Abnormality detection method and system based on knowledge graph and rule reasoning

Abstract

The invention provides an anomaly detection method and system based on a knowledge graph and rule reasoning, and the method comprises the steps: obtaining the anomaly information of a power system: inputting the anomaly information into a preset operation inspection model, so as to enable the operation inspection model to generate standardized data in a preset format, extracting corresponding knowledge paths and node information from a preset knowledge graph according to the standardized data, and further generating a semantic reasoning result; inputting the standardized data into a preset inference engine, so that the inference engine performs rule inference according to a preset rule base, and further generates a rule inference result; each of the semantic reasoning result and the rule reasoning result comprises a judgment result of an abnormal state, cause analysis of the abnormal state and a fault root cause positioning path; and performing comparison verification according to the semantic reasoning result and the rule reasoning result, and generating a corresponding anomaly detection result according to a comparison verification result, thereby improving the accuracy and efficiency of anomaly detection.

Description

Technical Field

[0001] The present application relates to the technical fields of artificial intelligence and power system anomaly detection, and in particular to an anomaly detection method and system based on knowledge graph and rule reasoning. Background Art

[0002] As a key equipment of the new power system, the flexible high-voltage direct current (VSC-HVDC) converter station is widely used in scenarios such as renewable energy grid connection and long-distance power transmission. As the core hub of this technology, the flexible high-voltage direct current (VSC-HVDC) converter station has complex operating conditions and involves a rich variety of monitoring data types, including alarm information, equipment operating parameters, environmental information and other multimodal data. The traditional operation and maintenance mode is mainly based on manual monitoring, relying on the experience and established procedures of the operation and maintenance personnel to perform abnormal analysis and troubleshooting. The operation and maintenance personnel need to manually screen historical alarm logs and procedure documents (such as IEC 61850 standard documents), which is inefficient and easily limited by subjective experience. With the development of science and technology, there are still several methods for abnormal detection of power systems: (1) SCADA system monitoring: The equipment operating parameters (such as voltage, current, and temperature) are collected through the Supervisory Control and Data Acquisition (SCADA) system, but the data utilization is limited to threshold alarms and lacks multi-dimensional correlation analysis. (2) Traditional machine learning models: These use algorithms such as isolation forests or support vector machines (SVMs) for anomaly detection, but they suffer from the following problems: difficulty processing multi-source heterogeneous data (e.g., text-based maintenance reports, time-series sensor data, and equipment topology diagrams); reliance on manual feature engineering, which makes it impossible to dynamically adapt to the characteristics of new converter station equipment (e.g., modular multilevel converters (MMCs)); and poor model interpretability, which prevents them from outputting reasoning paths that comply with power industry standards. (3) Knowledge base construction technology: Existing knowledge bases are mostly based on relational databases (e.g., MySQL) to store device parameters. These lack semantic association capabilities and are unable to support the "fault cause → treatment suggestion" reasoning chain.

[0003] However, current anomaly detection in flexible DC converter stations primarily relies on a single-point threshold-based alarm mechanism, which is inadequate for complex scenarios. The system lacks the ability to deeply analyze inter-alarm correlations. For example, it cannot identify whether multiple alarms from different components of the same equipment stem from the same fault chain, or the causal relationship between alarms from different devices. This results in isolated alarm information, making it difficult to accurately locate the root cause of the fault. When an anomaly occurs, the system often triggers a large number of unprioritized alarms, creating an "alarm flood." Operations and maintenance personnel spend a considerable amount of time sifting through critical information, which can easily lead to misjudgments and delayed response, severely impacting fault response efficiency. Furthermore, existing operations and maintenance knowledge is primarily stored in unstructured documents (such as procedure manuals and training materials), resulting in significant knowledge management deficiencies. Distributed knowledge storage creates "islands," making it difficult to integrate and reuse knowledge across departments and positions, resulting in low utilization of operational and maintenance experience. Furthermore, text-based knowledge lacks machine-interpretable semantic representations (such as knowledge graphs or structures supported by rule engines), making it unsuitable for direct use in automated reasoning and decision support. The knowledge update mechanism is also relatively rigid. When equipment is iterated or new fault types are added, manual intervention is required to update the knowledge base, which poses a lag risk and makes it difficult to adapt to rapidly changing operation and maintenance needs. Finally, the existing system relies too much on manual experience in fault diagnosis and processing, and lacks intelligent tools. Faced with multi-source data (real-time monitoring, historical records, alarm logs, etc.), the system lacks cross-dimensional data fusion and comprehensive analysis capabilities, making it difficult to generate global fault analysis conclusions. The processing suggestions are mostly static preset rules, and it is impossible to dynamically generate personalized solutions based on specific scenarios, resulting in insufficient flexibility in dealing with complex faults. At the same time, differences in personnel capabilities directly affect the quality of operation and maintenance. When experts leave their posts or newcomers lack experience, the efficiency and accuracy of fault handling drop significantly, posing a greater operation and maintenance risk. Summary of the Invention

[0004] In response to the above technical problems, this application provides an anomaly detection method and system based on knowledge graph and rule reasoning to improve the accuracy and efficiency of anomaly detection.

[0005] In a first aspect, an embodiment of the present application provides an anomaly detection method based on knowledge graph and rule reasoning, including:

[0006] Obtain abnormal information of the power system:

[0007] Input the abnormal information into a preset operation and inspection model, so that the operation and inspection model generates standardized data in a preset format according to the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph according to the standardized data, thereby generating a semantic reasoning result;

[0008] Inputting the standardized data into a preset reasoning engine, so that the reasoning engine performs rule reasoning on the standardized data according to a preset rule base, thereby generating a rule reasoning result; wherein both the semantic reasoning result and the rule reasoning result include a determination result of an abnormal state, an analysis of the cause of the abnormal state, and a fault root cause location path;

[0009] Comparing and verifying the semantic reasoning result with the rule reasoning result, and generating a corresponding anomaly detection result based on the comparison and verification result;

[0010] Among them, the operation and inspection model is obtained by training the language model, the knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, and the inference engine is constructed based on the open source rule inference framework and the knowledge graph.

[0011] The present application embodiment provides an anomaly detection method based on knowledge graphs and rule reasoning. This method uses an operation and maintenance model to perform preliminary processing and understanding of power system anomaly information, generating corresponding standardized data. The knowledge graph then performs semantic reasoning on the anomaly information to generate semantic reasoning results. Furthermore, the present application embodiment introduces a reasoning engine to perform more rigorous and tight rule reasoning on the standardized data to generate rule reasoning results. The reasoning engine focuses on rule-driven, symbolic logic reasoning, making judgments based on explicit rule chains based on expert knowledge. It is suitable for problem-solving scenarios with clear boundary conditions and clear causal relationships. The large model, on the other hand, is more adept at understanding unstructured input, contextual semantic completion, and parsing complex language expressions, primarily for enhancing input understanding and addressing language ambiguity. The present application embodiment enables the two to work together and complement each other, forming a fusion mechanism of structured rule reasoning and semantically enhanced reasoning, enabling automated processing of massive amounts of anomaly information and improving the accuracy and efficiency of anomaly detection. Furthermore, the reasoning process incorporates professional knowledge graphs in the field of power system operation and maintenance, enhancing the ability to analyze the causes and locate the root causes of complex fault chains, addressing the problem of isolated alarm information in traditional methods and further improving the accuracy of anomaly detection.

[0012] In one possible implementation, the operation and inspection model generates standardized data in a preset format based on the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph based on the standardized data, thereby generating semantic reasoning results, including:

[0013] Performing entity recognition, context modeling, and semantic completion on the abnormal information to generate standardized data in an intermediate semantic representation, wherein the standardized data includes device entities, alarm types, and potential failure modes;

[0014] Querying a preset knowledge graph based on the standardized data to determine whether a corresponding knowledge path exists;

[0015] If a corresponding knowledge path exists in the knowledge graph, extract the knowledge path and node information on the knowledge path;

[0016] The standardized data is semantically matched and knowledge enhanced according to the knowledge path and node information to generate the semantic reasoning result.

[0017] The embodiment of the present application provides a semantic reasoning method based on an operation and inspection model. Since the text structure of the abnormal information generated by the power system is diverse, the knowledge graph or reasoning engine cannot process it directly. Therefore, the present application first utilizes the language model's efficient processing capabilities for text information, performs entity recognition, context modeling, and semantic completion on the acquired abnormal information, generates standardized data that can be recognized by the knowledge graph or reasoning engine, improves data consistency, and prepares data for subsequent semantic reasoning and rule reasoning. Then, based on the knowledge graph, the knowledge path is dynamically queried and node information is extracted to avoid the static knowledge storage defects of traditional relational databases and adapt to the requirements of updating the failure mode of new equipment. Finally, through semantic matching and knowledge enhancement technology, the ability to analyze fuzzy or unstructured abnormal information is enhanced, the reliability of the reasoning results is improved, and the accuracy of subsequent abnormality detection is thereby improved.

[0018] In one possible implementation, the inference engine performs rule inference on the standardized data according to a preset rule base, thereby generating a rule inference result, including:

[0019] Matching the standardized data with entity nodes in the knowledge graph to obtain a number of matching entity nodes;

[0020] Performing forward chain reasoning and backward chain reasoning on each of the matching entity nodes according to the rule base, thereby determining the logical relationship between each of the matching entity nodes;

[0021] generating a causal chain including each of the matching entity nodes according to the logical relationship between each of the matching entity nodes;

[0022] Generate rule reasoning results based on the causal chain.

[0023] This embodiment of the application provides a rule-based reasoning method based on an inference engine. During the rule-based reasoning process, the entity nodes of the knowledge graph are dynamically bound to achieve dynamic expansion of the rule base and adapt to complex power grid scenarios. Furthermore, forward chaining and backward chaining reasoning are combined to perform multi-dimensional logical relationship verification on each matching entity node, thereby improving the comprehensiveness and accuracy of rule-based reasoning and, in turn, the accuracy of subsequent anomaly detection. Finally, a complete causal chain is generated based on each logical relationship, clarifying the fault path corresponding to the anomaly information, enhancing the interpretability of the rule-based reasoning results, and improving the user experience.

[0024] In one possible implementation, generating a corresponding anomaly detection result based on the comparison and verification result includes:

[0025] If the semantic reasoning result is consistent with the rule reasoning result, the semantic reasoning result and the preset first prompt word are input into the operation and inspection model, so that the operation and inspection model generates corresponding exception handling suggestions according to the semantic reasoning result; the semantic reasoning result, the exception handling suggestions and the knowledge path are encapsulated as the exception detection result;

[0026] If the semantic reasoning result is inconsistent with the rule reasoning result, the semantic reasoning result and the rule reasoning result are encapsulated in a parallel form as the anomaly detection result.

[0027] In the embodiments of the present application, semantic reasoning is compared and verified with rule reasoning results to reduce the limitations of a single model and improve the robustness and accuracy of anomaly detection. When the results of semantic reasoning and rule reasoning are consistent, the text generation capability of the operation and inspection model is further utilized to generate corresponding anomaly handling suggestions based on the determined reasoning results, realizing closed-loop automation from detection to disposal. When the results of semantic reasoning and rule reasoning are inconsistent, the conflicting results are packaged in parallel to facilitate manual review by operation and maintenance personnel, reduce decision delays, improve user experience and the efficiency of handling anomaly situations.

[0028] Furthermore, if the inference engine cannot recognize the standardized data or the inference engine cannot generate the rule inference result, the semantic inference result and the preset second prompt word are input into the operation and inspection model, so that the operation and inspection model generates a confidence score and a semantic matching score corresponding to the semantic inference result;

[0029] If the confidence score and semantic matching score corresponding to the semantic reasoning result are greater than a preset threshold, the semantic reasoning result, the confidence score, the semantic matching score and the knowledge path are encapsulated as the anomaly detection result and the anomaly detection result is marked.

[0030] In the embodiment of the present application, the difference in the ability of the inference engine and the operation and inspection model to understand the input data is taken into account. For abnormal information of fuzzy input, even if the operation and inspection model is used to process it into standardized data, the inference engine may still not be able to recognize it, or the rule reasoning of the standardized data cannot be completed based on the existing rule base, resulting in a temporary failure of the inference engine. On the contrary, the operation and inspection model built based on the language model is better at understanding unstructured input. In most cases, it can recognize the input standardized data and generate corresponding reasoning results. Therefore, the embodiment of the present application provides a special processing mechanism under the condition of temporary failure of the inference engine, extracts the confidence score and semantic matching score corresponding to the semantic reasoning result, and quantifies the reliability of the reasoning result through the score. If the score is greater than the preset threshold, the corresponding semantic reasoning result and each score are encapsulated as an abnormality detection result and marked to ensure the normal output of the abnormality detection result. At the same time, it is convenient for the operation and maintenance personnel to manually review, reduce decision delays, and enhance the power system's adaptive ability to new abnormalities.

[0031] In one possible implementation, the knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, including:

[0032] Extract several professional knowledge texts of operation and inspection from several heterogeneous data sources;

[0033] Identify entities in each of the operation and inspection professional knowledge texts using named entity recognition technology to obtain a number of entities and corresponding entity attributes;

[0034] According to the dependency syntax analysis and relationship extraction algorithm, the semantic relationship between each of the entities is identified through the preset extraction rules and the neural network relationship classifier to obtain a number of entity relationship recognition results;

[0035] Constructing a plurality of triples in RDF format according to the plurality of entities and the plurality of entity relationship recognition results;

[0036] Based on the entities, entity attributes and triples, the knowledge graph is constructed.

[0037] The embodiment of the present application provides a method for constructing a knowledge graph, which extracts various entities and entity attributes from a number of operation and inspection professional knowledge texts and establishes RDF triples based on the relationships between the entities, and finally integrates the above data to complete the construction of the knowledge graph. Among them, structured storage based on RDF triples is utilized to support the semantic association of multi-source heterogeneous data, effectively avoiding the formation of "islands" of knowledge stored in dispersed manner and improving the utilization rate of operation and inspection professional knowledge; dependency syntax analysis and relationship extraction algorithms are used to improve the efficiency of knowledge mining of unstructured texts. The construction of the knowledge graph provides a stable and flexible knowledge foundation for the subsequent rule reasoning engine and large model semantic mapping, improving the accuracy and efficiency of anomaly detection.

[0038] In one possible implementation, the obtaining of the operation and inspection model by training the language model includes:

[0039] Build an initial operation and inspection model based on the pre-trained language model;

[0040] Performing unsupervised language modeling training on the initial operation inspection model according to a preset operation inspection field corpus to obtain a first operation inspection model;

[0041] According to a number of preset operation and inspection tasks and a manually annotated training set, the first operation and inspection model is fine-tuned through supervised learning to obtain a second operation and inspection model;

[0042] The output content of the second operation and inspection model in the question and answer process is optimized by a reinforcement learning algorithm to obtain the operation and inspection model.

[0043] An embodiment of the present application provides a training method for an operation and inspection model, which constructs an initial operation and inspection model based on a pre-trained language model to ensure that the initial operation and inspection model has a certain text understanding and processing capability, and then uses a method combining unsupervised learning and supervised learning to train and fine-tune the initial operation and inspection model. Among them, unsupervised language modeling training can enable the model to form a priori understanding of power industry terminology and contextual semantic expressions, improve the model's understanding and expression capabilities in the operation and inspection field, and then perform targeted supervised learning fine-tuning on the model for specific operation and inspection tasks and manually annotated training sets to improve the model's reasoning ability for specific tasks, optimize the model output behavior, make it closer to the judgment habits and actual business needs of professionals, and improve the accuracy and efficiency of subsequent anomaly detection.

[0044] In one possible implementation, the inference engine is constructed based on an open source rule-based inference framework and the knowledge graph, including:

[0045] Build a basic reasoning engine based on an open source rule-based reasoning framework;

[0046] According to the knowledge graph and the operation and maintenance rules of the power system, a rule base is constructed based on the structure of "precondition-reasoning conclusion";

[0047] By using a graph parser, each entity in the knowledge graph is bound to each condition item in the rule base, and an entity relationship index between the rule base and the knowledge graph is generated;

[0048] The reasoning engine is constructed by combining the basic reasoning engine, the rule base and the entity relationship index.

[0049] An embodiment of the present application provides a method for constructing an inference engine, integrating an open source rule inference framework with a rule base, realizing customized development of an inference engine for the operation and maintenance field, and enabling the inference engine to adapt to the semantic complexity of power operation and maintenance scenarios. At the same time, the constructed knowledge graph is further introduced, and various entities in the knowledge graph are bound to conditional items in the rule base to form a unified semantic reference system, thereby ensuring the consistency of data semantics during rule execution and improving the accuracy of rule reasoning.

[0050] In a second aspect, an embodiment of the present application provides an anomaly detection system based on knowledge graph and rule reasoning, including an acquisition module, a first reasoning module, a second reasoning module, and a comparison and verification module;

[0051] The acquisition module is used to obtain abnormal information of the power system:

[0052] The first reasoning module is used to input the abnormal information into a preset operation and inspection model, so that the operation and inspection model generates standardized data in a preset format according to the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph according to the standardized data, thereby generating a semantic reasoning result;

[0053] The second reasoning module is used to input the standardized data into a preset reasoning engine, so that the reasoning engine performs rule reasoning on the standardized data according to a preset rule base, thereby generating a rule reasoning result; wherein the semantic reasoning result and the rule reasoning result both include a determination result of an abnormal state, an analysis of the cause of the abnormal state, and a fault root cause location path;

[0054] The comparison and verification module is used to compare and verify the semantic reasoning result with the rule reasoning result, and generate a corresponding anomaly detection result according to the comparison and verification result;

[0055] Among them, the operation and inspection model is obtained by training the language model, the knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, and the inference engine is constructed based on the open source rule inference framework and the knowledge graph.

[0056] In one possible implementation, the operation and inspection model generates standardized data in a preset format based on the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph based on the standardized data, thereby generating semantic reasoning results, including:

[0057] Performing entity recognition, context modeling, and semantic completion on the abnormal information to generate standardized data in an intermediate semantic representation, wherein the standardized data includes device entities, alarm types, and potential failure modes;

[0058] Querying a preset knowledge graph based on the standardized data to determine whether a corresponding knowledge path exists;

[0059] If a corresponding knowledge path exists in the knowledge graph, extract the knowledge path and node information on the knowledge path;

[0060] The standardized data is semantically matched and knowledge enhanced according to the knowledge path and node information to generate the semantic reasoning result. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 A flowchart of an anomaly detection method based on knowledge graph and rule reasoning provided in an embodiment of the present application;

[0062] Figure 2 A flowchart of a modular implementation of an anomaly detection method based on knowledge graph and rule reasoning provided in an embodiment of the present application;

[0063] Figure 3 A schematic diagram of the structure of an anomaly detection system based on knowledge graph and rule reasoning provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0065] It should be noted that the step numbers herein are for convenience of explanation of the specific embodiments and do not serve to define the order in which the steps are to be performed. In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature designated "first" or "second" may explicitly or implicitly include one or more of such features.

[0066] Example 1:

[0067] like Figure 1 As shown, embodiment 1 provides an anomaly detection method based on knowledge graph and rule reasoning, including steps S1 to S4:

[0068] Step S1: Obtain abnormal information of the power system:

[0069] Step S2: input the abnormal information into a preset operation and inspection model, so that the operation and inspection model generates standardized data in a preset format according to the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph according to the standardized data, thereby generating a semantic reasoning result;

[0070] Step S3: Input the standardized data into a preset reasoning engine, so that the reasoning engine performs rule reasoning on the standardized data according to a preset rule base, thereby generating a rule reasoning result; wherein both the semantic reasoning result and the rule reasoning result include a determination result of an abnormal state, an analysis of the cause of the abnormal state, and a fault root cause location path;

[0071] Step S4: Compare and verify the semantic reasoning result with the rule reasoning result, and generate a corresponding anomaly detection result based on the comparison and verification result;

[0072] Among them, the operation and inspection model is obtained by training the language model, the knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, and the inference engine is constructed based on the open source rule inference framework and the knowledge graph.

[0073] The present application embodiment provides an anomaly detection method based on knowledge graphs and rule reasoning. This method uses an operation and maintenance model to perform preliminary processing and understanding of power system anomaly information, generating corresponding standardized data. The knowledge graph then performs semantic reasoning on the anomaly information to generate semantic reasoning results. Furthermore, the present application embodiment introduces a reasoning engine to perform more rigorous and tight rule reasoning on the standardized data to generate rule reasoning results. The reasoning engine focuses on rule-driven, symbolic logic reasoning, making judgments based on explicit rule chains based on expert knowledge. It is suitable for problem-solving scenarios with clear boundary conditions and clear causal relationships. The large model, on the other hand, is more adept at understanding unstructured input, contextual semantic completion, and parsing complex language expressions, primarily for enhancing input understanding and addressing language ambiguity. The present application embodiment enables the two to work together and complement each other, forming a fusion mechanism of structured rule reasoning and semantically enhanced reasoning, enabling automated processing of massive amounts of anomaly information and improving the accuracy and efficiency of anomaly detection. Furthermore, the reasoning process incorporates professional knowledge graphs in the field of power system operation and maintenance, enhancing the ability to analyze the causes and locate the root causes of complex fault chains, addressing the problem of isolated alarm information in traditional methods and further improving the accuracy of anomaly detection.

[0074] In a preferred embodiment, Figure 2 As shown in the figure, a unified knowledge graph is constructed based on the operation and maintenance data and knowledge of flexible DC converter stations. By combining rule-based reasoning with large-scale model-enhanced reasoning, anomaly detection, alarm correlation analysis, fault root cause location, and the generation of treatment suggestions are achieved. Finally, the anomaly detection results are integrated and visualized. Operation and maintenance personnel can use the interface to view the entire anomaly diagnosis process, quickly identify faulty equipment and related information, and improve fault handling efficiency.

[0075] In one possible implementation, in step S2, the operation and inspection model generates standardized data in a preset format based on the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph based on the standardized data, thereby generating a semantic reasoning result, including:

[0076] Performing entity recognition, context modeling, and semantic completion on the abnormal information to generate standardized data in an intermediate semantic representation, wherein the standardized data includes device entities, alarm types, and potential failure modes;

[0077] Querying a preset knowledge graph based on the standardized data to determine whether a corresponding knowledge path exists;

[0078] If a corresponding knowledge path exists in the knowledge graph, extract the knowledge path and node information on the knowledge path;

[0079] The standardized data is semantically matched and knowledge enhanced according to the knowledge path and node information to generate the semantic reasoning result.

[0080] The embodiment of the present application provides a semantic reasoning method based on an operation and inspection model. Since the text structure of the abnormal information generated by the power system is diverse, the knowledge graph or reasoning engine cannot process it directly. Therefore, the present application first utilizes the language model's efficient processing capabilities for text information, performs entity recognition, context modeling, and semantic completion on the acquired abnormal information, generates standardized data that can be recognized by the knowledge graph or reasoning engine, improves data consistency, and prepares data for subsequent semantic reasoning and rule reasoning. Then, based on the knowledge graph, the knowledge path is dynamically queried and node information is extracted to avoid the static knowledge storage defects of traditional relational databases and adapt to the requirements of updating the failure mode of new equipment. Finally, through semantic matching and knowledge enhancement technology, the ability to analyze fuzzy or unstructured abnormal information is enhanced, the reliability of the reasoning results is improved, and the accuracy of subsequent abnormality detection is thereby improved.

[0081] In a preferred embodiment, a "large model-reasoning engine" collaborative operation architecture is designed. First, the system introduces an intermediate semantic representation (ISR) as a bridge, connecting the semantic output of the operation and inspection model with the structured reasoning logic. For abnormal information input by users or reported by the monitoring system, the operation and inspection model first performs entity recognition, context modeling, and semantic completion, and outputs a standardized ISR structure, including the identified device entity, possible alarm type, and potential failure mode. The operation and inspection model then generates corresponding semantic reasoning results based on the standardized data in the ISR structure. During the internal processing of the operation and inspection model, the operation and inspection model first performs language modeling and vectorization on the input, identifies key words and professional terms, and fine-tunes the model's multi-task learning capabilities to complete tasks such as alarm classification, fault identification, and action suggestion generation. Simultaneously, the operation and inspection model can actively call an embedded graph query module to retrieve relevant path and node information from the knowledge graph, perform knowledge enhancement and semantic verification on the generated results, and then generate semantic reasoning results. Throughout this process, the model uses a soft matching mechanism to semantically align fuzzy inputs and combine context to determine the cause of the fault. For example, "frequent tripping of the air cooling system" can be identified by the model as "possibly due to dust accumulation in the condenser, temperature control failure or filter blockage", and then the graph retrieval can be used to verify whether the path exists, thereby enhancing the professionalism and engineering adaptability of the reasoning results.

[0082] In one possible implementation, in step S3, the inference engine performs rule inference on the standardized data according to a preset rule base, thereby generating a rule inference result, including:

[0083] Matching the standardized data with entity nodes in the knowledge graph to obtain a number of matching entity nodes;

[0084] Performing forward chain reasoning and backward chain reasoning on each of the matching entity nodes according to the rule base, thereby determining the logical relationship between each of the matching entity nodes;

[0085] generating a causal chain including each of the matching entity nodes according to the logical relationship between each of the matching entity nodes;

[0086] Generate rule reasoning results based on the causal chain.

[0087] This embodiment of the application provides a rule-based reasoning method based on an inference engine. During the rule-based reasoning process, the entity nodes of the knowledge graph are dynamically bound to achieve dynamic expansion of the rule base and adapt to complex power grid scenarios. Furthermore, forward chaining and backward chaining reasoning are combined to perform multi-dimensional logical relationship verification on each matching entity node, thereby improving the comprehensiveness and accuracy of rule-based reasoning and, in turn, the accuracy of subsequent anomaly detection. Finally, a complete causal chain is generated based on each logical relationship, clarifying the fault path corresponding to the anomaly information, enhancing the interpretability of the rule-based reasoning results, and improving the user experience.

[0088] In a preferred embodiment, standardized data of the corresponding ISR structure is generated based on the equipment data and alarm information from the real-time monitoring system, and then the standardized data is input into the reasoning engine and matched with the entity nodes in the knowledge graph. The data is semantically aligned and entity mapped based on the knowledge graph, and then the forward chaining and backward chaining mechanisms are triggered to make a comprehensive judgment on the triggered alarm and the status of related equipment to generate the corresponding rule reasoning results.

[0089] In one possible implementation, generating a corresponding anomaly detection result based on the comparison and verification result includes:

[0090] If the semantic reasoning result is consistent with the rule reasoning result, the semantic reasoning result and the preset first prompt word are input into the operation and inspection model, so that the operation and inspection model generates corresponding exception handling suggestions according to the semantic reasoning result; the semantic reasoning result, the exception handling suggestions and the knowledge path are encapsulated as the exception detection result;

[0091] If the semantic reasoning result is inconsistent with the rule reasoning result, the semantic reasoning result and the rule reasoning result are encapsulated in a parallel form as the anomaly detection result.

[0092] In the embodiments of the present application, semantic reasoning is compared and verified with rule reasoning results to reduce the limitations of a single model and improve the robustness and accuracy of anomaly detection. When the results of semantic reasoning and rule reasoning are consistent, the text generation capability of the operation and inspection model is further utilized to generate corresponding anomaly handling suggestions based on the determined reasoning results, realizing closed-loop automation from detection to disposal. When the results of semantic reasoning and rule reasoning are inconsistent, the conflicting results are packaged in parallel to facilitate manual review by operation and maintenance personnel, reduce decision delays, improve user experience and the efficiency of handling anomaly situations.

[0093] Furthermore, if the inference engine cannot recognize the standardized data or the inference engine cannot generate the rule inference result, the semantic inference result and the preset second prompt word are input into the operation and inspection model, so that the operation and inspection model generates a confidence score and a semantic matching score corresponding to the semantic inference result;

[0094] If the confidence score and semantic matching score corresponding to the semantic reasoning result are greater than a preset threshold, the semantic reasoning result, the confidence score, the semantic matching score and the knowledge path are encapsulated as the anomaly detection result and the anomaly detection result is marked.

[0095] In the embodiment of the present application, the difference in the ability of the inference engine and the operation and inspection model to understand the input data is taken into account. For abnormal information of fuzzy input, even if the operation and inspection model is used to process it into standardized data, the inference engine may still not be able to recognize it, or the rule reasoning of the standardized data cannot be completed based on the existing rule base, resulting in a temporary failure of the inference engine. On the contrary, the operation and inspection model built based on the language model is better at understanding unstructured input. In most cases, it can recognize the input standardized data and generate corresponding reasoning results. Therefore, the embodiment of the present application provides a special processing mechanism under the condition of temporary failure of the inference engine, extracts the confidence score and semantic matching score corresponding to the semantic reasoning result, and quantifies the reliability of the reasoning result through the score. If the score is greater than the preset threshold, the corresponding semantic reasoning result and each score are encapsulated as an abnormality detection result and marked to ensure the normal output of the abnormality detection result. At the same time, it is convenient for the operation and maintenance personnel to manually review, reduce decision delays, and enhance the power system's adaptive ability to new abnormalities.

[0096] In a preferred embodiment, the system integrates the output of the operation and inspection model with the output of the rule system. When the semantic reasoning result is consistent with the rule reasoning result, the reasoning conclusion can be directly confirmed and a processing suggestion with a traceability path can be output; when there is a difference between the two, the system will display multiple results in parallel for operation and maintenance personnel to compare and judge; if the reasoning engine fails to identify, but the large model provides a high-confidence suggestion, the system can mark the source as "semantic reasoning result" and supplement it with relevant evidence (such as semantic matching score, graph matching path) to enhance its credibility and explainability. Through the above-mentioned collaborative approach, the system effectively combines the logical rigor of rule reasoning with the semantic understanding ability of the large model, which not only significantly improves the accuracy of anomaly detection and fault location, but also enhances the system's response to natural language input, and realizes a highly intelligent operation and maintenance auxiliary decision-making capability in the flexible direct current converter station scenario.

[0097] In one possible implementation, the knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, including:

[0098] Extract several professional knowledge texts of operation and inspection from several heterogeneous data sources;

[0099] Identify entities in each of the operation and inspection professional knowledge texts using named entity recognition technology to obtain a number of entities and corresponding entity attributes;

[0100] According to the dependency syntax analysis and relationship extraction algorithm, the semantic relationship between each of the entities is identified through the preset extraction rules and the neural network relationship classifier to obtain a number of entity relationship recognition results;

[0101] Constructing a plurality of triples in RDF format according to the plurality of entities and the plurality of entity relationship recognition results;

[0102] Based on the entities, entity attributes and triples, the knowledge graph is constructed.

[0103] The embodiment of the present application provides a method for constructing a knowledge graph, which extracts various entities and entity attributes from a number of operation and inspection professional knowledge texts and establishes RDF triples based on the relationships between the entities, and finally integrates the above data to complete the construction of the knowledge graph. Among them, structured storage based on RDF triples is utilized to support the semantic association of multi-source heterogeneous data, effectively avoiding the formation of "islands" of knowledge stored in dispersed manner and improving the utilization rate of operation and inspection professional knowledge; dependency syntax analysis and relationship extraction algorithms are used to improve the efficiency of knowledge mining of unstructured texts. The construction of the knowledge graph provides a stable and flexible knowledge foundation for the subsequent rule reasoning engine and large model semantic mapping, improving the accuracy and efficiency of anomaly detection.

[0104] In a preferred embodiment, a knowledge graph system for flexible DC converter station operation and maintenance scenarios is pre-built as the basic support for subsequent rule reasoning and semantic enhancement of large models. First, through multi-source data collection and standardization processes, the system extracts operation and maintenance knowledge-related information from multiple heterogeneous data sources, including real-time operation data of converter stations (such as sensor data such as equipment voltage, current, temperature, etc.), historical maintenance records, automated alarm information, expert experience summary documents, rules and regulations, and professional knowledge texts obtained from external shared knowledge platforms (such as "Southern Power Grid Zhikan"). The collected raw data is cleaned, desensitized, format converted and uniformly encoded, and converted into structured data units for subsequent knowledge modeling.

[0105] On this basis, the system enters the knowledge extraction and graph modeling phase. The core goal of this phase is to transform massive amounts of unstructured and semi-structured maintenance data into a structured knowledge graph suitable for rule-based reasoning. First, the system uses named entity recognition (NER) technology to identify key entities in the text. Entity types include equipment components (such as converter transformers and DC filters), fault types (such as overheating and tripping), operating instructions (such as switching cooling modes and performing a restart), and alarm information (such as Class P and Class C alarms). To improve recognition accuracy, the system incorporates a vocabulary of power-specific terminology and uses a multi-layer semantic analysis framework combining models such as BERT and BiLSTM-CRF to ensure accurate and comprehensive domain terminology recognition. Subsequently, the system uses dependency parsing and relation extraction algorithms to identify semantic relationships between entities. These relationships typically manifest as typical causal, triggering, suggestion, or inclusion structures, such as "a certain device experienced a certain type of fault," "a certain fault triggered a certain type of alarm," and "a certain alarm recommended a certain maintenance operation." This process combines template-based extraction rules with a neural network relationship classifier to ensure high-confidence entity-relationship pair recognition. To enhance the completeness of entity representation, the system also annotates each entity with relevant attributes, such as the device's electrical parameters, operating status, geographic location, and alarm history, forming context-rich knowledge units. After extracting entities, relationships, and attributes, the system converts this information into RDF triples, constructing a semantic network of nodes and edges within a knowledge graph using a "subject-verb-object" structure. For example, "air cooling system - occurrence - overheating fault," "overheating fault - trigger - Class C alarm," and "Class C alarm - recommendation - fan cleaning" are automatically generated as computable graph triples. To ensure semantic consistency between different data sources and model outputs, the system introduces a unified ontology constraint, standardizing the definition and semantic alignment of entity and relationship types. The resulting knowledge graph is managed using a graph database, offering dynamic updates, visualization, and support for graph traversal queries. All generated knowledge triples are uniformly stored in a graph database (such as Neo4j or JanusGraph), supporting efficient graph traversal, path retrieval, and semantic query operations. This graph database features an incremental update mechanism, version management capabilities, and a visual interactive interface, allowing users to intuitively view device status, fault paths, and troubleshooting recommendations within the system. This provides a stable and flexible knowledge foundation for subsequent rule-based reasoning engines and large-scale model semantic mapping.

[0106] In one possible implementation, the obtaining of the operation and inspection model by training the language model includes:

[0107] Build an initial operation and inspection model based on the pre-trained language model;

[0108] Performing unsupervised language modeling training on the initial operation inspection model according to a preset operation inspection field corpus to obtain a first operation inspection model;

[0109] According to a number of preset operation and inspection tasks and a manually annotated training set, the first operation and inspection model is fine-tuned through supervised learning to obtain a second operation and inspection model;

[0110] The output content of the second operation and inspection model in the question and answer process is optimized by a reinforcement learning algorithm to obtain the operation and inspection model.

[0111] An embodiment of the present application provides a training method for an operation and inspection model, which constructs an initial operation and inspection model based on a pre-trained language model to ensure that the initial operation and inspection model has a certain text understanding and processing capability, and then uses a method combining unsupervised learning and supervised learning to train and fine-tune the initial operation and inspection model. Among them, unsupervised language modeling training can enable the model to form a priori understanding of power industry terminology and contextual semantic expressions, improve the model's understanding and expression capabilities in the operation and inspection field, and then perform targeted supervised learning fine-tuning on the model for specific operation and inspection tasks and manually annotated training sets to improve the model's reasoning ability for specific tasks, optimize the model output behavior, make it closer to the judgment habits and actual business needs of professionals, and improve the accuracy and efficiency of subsequent anomaly detection.

[0112] In a preferred embodiment, a general pre-trained language model (such as BERT, RoBERTa, and T5) is selected as the base model and optimized using a two-stage strategy of "domain corpus adaptation + task fine-tuning." First, the system constructs a large-scale professional corpus covering equipment parameter manuals, operation and maintenance procedures, operating manuals, historical maintenance work orders, and alarm records, and conducts continuous unsupervised language modeling training to enable the model to develop a priori understanding of power industry terminology and contextual semantic expressions. Next, supervised learning fine-tuning is performed using a high-quality, manually annotated training set for specific tasks (such as alarm description classification, fault pattern recognition, and question-answer intent understanding). The cross-entropy loss function is used to optimize the model's performance in multi-task classification and sequence generation tasks. To further improve the accuracy of model output and engineering usability, the system incorporates reinforcement learning techniques, such as the human feedback-based policy optimization (RLHF) mechanism. The system simulates operation and maintenance scenarios and user query interactions, collects user ratings and feedback on the model's responses, and continuously optimizes the model's output behavior using a policy gradient algorithm (such as PPO) to better align it with professional judgment habits and actual business needs.

[0113] In one possible implementation, the inference engine is constructed based on an open source rule-based inference framework and the knowledge graph, including:

[0114] Build a basic reasoning engine based on an open source rule-based reasoning framework;

[0115] According to the knowledge graph and the operation and maintenance rules of the power system, a rule base is constructed based on the structure of "precondition-reasoning conclusion";

[0116] By using a graph parser, each entity in the knowledge graph is bound to each condition item in the rule base, and an entity relationship index between the rule base and the knowledge graph is generated;

[0117] The reasoning engine is constructed by combining the basic reasoning engine, the rule base and the entity relationship index.

[0118] An embodiment of the present application provides a method for constructing an inference engine, integrating an open source rule inference framework with a rule base, realizing customized development of an inference engine for the operation and maintenance field, and enabling the inference engine to adapt to the semantic complexity of power operation and maintenance scenarios. At the same time, the constructed knowledge graph is further introduced, and various entities in the knowledge graph are bound to conditional items in the rule base to form a unified semantic reference system, thereby ensuring the consistency of data semantics during rule execution and improving the accuracy of rule reasoning.

[0119] In a preferred embodiment, the inference engine adopts a modular design approach, with its core components comprising a rule base management module, a semantic mapping module, a logical reasoning execution module, and an interpretable result generation module. The inference engine's underlying architecture is based on an open-source rule-based reasoning framework (such as Drools or an OWL / RDF-based reasoning framework), customized to accommodate the semantic complexity of power operation and maintenance scenarios. A rule base is then constructed based on the constructed knowledge graph, incorporating the experience of power operation and maintenance experts and standardized procedures. Rules are written according to a "precondition-reasoning conclusion" structure, covering causal relationships between alarms, boundary condition judgments for equipment operating indicators, fault pattern recognition logic, and corresponding action suggestion generation logic. All rules are stored in a structured rule base, which supports a visual rule management interface for rule version control, start / stop management, and on-demand updates. Finally, the engine uses a graph parser to bind various entities in the knowledge graph (such as equipment, faults, alarms, and operations) to conditional items in the rule base, forming a unified semantic reference system. The mapping process uses the RDF triple pattern to construct an entity relationship index and improves the mapping accuracy through semantic similarity calculation and structured entity alignment algorithm, thereby ensuring the consistency of data semantics during rule execution.

[0120] In a preferred embodiment, a complete and practical intelligent operation and maintenance application system is constructed to implement the anomaly detection method based on knowledge graph and rule reasoning provided in the embodiment of this application, and the anomaly detection results are displayed through the interface to serve the actual converter station operation and maintenance scenario. The system uniformly dispatches and presents various types of data in a multi-dimensional manner, including real-time monitoring data, related entities in the knowledge graph, reasoning results generated based on rules and large model reasoning (i.e., determination of abnormal status, possible cause analysis, root cause location path of fault and corresponding disposal suggestions), and related knowledge paths, etc. The reasoning result is a structured diagnostic conclusion output by the system based on the integrated equipment status information and knowledge reasoning logic, including the causal chain between alarms, potential fault mode identification, root cause path tracing and corresponding operation guidance suggestions. This type of information is presented in the form of a graph structure and interpretable semantics to ensure that users have a clear understanding and tracking basis for the judgment process and conclusions of abnormal events. The interface supports multi-dimensional content display such as equipment status overview, alarm timeline, reasoning link map, processing suggestion list, etc., and combines GIS map to realize spatial distribution situation awareness. Operation and maintenance personnel can view the entire abnormality diagnosis process through the interface, quickly identify faulty equipment and related information, and improve fault handling efficiency.

[0121] The system also features support for operations and maintenance, as well as personnel training. Through a knowledge-based question-and-answer interface connected to a large model, users can interact with the system using natural language. For example, by entering questions such as "What are common air cooling system anomalies?" or "How do I determine if overheating is caused by a clogged filter?" the system will return real-time answers based on the knowledge graph and reasoning results. Furthermore, the system records user questions and feedback as training data, enabling self-learning iterations for new problems. This mechanism not only improves the learning efficiency of novice operators but also lays the foundation for building a self-evolving intelligent operations system in the future.

[0122] The present embodiment significantly overcomes several key technical issues in existing flexible DC converter station operation and maintenance systems by integrating multiple key technologies, including knowledge graph modeling, rule-based reasoning engines, domain-wide model semantic enhancement, and intelligent operation and maintenance visualization systems. These include:

[0123] 1. Improved anomaly detection accuracy and intelligence. By building a domain-specific operational knowledge graph and organically linking multi-source operational data with expert knowledge, the system possesses the ability to semantically understand and reason about multi-dimensional alarm signals and equipment status. Compared to traditional threshold- and rule-based approaches, the system can accurately identify the root causes of complex anomalies, improving fault detection accuracy and diagnostic coverage.

[0124] 2. Significantly improved alarm analysis efficiency and root cause location capabilities. The system leverages graph-structured reasoning and rule-based link calculation to rapidly merge alarm events, analyze alarm sources, and reconstruct fault chains. This helps operations personnel focus on core issues amidst an alarm storm, shortens the average time from alarm triggering to fault location, and improves overall response efficiency.

[0125] 3. Achieves structured expression and reusability of professional knowledge. By using graphs to structure and model power operation and maintenance knowledge, the system transforms text-based empirical knowledge into machine-recognizable and automated knowledge. This promotes the unified management and efficient reuse of operation and maintenance knowledge, supporting the long-term accumulation, inheritance, and evolution of knowledge.

[0126] 4. Enhanced system understanding of natural language descriptions and semantically ambiguous information. By introducing a large language model, the system can recognize and reason about unstructured alarm descriptions, ambiguous problem expressions, anomaly records, and other semantic information. This system can understand complex fault semantics and conduct question-and-answer interactions, improving the efficiency of human-machine collaboration.

[0127] 5. Improved system interpretability and auditability. All reasoning processes are based on visual graph paths and rule logic. The reasoning results are traceable and replayable, meeting the power industry's requirements for explainability, security, and controllability of key decision-making links. Compared with black-box models, it has greater engineering usability.

[0128] 6. Self-learning and continuous optimization capabilities. Through closed-loop fault handling records and user feedback mechanisms, the system can continuously accumulate new knowledge and optimize model weights and reasoning paths, achieving enhanced adaptability and automatic evolution for future equipment, fault types, and operating scenarios.

[0129] In summary, the technical means provided by the embodiments of the present application effectively solve the prominent problems existing in the traditional flexible DC converter station operation and maintenance system, such as detection lag, inaccurate positioning, knowledge dispersion, weak interaction ability, lack of explainability and poor self-optimization ability, and greatly improve the overall operation and maintenance intelligence level, decision-making efficiency and system maintainability, and have significant practical value and promotion prospects.

[0130] Example 2:

[0131] like Figure 3 As shown, embodiment 2 provides an anomaly detection system based on knowledge graph and rule reasoning, including an acquisition module 10, a first reasoning module 20, a second reasoning module 30 and a comparison and verification module 40;

[0132] The acquisition module 10 is used to obtain abnormal information of the power system:

[0133] The first reasoning module 20 is used to input the abnormal information into a preset operation and inspection model, so that the operation and inspection model generates standardized data in a preset format according to the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph according to the standardized data, thereby generating a semantic reasoning result;

[0134] The second reasoning module 30 is used to input the standardized data into a preset reasoning engine, so that the reasoning engine performs rule reasoning on the standardized data according to a preset rule base, and then generates a rule reasoning result; wherein the semantic reasoning result and the rule reasoning result both include the determination result of the abnormal state, the cause analysis of the abnormal state, and the fault root cause location path;

[0135] The comparison and verification module 40 is used to compare and verify the semantic reasoning result with the rule reasoning result, and generate a corresponding anomaly detection result according to the comparison and verification result;

[0136] Among them, the operation and inspection model is obtained by training the language model, the knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, and the inference engine is constructed based on the open source rule inference framework and the knowledge graph.

[0137] In one possible implementation, the operation and inspection model generates standardized data in a preset format based on the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph based on the standardized data, thereby generating semantic reasoning results, including:

[0138] Performing entity recognition, context modeling, and semantic completion on the abnormal information to generate standardized data in an intermediate semantic representation, wherein the standardized data includes device entities, alarm types, and potential failure modes;

[0139] Querying a preset knowledge graph based on the standardized data to determine whether a corresponding knowledge path exists;

[0140] If a corresponding knowledge path exists in the knowledge graph, extract the knowledge path and node information on the knowledge path;

[0141] The standardized data is semantically matched and knowledge enhanced according to the knowledge path and node information to generate the semantic reasoning result.

[0142] In one possible implementation, the inference engine performs rule inference on the standardized data according to a preset rule base, thereby generating a rule inference result, including:

[0143] Matching the standardized data with entity nodes in the knowledge graph to obtain a number of matching entity nodes;

[0144] Performing forward chain reasoning and backward chain reasoning on each of the matching entity nodes according to the rule base, thereby determining the logical relationship between each of the matching entity nodes;

[0145] generating a causal chain including each of the matching entity nodes according to the logical relationship between each of the matching entity nodes;

[0146] Generate rule reasoning results based on the causal chain.

[0147] In one possible implementation, the comparison and verification module 40 generates a corresponding abnormality detection result according to the comparison and verification result, including:

[0148] If the semantic reasoning result is consistent with the rule reasoning result, the semantic reasoning result and the preset first prompt word are input into the operation and inspection model, so that the operation and inspection model generates corresponding exception handling suggestions according to the semantic reasoning result; the semantic reasoning result, the exception handling suggestions and the knowledge path are encapsulated as the exception detection result;

[0149] If the semantic reasoning result is inconsistent with the rule reasoning result, the semantic reasoning result and the rule reasoning result are encapsulated in a parallel form as the anomaly detection result.

[0150] Furthermore, if the inference engine cannot recognize the standardized data or the inference engine cannot generate the rule inference result, the semantic inference result and the preset second prompt word are input into the operation and inspection model, so that the operation and inspection model generates a confidence score and a semantic matching score corresponding to the semantic inference result;

[0151] If the confidence score and semantic matching score corresponding to the semantic reasoning result are greater than a preset threshold, the semantic reasoning result, the confidence score, the semantic matching score and the knowledge path are encapsulated as the anomaly detection result and the anomaly detection result is marked.

[0152] In one possible implementation, the knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, including:

[0153] Extract several professional knowledge texts of operation and inspection from several heterogeneous data sources;

[0154] Identify entities in each of the operation and inspection professional knowledge texts using named entity recognition technology to obtain a number of entities and corresponding entity attributes;

[0155] According to the dependency syntax analysis and relationship extraction algorithm, the semantic relationship between each of the entities is identified through the preset extraction rules and the neural network relationship classifier to obtain a number of entity relationship recognition results;

[0156] Constructing a plurality of triples in RDF format according to the plurality of entities and the plurality of entity relationship recognition results;

[0157] Based on the entities, entity attributes and triples, the knowledge graph is constructed.

[0158] In one possible implementation, the obtaining of the operation and inspection model by training the language model includes:

[0159] Build an initial operation and inspection model based on the pre-trained language model;

[0160] Performing unsupervised language modeling training on the initial operation inspection model according to a preset operation inspection field corpus to obtain a first operation inspection model;

[0161] According to a number of preset operation and inspection tasks and a manually annotated training set, the first operation and inspection model is fine-tuned through supervised learning to obtain a second operation and inspection model;

[0162] The output content of the second operation and inspection model in the question and answer process is optimized by a reinforcement learning algorithm to obtain the operation and inspection model.

[0163] In one possible implementation, the inference engine is constructed based on an open source rule-based inference framework and the knowledge graph, including:

[0164] Build a basic reasoning engine based on an open source rule-based reasoning framework;

[0165] According to the knowledge graph and the operation and maintenance rules of the power system, a rule base is constructed based on the structure of "precondition-reasoning conclusion";

[0166] By using a graph parser, each entity in the knowledge graph is bound to each condition item in the rule base, and an entity relationship index between the rule base and the knowledge graph is generated;

[0167] The reasoning engine is constructed by combining the basic reasoning engine, the rule base and the entity relationship index.

[0168] The more detailed working principle and process flow of this embodiment can be referred to, but not limited to, the relevant records of the first embodiment.

[0169] The specific embodiments described above further illustrate the objectives, technical solutions, and beneficial effects of this application. It should be understood that the above descriptions are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this application by those skilled in the art should be included within the scope of protection of this application.

Claims

1. An anomaly detection method based on knowledge graph and rule reasoning, characterized in that: include: Obtain abnormal information of the power system: Input the abnormal information into a preset operation and inspection model, so that the operation and inspection model generates standardized data in a preset format according to the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph according to the standardized data, thereby generating a semantic reasoning result; Inputting the standardized data into a preset reasoning engine, so that the reasoning engine performs rule reasoning on the standardized data according to a preset rule base, thereby generating a rule reasoning result; wherein both the semantic reasoning result and the rule reasoning result include a determination result of an abnormal state, an analysis of the cause of the abnormal state, and a fault root cause location path; Comparing and verifying the semantic reasoning result with the rule reasoning result, and generating a corresponding anomaly detection result based on the comparison and verification result; Among them, the operation and inspection model is obtained by training the language model, the knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, and the inference engine is constructed based on the open source rule inference framework and the knowledge graph.

2. The anomaly detection method based on knowledge graph and rule reasoning according to claim 1, characterized in that: The operation and inspection model generates standardized data in a preset format based on the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph based on the standardized data, thereby generating semantic reasoning results, including: Performing entity recognition, context modeling, and semantic completion on the abnormal information to generate standardized data in an intermediate semantic representation, wherein the standardized data includes device entities, alarm types, and potential failure modes; Querying a preset knowledge graph based on the standardized data to determine whether a corresponding knowledge path exists; If a corresponding knowledge path exists in the knowledge graph, extract the knowledge path and node information on the knowledge path; The standardized data is semantically matched and knowledge enhanced according to the knowledge path and node information to generate the semantic reasoning result.

3. The anomaly detection method based on knowledge graph and rule reasoning according to claim 1, characterized in that: The inference engine performs rule inference on the standardized data according to a preset rule base, thereby generating rule inference results, including: Matching the standardized data with entity nodes in the knowledge graph to obtain a number of matching entity nodes; Performing forward chain reasoning and backward chain reasoning on each of the matching entity nodes according to the rule base, thereby determining the logical relationship between each of the matching entity nodes; generating a causal chain including each of the matching entity nodes according to the logical relationship between each of the matching entity nodes; Generate rule reasoning results based on the causal chain.

4. The anomaly detection method based on knowledge graph and rule reasoning according to claim 1, characterized in that: Generating corresponding anomaly detection results according to the comparison and verification results includes: If the semantic reasoning result is consistent with the rule reasoning result, the semantic reasoning result and the preset first prompt word are input into the operation and inspection model, so that the operation and inspection model generates corresponding exception handling suggestions according to the semantic reasoning result; the semantic reasoning result, the exception handling suggestions and the knowledge path are encapsulated as the exception detection result; If the semantic reasoning result is inconsistent with the rule reasoning result, the semantic reasoning result and the rule reasoning result are encapsulated in a parallel form as the anomaly detection result.

5. The anomaly detection method based on knowledge graph and rule reasoning according to claim 4 is characterized in that: If the inference engine cannot recognize the standardized data or the inference engine cannot generate the rule inference result, the semantic inference result and the preset second prompt word are input into the operation and inspection model, so that the operation and inspection model generates a confidence score and a semantic matching score corresponding to the semantic inference result; If the confidence score and semantic matching score corresponding to the semantic reasoning result are greater than a preset threshold, the semantic reasoning result, the confidence score, the semantic matching score and the knowledge path are encapsulated as the anomaly detection result and the anomaly detection result is marked.

6. The anomaly detection method based on knowledge graph and rule reasoning according to claim 1, characterized in that: The knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, including: Extract several professional knowledge texts of operation and inspection from several heterogeneous data sources; Identify entities in each of the operation and inspection professional knowledge texts using named entity recognition technology to obtain a number of entities and corresponding entity attributes; According to the dependency syntax analysis and relationship extraction algorithm, the semantic relationship between each of the entities is identified through the preset extraction rules and the neural network relationship classifier to obtain a number of entity relationship recognition results; Constructing a plurality of triples in RDF format according to the plurality of entities and the plurality of entity relationship recognition results; Based on the entities, entity attributes and triples, the knowledge graph is constructed.

7. The anomaly detection method based on knowledge graph and rule reasoning according to claim 1, characterized in that: The obtaining of the operation and inspection model by training the language model includes: Build an initial operation and inspection model based on the pre-trained language model; Performing unsupervised language modeling training on the initial operation inspection model according to a preset operation inspection field corpus to obtain a first operation inspection model; According to a number of preset operation and inspection tasks and a manually annotated training set, the first operation and inspection model is fine-tuned through supervised learning to obtain a second operation and inspection model; The output content of the second operation and inspection model in the question and answer process is optimized by a reinforcement learning algorithm to obtain the operation and inspection model.

8. The anomaly detection method based on knowledge graph and rule reasoning according to claim 1, characterized in that: The inference engine is obtained based on the open source rule-based inference framework and the knowledge graph, including: Build a basic reasoning engine based on an open source rule-based reasoning framework; According to the knowledge graph and the operation and maintenance rules of the power system, a rule base is constructed based on the "precondition-reasoning conclusion" structure; By using a graph parser, each entity in the knowledge graph is bound to each condition item in the rule base, and an entity relationship index between the rule base and the knowledge graph is generated; The reasoning engine is constructed by combining the basic reasoning engine, the rule base and the entity relationship index.

9. An anomaly detection system based on knowledge graph and rule reasoning, characterized in that: It includes an acquisition module, a first reasoning module, a second reasoning module and a comparison and verification module; The acquisition module is used to obtain abnormal information of the power system: The first reasoning module is used to input the abnormal information into a preset operation and inspection model, so that the operation and inspection model generates standardized data in a preset format according to the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph according to the standardized data, thereby generating a semantic reasoning result; The second reasoning module is used to input the standardized data into a preset reasoning engine, so that the reasoning engine performs rule reasoning on the standardized data according to a preset rule base, thereby generating a rule reasoning result; wherein the semantic reasoning result and the rule reasoning result both include a determination result of an abnormal state, an analysis of the cause of the abnormal state, and a fault root cause location path; The comparison and verification module is used to compare and verify the semantic reasoning result with the rule reasoning result, and generate a corresponding anomaly detection result according to the comparison and verification result; Among them, the operation and inspection model is obtained by training the language model, the knowledge graph is constructed based on a number of operation and inspection professional knowledge texts, and the inference engine is constructed based on the open source rule inference framework and the knowledge graph.

10. The anomaly detection system based on knowledge graph and rule reasoning according to claim 9, characterized in that: The operation and inspection model generates standardized data in a preset format based on the abnormal information, and extracts corresponding knowledge paths and node information from a preset knowledge graph based on the standardized data, thereby generating semantic reasoning results, including: Performing entity recognition, context modeling, and semantic completion on the abnormal information to generate standardized data in an intermediate semantic representation, wherein the standardized data includes device entities, alarm types, and potential failure modes; Querying a preset knowledge graph based on the standardized data to determine whether a corresponding knowledge path exists; If a corresponding knowledge path exists in the knowledge graph, extract the knowledge path and node information on the knowledge path; The standardized data is semantically matched and knowledge enhanced according to the knowledge path and node information to generate the semantic reasoning result.

Images