the root cause and generate an evidence chain, specifically including: S51: Query the candidate root cause node for matching rules in the rule library; S52: Perform rule condition verification. The supplier node checks whether the delivery delay rate exceeds the historical mean plus 2 standard deviations, the competitor node checks whether the promotion intensity has increased by more than 50%, and the logistics node checks whether the on-time rate is less than 90%; S53: For root cause nodes that pass the verification, use Dijkstra's algorithm to search for the shortest path from the anomaly node in the knowledge graph. All nodes and edges on the path form the evidence chain; S54: Calculate the comprehensive confidence level according to the confidence formula, and confirm it as an effective root cause when the confidence level is greater than 0.7; Step S6: Generate a visual report, specifically including: S61: Use the D3.js force-directed algorithm to render the graph structure of the evidence chain, with abnormal nodes marked in red and root cause nodes marked in orange, and the evidence path highlighted with thick lines; S62: Create a detail panel for each root cause node, displaying its historical trend chart and related raw data; S63: Generate a PDF report containing four parts: abnormal event description, root cause analysis conclusion, evidence chain visualization, and improvement suggestions, and automatically send it to the relevant responsible person. 5.The supply chain sales anomaly detection and root cause analysis method of fusing knowledge graph according to claim 4, characterized in that, The improved PGExplainer optimization process in step S42 specifically includes: Initialize the edge mask as a full 1 matrix; In each iteration, calculate the mutual information between the predicted results under the current mask and the true anomaly label; Update the edge mask value through the mask gradient, with a learning rate of 0.01; The mask value is constrained in the interval [0, 1] by using a sigmoid function; the training is terminated in advance when the loss change of 5 consecutive iterations is less than 0.

001.

6. The supply chain sales anomaly detection and root cause analysis method of fusing knowledge graph according to claim 4, characterized in that, The multi-path processing mechanism of the evidence chain in step S53 includes: When there are multiple equal-length shortest paths, calculate the service relevance score of each path; The service relevance score is equal to the sum of the service importance coefficients of all edges on the path; Keep the top 3 paths with the highest scores as parallel evidence chains; If the evidence chain nodes of multiple root causes overlap by more than 60%, merge them into a composite root cause.

7. The supply chain sales anomaly detection and root cause analysis method of fusing knowledge graph according to claim 4, characterized in that, The online updating steps of the model and rules are also included: Select the abnormal cases confirmed by humans from the historical detection results every week; Add new cases to the training set and update the GNN model parameters using incremental learning; Statistical the accuracy of each rule and automatically adjust the rule weight according to the time decay function; When the accuracy of a rule is less than 50% for a month, mark it as a rule to be eliminated. 8.The supply chain sales anomaly detection and root cause analysis method of fusing knowledge graph according to claim 4, characterized in that, The real-time performance is guaranteed through the following mechanisms: Optimize the index of the graph database, and control the query time of the 3-hop subgraph within 100 milliseconds; Use model quantization and batch processing for GNN inference, and the single-batch inference time is not more than 200 milliseconds; Use memory caching and parallel computing for rule matching, and the matching time is controlled within 50 milliseconds; The total time of end-to-end anomaly detection to root cause positioning is not more than 5 seconds.

Images