Log data visualization analysis method and system combining RPA and AI

Abstract

The application provides a log data visualization analysis method and system combining RPA and AI, first, the target information system log data is processed by using the RPA tool according to the preset data correlation rule, the pretreated log data body is generated, then the original text feature fragments are processed by the AI semantic analysis module, the deep semantic feature set is extracted, then the deep semantic feature set and the pretreated log data body information are three-dimensionally modeled according to the space-time correlation, the comprehensive analysis data body is generated, based on the comprehensive analysis data body, the visualization engine generates the visualization analysis interface with the multi-dimension linkage characteristics, finally, the user interactive operation is captured in real time, the modeling parameters and the visualization display mode of the comprehensive analysis data body are dynamically adjusted, so that the efficiency and accuracy of the log data analysis are improved.

Description

Technical Field

[0001] This invention relates to the field of digital business technology, and more specifically, to a method and system for visualizing and analyzing log data that combines RPA and AI. Background Technology

[0002] In today's digital business environment, target information systems generate massive amounts of log data. This log data contains crucial information such as system operating status and operational behaviors, which is of great significance for ensuring stable system operation, optimizing business processes, and preventing security risks. However, existing log data analysis methods have many limitations. On the one hand, traditional log processing methods rely heavily on manual operation, which is not only inefficient but also prone to data omissions or erroneous analysis due to human error. On the other hand, while some automated log analysis tools can complete basic data processing, they lack a deep understanding of the semantic meaning of log data, making it difficult to extract key information such as operational intent and abnormal characteristics. Furthermore, existing technologies for log data visualization often only provide a simple, single-dimensional display, failing to present the complex relationships between multiple dimensions such as the operation subject, time, and semantics. This makes it difficult to meet users' needs for comprehensive and in-depth analysis of log data and hinders the rapid extraction of valuable information from massive amounts of log data. Summary of the Invention

[0003] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a log data visualization and analysis method combining RPA and AI, the method comprising:

[0004] The RPA tool is used to perform automated and process-oriented processing on the log data of the target information system. According to the preset data association rules determined by the operation subject interaction mode and time series fluctuation pattern based on historical log data, the log entry unit is initially structured and mapped to generate a preprocessed log data body containing operation subject association chain, timestamp correspondence and original text feature fragments.

[0005] The AI ​​semantic parsing module, constructed by a multi-layer attention mechanism network, performs contextual semantic penetration processing on the original text feature fragments in the preprocessed log data body, and extracts a set of deep semantic features including operation behavior intent identifiers, abnormal feature keywords and process node association tags. The AI ​​semantic parsing module is used to identify the implicit cross-entry semantic dependencies in the log text.

[0006] The deep semantic feature set is used to perform three-dimensional spatiotemporal correlation modeling with the operation subject association chain and timestamp correspondence in the preprocessed log data body. The dynamic relationship modeling of the operation subject association chain is realized through graph neural network, and the temporal feature extraction of timestamp correspondence is realized by combining temporal convolutional network. A comprehensive analysis data body containing subject behavior trajectory matrix, time window feature tensor and semantic feature heatmap is generated.

[0007] Based on the main behavior trajectory matrix, time window feature tensor, and semantic feature heatmap of the comprehensive analysis data body, a visualization analysis interface with multi-dimensional linkage characteristics is generated through a visualization engine. The multi-dimensional linkage includes the graphical display of the operation subject association chain and the interactive mapping of the semantic feature heatmap within the time window, as well as the highlighting of abnormal feature keywords in the spatiotemporal dimension.

[0008] The system captures user interactions in the visualization analysis interface in real time, and dynamically adjusts the modeling parameters and visualization display methods of the comprehensive analysis data body based on the analysis dimension switching instructions or feature filtering instructions triggered by the user interactions.

[0009] In another aspect, embodiments of the present invention also provide a log data visualization and analysis system combining RPA and AI, including a processor and a machine-readable storage medium connected to the processor. The machine-readable storage medium is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the machine-readable storage medium to implement the above-described method.

[0010] Based on the above, by utilizing RPA tools for automated process handling and performing initial structured mapping of log entry units according to data association rules determined based on historical data, efficient and accurate preprocessing of log data is achieved. With the help of an AI semantic parsing module built from a multi-layer attention mechanism network, the implicit cross-entry semantic dependencies in the log text can be deeply mined, extracting a set of deep semantic features containing key information such as operational intent identifiers. This greatly enhances the semantic understanding capability of the log data. The deep semantic feature set is then used to perform three-dimensional spatiotemporal correlation modeling with other information in the preprocessed log data body. Combining graph neural networks and temporal convolutional networks, the relationships between the operational subject's behavioral trajectory, time window features, and semantic features are comprehensively depicted. The generated comprehensive analysis data body has greater informational and analytical value. Based on this comprehensive analysis data body, a multi-dimensional linked visualization analysis interface is generated, allowing users to intuitively and comprehensively understand the complex information in the log data. Furthermore, by dynamically adjusting modeling parameters and display methods through real-time capture of user interaction operations, the flexibility and personalization of the analysis process are achieved, greatly improving the efficiency and accuracy of log data analysis. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the execution flow of the log data visualization and analysis method combining RPA and AI provided in the embodiments of the present invention.

[0012] Figure 2 This is a schematic diagram of exemplary hardware and software components of the log data visualization and analysis system combining RPA and AI provided in an embodiment of the present invention. Detailed Implementation

[0013] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating a log data visualization and analysis method combining RPA and AI, provided in one embodiment of the present invention. The following is a detailed description of this log data visualization and analysis method combining RPA and AI.

[0014] Step S110: Use RPA tools to perform automated process processing on the log data of the target information system. According to the preset data association rules determined by the operation subject interaction mode and time series fluctuation pattern based on historical log data, perform initial structured mapping on the log entry units to generate a preprocessed log data body containing operation subject association chain, timestamp correspondence and original text feature fragments.

[0015] In the healthcare industry, the target information system could be the medical information management system of a large general hospital, which encompasses log records of the entire process from patient registration, consultation, examination, treatment, to discharge. The RPA tool can automatically access the target information system's log storage location according to a pre-defined workflow.

[0016] Step S111: Configure the automated data collection process of the RPA tool, set the log access path, login verification mechanism and data capture cycle of the target information system, so that the RPA tool can obtain log data and generate a set of raw log entries according to the set process at regular intervals.

[0017] In this step, the log access path for the target information system needs to be precise down to the specific storage folder or database table. For example, the logs of a medical information management system might be stored in a folder under a specific disk partition on the server, and the RPA tool needs to know the specific path of that folder to access it accurately. A login authentication mechanism is crucial to ensure that the RPA tool can legally access the log data, and may include usernames, passwords, digital certificates, etc. In a medical setting, security is paramount; only through strict login authentication can the confidentiality and integrity of log data be guaranteed. The data capture cycle is set according to actual needs; for example, it can be set to automatically capture the previous day's log data every morning to ensure timeliness and accuracy. When the RPA tool executes according to the set process, it can simulate manual login to the target information system and then organize the acquired log data into a raw log entry set according to the set format. This raw log entry set contains various types of log entries, such as doctors' diagnostic records, nurses' nursing operation records, and equipment usage records.

[0018] Step S112: Construct a preset data association rule base. The preset data association rule base includes standardized mapping rules for operation subject identifiers, unified conversion rules for timestamp formats, and rules for locating and extracting key information from log text.

[0019] Operational entity identifiers in medical logs may take various forms, such as doctors' names and employee IDs, and nurses' job numbers. To facilitate subsequent analysis and processing, these non-standardized operational entity identifiers need to be converted into a unified entity code. Standardized mapping rules are used to achieve this conversion, establishing corresponding mapping relationships based on different identifier types. For example, for doctors' names and employee IDs, a mapping table can be created, mapping each doctor's name and employee ID to a unique entity code. Timestamp formats may differ across systems or modules; some may use the format "year / month / day hour:minute:second," while others may use "month-day-year hour:minute." Unified conversion rules convert these different timestamp formats into a standard time format to facilitate subsequent time series analysis. Rules for locating and extracting key information from log text are used to extract useful information from complex log text. Medical logs may contain basic patient information, diagnostic results, treatment plans, etc., requiring specific rules to locate and extract this key information.

[0020] Step S113: Perform rule-based processing on the original log entry set using RPA tools, convert non-standardized operation subject identifiers into unified subject codes, convert timestamps of different formats into standard time formats, and extract key information fragments from the log text as original text feature fragments.

[0021] The RPA tool iterates through and processes the original log entry set one by one according to a pre-defined data association rule base. For non-standardized operation subject identifiers, the RPA tool looks up standardized mapping rules and converts them into a unified subject code. For example, if a log entry records the doctor's name "Zhang San", the RPA tool will convert it into the corresponding subject code according to the mapping table. For timestamps of different formats, the RPA tool will use unified conversion rules to convert them. Assuming a log entry's timestamp is "05-10-2024 14:30", the RPA tool will convert it to the standard time format "2024 / 05 / 10 14:30". When extracting key information fragments from the log text, the RPA tool parses the log text according to the rules for locating and extracting key information in the log text. For example, for a log text containing patient diagnosis information, the RPA tool will extract key information such as the patient's disease name and the diagnosing doctor, and use this information as the original text feature fragments.

[0022] Step S114: Based on the operation subject code and timestamp information, analyze the order and time sequence of the main operations between log entry units, construct the operation subject association chain and timestamp correspondence. The operation subject association chain records the operation sequence of the same subject under consecutive timestamps, and the timestamp correspondence records the intersection of different subject operations in the time dimension.

[0023] After obtaining the processed log entries, further analysis of the sequence and temporal relationships of the main operations is needed. For constructing the operation subject association chain, the operation subject code can be used as a clue to associate operations performed by the same subject under consecutive timestamps. For example, if Doctor A performs operations such as diagnosis, prescription, and treatment plan adjustment on a patient at different times, these operations will be connected in chronological order, forming Doctor A's operation subject association chain. Timestamp correspondence focuses on the intersection points of different subject operations in the time dimension. For example, if Doctor A issues an examination order at a certain time, and Nurse B performs the examination at a later time, the intersection point of these two operations constitutes the timestamp correspondence. By analyzing these intersection points, the collaboration between different subjects and the timeliness of the operations can be understood.

[0024] Step S115: Integrate the processed original text feature fragments, operation subject association chains, and timestamp correspondences, and generate a preprocessed log data body according to the preset data structure.

[0025] Finally, the processed original text feature fragments, the operation subject association chain, and the timestamp correspondence are integrated. The pre-defined data structure specifies how this information is organized, which may include field names, data types, and storage order. For example, the preprocessed log data body may adopt a structured format, containing fields such as operation subject code, timestamp, original text feature fragments, and operation subject association chain. Following this data structure, the relevant information is organized and stored to generate the preprocessed log data body. This preprocessed log data body contains information on the operation subject's behavioral trajectory, time sequence, and text features, among other things.

[0026] Step S120: The AI ​​semantic parsing module, constructed by a multi-layer attention mechanism network, performs contextual semantic penetration processing on the original text feature fragments in the preprocessed log data body, and extracts a set of deep semantic features containing operation behavior intent identifiers, abnormal feature keywords and process node association tags. The AI ​​semantic parsing module is used to identify the implicit cross-entry semantic dependencies in the log text.

[0027] In the medical field, log data generated by medical information systems may originate from multiple sources, such as electronic medical record systems and medical equipment monitoring systems. The raw text fragments within these data encompass doctors' detailed descriptions of patients' conditions, nurses' records of nursing procedures, and feedback on the operational status of medical equipment. This textual information often possesses strong contextual relationships, making it difficult to extract its deeper meaning from a mere surface understanding. Therefore, utilizing AI semantic parsing modules for contextual semantic penetration processing is particularly important.

[0028] Step S121: Input the original text feature fragments in the preprocessed log data body into the embedding layer of the AI ​​semantic parsing module, and generate a text embedding representation containing word position information and semantic vectors through a pre-trained language model. The text embedding representation is used to capture the domain-specific semantics of words in the log text.

[0029] The pre-trained language model is trained on massive amounts of medical-related text data. This data comes from a wide range of sources, including medical research papers, large-scale case databases, and professional medical books. The embedding layer meticulously processes each word in the original text feature fragments. Taking a log entry about a patient's heart disease diagnosis, "The patient recently experienced palpitations and chest tightness, and was initially diagnosed with coronary heart disease," as an example, the embedding layer generates corresponding semantic vectors for each word such as "patient," "palpitations," "chest tightness," and "coronary heart disease." These semantic vectors are not merely simple numerical representations; they contain rich semantic information about the word in the medical field. For example, the semantic vector for "coronary heart disease" includes information on the disease's pathological features, common symptoms, and treatment methods. Simultaneously, the embedding layer accurately records the positional information of these words within the sentence. In medical log text, the position of words plays a crucial role in accurately understanding semantics. For instance, the specific positions of "palpitations" and "chest tightness" in a sentence indicate that they are the patient's current symptoms, which is essential for doctors to make accurate diagnoses. The generated text embedding representation can accurately capture the specific semantics of words in medical log text, enabling subsequent analysis to be based on accurate semantic foundations.

[0030] Step S122: The text embedding representation is processed by the multi-layer attention mechanism network of the AI ​​semantic parsing module. The first layer attention mechanism focuses on the semantic association within the text of a single log entry and extracts the operational intent features at the word level. The second layer attention mechanism performs semantic association analysis across log entries and identifies the co-occurrence patterns and semantic propagation paths of abnormal feature keywords in different entries.

[0031] Step S1221: Input the text embedding representation of a single log entry into the first-layer attention mechanism, calculate the attention weights between words, and the attention weights reflect the semantic importance and interdependence of words in the log entry.

[0032] The first-layer attention mechanism performs an in-depth analysis of the textual embedding representation of individual log entries. Taking the log entry "The doctor performed coronary artery bypass surgery on the patient, and administered anticoagulant medication post-surgery" as an example, this layer calculates the attention weights between words such as "doctor," "patient," "coronary artery bypass surgery," and "anticoagulant medication." The attention weights between "coronary artery bypass surgery" and "anticoagulant medication" are relatively high because in the medical process, anticoagulant medication is usually required after coronary artery bypass surgery, and they have a close semantic dependency. The attention weights between "doctor" and "patient" reflect their subject-object relationship in the medical procedure. By accurately calculating the attention weights, the semantic importance and interdependencies of words in the log entry can be clearly understood.

[0033] Step S1222: Weight the semantic vectors of words by attention weights to generate an enhanced vector representation that includes the semantic context of the words, so as to highlight the semantic features of words related to the operation behavior.

[0034] After obtaining the attention weights between words, these weights can be used to perform a weighted summation of the semantic vectors of the words. For the log entry mentioned above, the semantic vector of the word "coronary artery bypass surgery" will be combined with the semantic vectors of related words such as "doctor," "patient," and "anticoagulant drug treatment," and then weighted and summed according to their attention weights. The resulting enhanced vector representation can fully contain the contextual semantic information of the word, highlighting the semantic features of words related to the operation. For example, the enhanced vector representation of "coronary artery bypass surgery" not only includes information such as the technical details and applicability of the surgery itself, but also reflects its association with the doctor's operation, the patient's condition, and subsequent treatment measures, making the semantic features of the word richer and more accurate.

[0035] Step S1223: Input the enhanced vector representation into the feedforward neural network for feature transformation, extract the key feature dimensions used to characterize the intention of the operation behavior, and generate a word-level feature vector of the intention of the operation behavior.

[0036] The augmented vector representation is fed into a feedforward neural network for feature transformation. The feedforward neural network consists of multiple neuron layers, each with a specific function. During this process, the feedforward neural network performs complex nonlinear transformations on the augmented vector representation. For the log entries mentioned above, the feedforward neural network may extract several key feature dimensions representing the intent of the action, such as "treatment intent," "operation subject," "operation object," and "operation type." "Treatment intent" reflects that the purpose of performing coronary artery bypass surgery and administering anticoagulant therapy is to improve the patient's cardiac condition; "operation subject" clarifies that the relevant operation was performed by a doctor; "operation object" is identified as the patient; and "operation type" specifically indicates coronary artery bypass surgery and anticoagulant therapy. Finally, a word-level action intent feature vector is generated, which accurately reflects the relevant information of the action intent. For example, the action intent feature vector for the word "coronary artery bypass surgery" would include detailed information such as the surgery being a treatment, the operation subject being a doctor, and the operation object being a patient.

[0037] Step S1224: Perform dimensionality compression on the operation behavior intention feature vector. Use principal component analysis or autoencoder to convert the high-dimensional feature vector into a low-dimensional dense vector to retain the core operation behavior intention information.

[0038] Since the feature vector of operational behavior intent can have high dimensionality, it can place a significant burden on subsequent computation and storage. Therefore, dimensionality compression is necessary. Principal component analysis (PCA) projects high-dimensional feature vectors into a low-dimensional space by identifying the principal components in the data. Autoencoders, on the other hand, learn the features of the input data, compress it into a low-dimensional representation, and then attempt to reconstruct the original data. Taking the feature vector of operational behavior intent for "heart bypass surgery" as an example, it might originally contain dozens or even hundreds of feature dimensions. However, after dimensionality compression, it can be transformed into a low-dimensional dense vector containing only a few key dimensions, such as "treatment intent," "operation subject," and "operation type," while retaining the key information of the operational behavior intent, making subsequent processing more efficient.

[0039] Step S1225: Arrange the operation behavior intent feature vectors of all words according to the order of log entries to generate the operation behavior intent feature sequence of a single log entry.

[0040] The action intent feature vectors of all words after dimensionality compression are arranged sequentially according to their order of appearance in the log entries. For the above log entries, the action intent feature vectors of words such as "doctor," "patient," "coronary artery bypass surgery," and "anticoagulant drug treatment" are arranged in the order of the log entries to generate an action intent feature sequence for a single log entry. This action intent feature sequence can completely and orderly reflect the overall situation of action intent in a single log entry.

[0041] Step S1226: The second-layer attention mechanism performs semantic association analysis across log entries to identify the co-occurrence patterns and semantic propagation paths of anomalous feature keywords in different entries.

[0042] The second-layer attention mechanism performs comprehensive semantic association analysis across different log entries. In medical logs, anomalous keywords may be scattered across multiple log entries from different times and patients. For example, in a large hospital's medical information system, there may be log records for multiple patients. For a group of patients with respiratory diseases, anomalous keywords such as "cough," "fever," and "difficulty breathing" may be recorded in the logs of different patients. The second-layer attention mechanism will conduct in-depth analysis of these keywords to identify their co-occurrence patterns. It may be found that "cough" and "fever" frequently appear together in the logs of certain patients, which may indicate that these patients have a specific respiratory infection. At the same time, this layer also analyzes semantic propagation paths to understand the semantic association and propagation of anomalous keywords across different log entries. For example, if "cough" appears first in a patient's log, followed by "fever" and "difficulty breathing" in subsequent logs, this may reflect a gradual worsening of the condition. By analyzing the semantic propagation path, the development trend of the condition can be detected in a timely manner.

[0043] Step S123: Introduce a process node knowledge base containing standard operation process nodes of the target information system and their associated relationships as an external semantic constraint. Use a knowledge graph matching algorithm to map the operation behaviors in the log text to the process node knowledge base and generate process node association tags.

[0044] The process node knowledge base is meticulously constructed based on the standard operating procedures of the target information system, recording in detail each operational process node and the relationships between them. In a medical scenario, this knowledge base covers the entire process from patient admission to discharge, including registration, consultation, examination, treatment, and discharge. The knowledge graph matching algorithm meticulously analyzes the operational behaviors in the log text and precisely maps them to the process node knowledge base. For example, if the log records that a doctor ordered a blood test for a patient, the knowledge graph matching algorithm will perform a detailed match between this operational behavior and the "examination process" node in the process node knowledge base. It will further analyze the specific location and role of this operational behavior within the "examination process," determining whether it belongs to a preliminary examination, a follow-up examination, or a specific disease-specific examination. Then, it generates a corresponding process node association tag, which clearly defines the precise location and role of the operational behavior within the entire standard operating procedure.

[0045] Step S124: Perform feature fusion on the extracted operational behavior intent features, abnormal feature keywords and process node association tags, and generate a unified dimension deep semantic feature vector by using feature splicing and channel attention mechanisms. Aggregate the deep semantic feature vectors of all log entry units into a deep semantic feature set.

[0046] After obtaining the operational intent features, abnormal feature keywords, and process node association labels, effective feature fusion is required. First, a feature concatenation method is used to combine these different types of features. For example, the operational intent feature vector, the vector representation of abnormal feature keywords, and the vector representation of process node association labels are concatenated into a longer vector. Taking a log entry about a patient's surgical treatment as an example, the operational intent feature vector contains information such as the purpose of the surgery and the operator; the vector representation of abnormal feature keywords may contain information such as complications that occurred during the surgery; and the vector representation of process node association labels clarifies the position of the surgery in the entire treatment process. These three vectors are concatenated to form a vector containing richer information. Then, a channel attention mechanism is used to process the concatenated vector. The channel attention mechanism learns and evaluates the importance of different feature channels, assigning corresponding weights to each channel to highlight important features. For example, in some cases, abnormal feature keywords may be more crucial for judging the patient's condition development, and the channel attention mechanism will assign higher weights to the channels containing abnormal feature keywords. Through the above methods, a deep semantic feature vector of a unified dimension is generated. Finally, the deep semantic feature vectors of all log entry units are aggregated to form a deep semantic feature set. This deep semantic feature set contains rich semantic information from the log text.

[0047] Step S130: Perform three-dimensional spatiotemporal correlation modeling on the deep semantic feature set and the operation subject association chain and timestamp correspondence in the preprocessed log data body. Realize the dynamic relationship modeling of the operation subject association chain through graph neural network, and realize the temporal feature extraction of timestamp correspondence by combining temporal convolutional network to generate a comprehensive analysis data body containing the subject behavior trajectory matrix, time window feature tensor and semantic feature heatmap.

[0048] In practical applications in the medical industry, three-dimensional spatiotemporal correlation modeling of deep semantic feature sets with the operation subject association chain and timestamp correspondence can comprehensively and deeply analyze the characteristics and patterns of medical operation behavior in the time and space dimensions.

[0049] Step S131: Construct an operation subject association graph with operation subject encoding as nodes and operation order and interaction number in the operation subject association chain as edge weights. Extract features from the operation subject association graph using a graph neural network to generate behavioral feature vectors for each operation subject and arrange them in order to form a subject behavior trajectory matrix.

[0050] Step S1311: Collect all operation subject codes in the preprocessed log data body, remove duplicates, and use them as the node set of the operation subject association graph. The number of nodes is equal to the number of different operation subjects.

[0051] The preprocessed log data contains coded information from multiple different operators. These operators cover staff from various departments of the hospital, such as doctors, nurses, and medical technicians. These codes are comprehensively collected and carefully deduplicated to ensure that each operator corresponds to only one unique node. For example, the logs of a large, comprehensive hospital's medical information system may record thousands of operation records, involving hundreds of different operator codes. After rigorous deduplication, the exact number of different operators is determined, and these operators form the nodes in the operator association graph, with each node representing a specific operator.

[0052] Step S1312: Traverse the operation subject association chain, count the number of consecutive operations and interaction frequency of each pair of operation subjects in the log entries and use them as the weight of the edge between nodes, and construct an undirected weighted graph or a directed weighted graph according to the directionality of the operation order.

[0053] When traversing the chain of relationships between operational entities, detailed statistics can be collected on the interactions between each pair of entities. In medical scenarios, interactions between operational entities are frequent and complex. For example, doctors and nurses collaborate multiple times during a patient's treatment. Doctors issue medical orders, nurses perform nursing procedures, and provide timely feedback on the patient's condition. Statistical analysis of the number of consecutive operations and interaction frequency between each pair of entities in the log entries accurately reflects the intensity of their interactions. If the operation sequence lacks a clear direction, such as in consultations between doctors where both parties are relatively equal and information exchange is bidirectional, an undirected weighted graph can be constructed, with edge weights reflecting the intensity of their interactions. If the operation sequence has a clear direction, such as a doctor issuing medical orders and a nurse executing them, the operations have a clear sequential order. A directed weighted graph can be constructed, where edge weights reflect not only the interaction frequency but also the sequence of operations.

[0054] Step S1313: Input the operation subject association graph into the input layer of the graph neural network. The initial features of each node are the statistical features of the number of log entries and the distribution of operation types corresponding to the operation subject.

[0055] The operator-related graph is input into the input layer of the graph neural network. The initial features of each node consist of the number of log entries corresponding to that operator and the statistical characteristics of the operation type distribution. Taking a surgeon as an example, the number of log entries reflects their workload. A large number of log entries indicates that they have recently participated in frequent surgeries and treatments. The operation type distribution reflects their area of ​​expertise and work focus. For example, if this surgeon's operations are mainly concentrated in cardiac and hepatobiliary surgeries, it indicates that they have extensive experience and professional skills in these areas. These initial features allow the network to analyze the operator from multiple perspectives.

[0056] Step S1314: Through multi-layer convolutional operations of the graph neural network, the node's own features and the features of its neighboring nodes are aggregated to update the node's feature representation, so that the feature vector of each node contains its own operational features and the interaction features of its neighboring entities.

[0057] The core processing step of a graph neural network is multi-layer convolution. Within each convolutional layer, features of the node itself and those of its neighbors are aggregated. For example, a doctor's node's features not only include its own operational characteristics, such as surgical skills, diagnostic accuracy, and research achievements, but are also influenced by neighboring nodes such as nurses and other doctors. If the doctor frequently collaborates with an experienced nurse, the nurse's professional competence and efficiency may positively impact the doctor's operations; this influence is transmitted to the doctor's feature representation through the features of neighboring nodes. Through multi-layer convolution, the node's feature representation is continuously updated, allowing each node's feature vector to comprehensively reflect its own operational characteristics and the interaction characteristics of its neighbors. This more comprehensive and accurate representation of interaction features better reflects the actual situation of the operating entity within the entire medical collaboration network.

[0058] Step S1315: After multi-level iterative training, extract the final feature vector of each node as the behavior feature vector of the operation subject.

[0059] After multiple iterations of training, the graph neural network converges to a stable state. At this point, the final feature vector of each node is extracted and used as the behavioral feature vector of the operator. This behavioral feature vector comprehensively reflects the operator's behavioral characteristics in the operator's relationship graph. For example, a doctor's behavioral feature vector can reflect their work habits, whether they prefer to perform surgeries independently or in a team; in terms of collaboration ability, their communication efficiency and level of cooperation with nurses and other doctors; and in terms of professional level, their success rate in treating specific diseases and the application of innovative treatment methods.

[0060] Step S1316: Arrange the behavioral feature vectors of all operating subjects in order to form a subject behavior trajectory matrix.

[0061] The behavioral feature vectors of all operators are arranged in the order of their encoding. In a medical setting, each operator has a corresponding behavioral feature vector. These vectors are arranged sequentially to form an operator behavior trajectory matrix. This matrix visually displays the behavioral trajectories and feature distributions of all operators. For example, by observing the changes in the vectors in a particular row of the matrix, the trend of behavioral feature changes of that operator over different time periods can be determined; by comparing the vectors in different rows, behavioral differences between different operators can be analyzed.

[0062] Step S132: Convert the timestamp correspondence into time series data, divide the time series according to the preset time window size, each time window contains log entry features of the corresponding time period, and use a temporal convolutional neural network to perform temporal modeling on the features within the time window to extract dynamic change features in the time dimension and generate a time window feature tensor.

[0063] Step S1321: Convert the timestamp correspondence into time series data.

[0064] Timestamp mapping records the intersections of different entities' operations across time, transforming this information into time-series data. In healthcare, timestamp mapping might include the time a doctor issues a prescription, the time a nurse performs a nursing procedure, and the time of a medical equipment examination. Arranging this time information chronologically forms time-series data. This time-series data clearly reflects the sequence and changes in operations over time. For example, analyzing time-series data can reveal the distribution patterns of a doctor's prescriptions throughout the day, identifying peak and off-peak periods, which is of significant value for the rational allocation of medical resources.

[0065] Step S1322: Divide the time series according to the preset time window size, and each time window contains the log entry characteristics of the corresponding time period.

[0066] The preset time window size can be set according to actual needs. In medical scenarios, the time window can be set to different lengths such as one day, one week, or one month. The time series is divided according to the size of the time window, and each time window contains log entry characteristics for the corresponding time period. For example, a one-day time window can include log entry characteristics for all operations within that day, such as the operation subject, operation type, and operation result. Taking a hospital's emergency department as an example, a one-day time window might include doctors' diagnostic and treatment records for different patients, nurses' nursing records, etc. These log entry characteristics can reflect the work situation of the emergency department and the characteristics of patients' conditions within that time window.

[0067] Step S1323: Perform temporal modeling of features within the time window using a temporal convolutional neural network to extract dynamic change features in the time dimension.

[0068] Temporal convolutional neural networks (CNNs) are specifically designed for processing time-series data. They perform detailed temporal modeling of features within each time window. In medical settings, CNNs can capture the dynamic changes in procedures across different time periods. For example, they can detect whether the number of medical orders issued by doctors increases or decreases over a period of time, or whether nurses' operational efficiency fluctuates. In hospital operating rooms, CNNs can analyze changes in the number, type, and success rate of surgeries across different time periods. If a decrease in the success rate of a certain surgery is observed within a specific time period, further analysis may be needed to determine whether the issue stems from surgical technique, equipment, or personnel coordination. Through this modeling, a deeper understanding of the patterns of change in procedures over time can be achieved.

[0069] Step S1324: Generate the time window feature tensor.

[0070] After processing by a temporal convolutional neural network, a time window feature tensor can be generated. This time window feature tensor contains dynamic changes in the time dimension. In medical scenarios, the time window feature tensor can reflect the comprehensive characteristics of operations within different time windows, such as the frequency, complexity, and success rate of operations. For example, by analyzing the time window feature tensor, the workload differences between different departments in a hospital at different time periods can be identified, thereby enabling the rational allocation of personnel and resources and improving the overall operational efficiency of the hospital.

[0071] Step S133: Map the abnormal feature keywords and process node association labels in the deep semantic feature set to the spatiotemporal dimension, construct a semantic feature matrix with time window as the row, operation subject as the column, and semantic feature weight as the value, and convert the semantic feature matrix into a semantic feature heatmap through a heatmap generation algorithm to present the distribution and changes of abnormal features in the spatiotemporal dimension.

[0072] Step S1331: Map the abnormal feature keywords and process node association labels in the deep semantic feature set to the spatiotemporal dimension.

[0073] The deep semantic feature set contains anomaly characteristic keywords and process node association tags. Mapping this information to the spatiotemporal dimension aims to closely associate them with time and the operating entity. In medical scenarios, anomaly characteristic keywords such as "infection," "allergy," and "bleeding," and process node association tags such as "surgical procedure," "examination procedure," and "rehabilitation procedure," can be correlated with specific times and operating entities. For example, if a doctor treats a patient with an "infection" anomaly at a certain point in time, the keyword "infection" can be associated with that time point and that doctor. Through this mapping, the distribution of anomaly characteristics and operating procedures at different times and under different operating entities can be clearly understood.

[0074] Step S1332: Construct a semantic feature matrix with time windows as rows, operation subjects as columns, and semantic feature weights as values.

[0075] A semantic feature matrix is ​​constructed, with time windows as rows, operational subjects as columns, and semantic feature weights as values. In a medical scenario, each time window corresponds to a row in the matrix, and each operational subject corresponds to a column. The semantic feature weights reflect the importance of abnormal feature keywords and process node association labels under different time windows and operational subjects. For example, if a doctor treats patients with a high frequency of "infection" anomalies within a certain time window, then the semantic feature weight of the keyword "infection" will be higher in the matrix cell corresponding to that time window and that doctor. By constructing a semantic feature matrix, complex spatiotemporal information can be organized and represented in matrix form, facilitating subsequent analysis and processing.

[0076] Step S1333: Convert the semantic feature matrix into a semantic feature heatmap using a heatmap generation algorithm to present the distribution and changes of abnormal features in the spatiotemporal dimensions.

[0077] Heatmap generation algorithms convert semantic feature matrices into semantic feature heatmaps. In medical settings, heatmaps can visually represent the distribution and changes of abnormal features across time and space. For example, a heatmap clearly shows which time windows and which user groups exhibit the highest frequency of abnormal feature keywords such as "infection" and "allergy," as well as the temporal trends of these abnormal features. If a region in the heatmap is darker, it indicates a higher frequency of abnormal features within that time window and user group, requiring close monitoring. This helps healthcare professionals promptly identify potential problems and take appropriate measures, such as strengthening infection control and adjusting treatment plans.

[0078] Step S134: Call the pre-built 3D spatiotemporal correlation fusion module, take the subject behavior trajectory matrix, time window feature tensor and semantic feature heatmap as input, realize cross-dimensional feature interaction through tensor fusion operation and attention mechanism, and generate a comprehensive analysis data body containing spatiotemporal semantic correlation information.

[0079] In this embodiment, the 3D spatiotemporal correlation fusion module is pre-built, and its function is to organically fuse the subject's behavior trajectory matrix, time window feature tensor, and semantic feature heatmap. In the medical scenario, the subject's behavior trajectory matrix reflects the behavioral characteristics of the operating subject, the time window feature tensor reflects the dynamic changes in the time dimension, and the semantic feature heatmap shows the distribution of abnormal features in the spatiotemporal dimension. Through tensor fusion operation and attention mechanism, cross-dimensional feature interaction is achieved. Tensor fusion operation deeply integrates data from different dimensions, fusing information such as subject behavior, time changes, and abnormal feature distribution together. Attention mechanism focuses on the importance of different features, highlighting key information. For example, within a certain time window, there may be a correlation between the behavioral characteristics of a certain operating subject and the distribution of abnormal features. This potential relationship can be discovered through cross-dimensional feature interaction. If it is found that a doctor's operating behavior within a certain time period is closely related to the frequency of abnormal patient infections, further analysis can be conducted to determine whether it is due to the doctor's operating procedures or the patient's special condition. Finally, a comprehensive analysis data body containing spatiotemporal semantic correlation information is generated, which integrates information from multiple aspects such as the operating subject, time, and semantics.

[0080] Step S135: Normalize and format the comprehensive analysis data to adapt it to the input requirements of the visualization engine.

[0081] To ensure optimal visualization of the comprehensive analysis data, normalization and format conversion are necessary. Normalization unifies the value ranges of different features into a reasonable interval, preventing excessively large or small values ​​from negatively impacting the visualization. For example, some feature values ​​in the subject's behavioral trajectory matrix might be large, while others in the time window feature tensor might be small; normalization allows for comparison and display on the same scale. Format conversion transforms the comprehensive analysis data into a format recognizable by the visualization engine. In medical settings, normalized and format-converted comprehensive analysis data can more accurately and clearly display the subject's behavioral trajectory, changes over time, and the distribution of abnormal features within the visualization interface. This facilitates intuitive observation and analysis by medical staff, leading to more informed medical decisions.

[0082] Step S140: Based on the main behavior trajectory matrix, time window feature tensor, and semantic feature heatmap of the comprehensive analysis data body, a visualization analysis interface with multi-dimensional linkage characteristics is generated through the visualization engine. The multi-dimensional linkage includes the graphical display of the operation subject association chain and the interactive mapping of the semantic feature heatmap within the time window, as well as the highlighting of abnormal feature keywords in the spatiotemporal dimension.

[0083] In a medical setting, the comprehensive analysis data contains a wealth of information related to medical procedures. The subject's behavioral trajectory matrix reflects the behavioral patterns of the operator, the time window feature tensor reflects dynamic changes over time, and the semantic feature heatmap shows the distribution of abnormal features in the spatiotemporal dimensions. The visualization engine's role is to present this complex data in an intuitive way, facilitating analysis and decision-making for medical staff and administrators.

[0084] Step S141: Construct a visualization component for the main behavior trajectory, convert the main behavior trajectory matrix into a node link graph, where each node represents an operation subject. The node size is normalized based on the number of log entries corresponding to the operation subject and mapped to reflect the operation frequency. The thickness and color of the edges are mapped according to the number of interactions and interaction types between the operation subjects to reflect the interaction intensity.

[0085] Step S1411: Determine the visual mapping parameters of the node. The node position is calculated using the force-directed layout algorithm, and the node size is mapped after normalization based on the number of log entries corresponding to the operation subject.

[0086] Force-directed placement is a physics-based layout method that treats nodes as objects with certain physical properties, determining their positions by simulating the attractive and repulsive forces between nodes. In medical scenarios, complex relationships exist between different operators. Force-directed placement can make the node layout more reasonable, facilitating the observation of relationships between operators. For example, nodes of operators who frequently collaborate will be placed closer together. The node size is determined based on the number of log entries corresponding to the operator. First, the number of log entries is normalized to map it to an appropriate range, allowing the node size to accurately reflect the operator's operation frequency. For example, a doctor with a large number of log entries will have larger nodes after normalization, intuitively showing the doctor's workload.

[0087] Step S1412: Define the visual attributes of the edges. The thickness of the edges is mapped according to the number of interactions between the operating subjects, and the color of the edges is distinguished according to the interaction type through a preset color coding scheme.

[0088] The thickness of the edges reflects the frequency of interaction between the operating entities; the more interactions, the thicker the edges. In medical scenarios, the frequent collaboration between doctors and nurses results in thicker edges between them, reflecting their close working relationship. A preset color coding scheme is used to distinguish different interaction types. For example, the interaction type of doctors issuing medical orders and nurses executing those orders can be represented by one color, while consultations between doctors can be represented by another. In this way, users can quickly identify the interaction type between the operating entities by the edge colors.

[0089] Step S1413: Add interaction events to nodes and edges. Clicking a node triggers a pop-up window with detailed information about that subject. Clicking an edge displays a list of specific interaction log entries between the two subjects.

[0090] Adding interactive events can enhance the interactivity and information display capabilities of the visualization interface. When a user clicks a node, a pop-up window displaying detailed information about the entity performing the operation can appear, which may include basic information, professional field, work experience, etc. Clicking an edge can display a list of specific interaction log entries between the two entities, allowing users to view detailed information such as the time and content of the interaction. This helps users gain a deeper understanding of the collaboration between the entities and the specific operational details.

[0091] Step S1414: Optimize the performance of the node link graph by using a graphics rendering engine to improve the drawing efficiency of large-scale nodes, and add node filtering and search functions.

[0092] When processing large-scale operational data, the efficiency of drawing node connection graphs can be affected. Employing a graphics rendering engine can accelerate the drawing process of nodes and edges, improving interface responsiveness. Integrating node filtering and search functions allows users to quickly locate and view operational entities of interest. For example, users can use the filtering function to display only operational entities from a specific department, or use the search function to enter the name of the operational entity to find specific nodes.

[0093] Step S1415: Add animation effects to achieve smooth transitions when nodes and edges are generated, moved, or deleted.

[0094] Animation effects can enhance the user experience, making the generation, movement, and deletion of nodes and edges more natural and smooth. When a new user entity is added or the relationships between user entities change, nodes and edges will present these changes in the form of animation, avoiding the visual shock caused by sudden interface updates.

[0095] Step S142: Call the preset time window feature visualization module, use the time window feature tensor as the time axis as the reference, and use data visualization graphics to display the feature change trend within different time windows, and support the scaling and sliding operation of the time window.

[0096] The time window feature visualization module is a pre-built display module that shows data based on a time axis. Using data visualization graphics (such as line charts and bar charts), it can intuitively present the trend of feature changes within different time windows. In a medical setting, users can observe the trend of a line chart to understand how a specific operational indicator (such as surgical success rate or patient infection rate) changes over time. It supports zooming and sliding of the time window, allowing users to view detailed information for different time periods as needed. For example, users can zoom in on a specific time period to view more refined feature changes within that period.

[0097] Step S143: Construct a semantic feature heatmap display area, display the semantic feature heatmap in the form of a two-dimensional matrix, with rows corresponding to time windows, columns corresponding to operation subjects, and cell color depth indicating the weight of semantic features. It also supports interactive viewing of specific abnormal feature keywords and process node association tags.

[0098] The semantic feature heatmap is displayed in the form of a two-dimensional matrix, with the weight of semantic features represented by the depth of cell color. In a medical context, darker cells indicate a greater weight for abnormal features or key process nodes within that time window and operation. Users can interactively view specific abnormal feature keywords and process node association tags. For example, when the mouse hovers over a cell, a detailed information box pops up, displaying the corresponding abnormal feature keywords (such as "fever" or "cough") and process node association tags (such as "diagnosis process" or "treatment process").

[0099] Step S144: Through a multi-dimensional linkage mechanism, interactive responses between different visualization components are achieved. When a user selects any operation subject in the main behavior trajectory map, the time window feature visualization module and the semantic feature heatmap automatically focus on the relevant features of the operation subject. When a specific time period is selected in the time window, the main behavior trajectory map and the semantic feature heatmap synchronously display the main interaction and semantic feature distribution within that time period.

[0100] A multi-dimensional linkage mechanism enhances the correlation and interactivity between different visualization components. When a user selects an operation subject in the main behavior trajectory graph, the time window feature visualization module automatically focuses on the feature changes of that operation subject within different time windows, and the semantic feature heatmap also highlights the abnormal features and process node distribution related to that operation subject. For example, when a user selects a doctor node, the time window feature visualization module displays the doctor's operation frequency changes within each time window, and the semantic feature heatmap displays the distribution of abnormal features that occur when the doctor treats patients. When a user selects a specific time period within a time window, the main behavior trajectory graph displays the interactions between operation subjects within that time period, and the semantic feature heatmap simultaneously displays the distribution of abnormal features and process nodes within that time period. This linkage mechanism allows users to comprehensively understand the spatiotemporal information of medical operations from multiple perspectives.

[0101] Step S145: Optimize the layout of the visualization components, adopt responsive design, and set legends and interactive guides.

[0102] Responsive design enables visual interfaces to adapt to different devices and screen sizes, ensuring a good user experience in various environments. Legends help users understand the meaning of various elements in the visual interface, such as node size, edge thickness and color, and the information represented by different shades of heatmap colors. Interaction guides provide users with operational instructions, showing them how to zoom, scroll, select, etc., reducing the learning curve and improving the usability of the interface.

[0103] Step S150: Capture user interaction operations in the visualization analysis interface in real time, and dynamically adjust the modeling parameters and visualization display method of the comprehensive analysis data body according to the analysis dimension switching command or feature filtering command triggered by the interaction operation.

[0104] In the visualization analysis interface, user interaction is a crucial way to obtain deeper information. Real-time capture and processing of these interactions can meet diverse user analysis needs. The modeling parameters refer to the core control parameters in 3D spatiotemporal correlation modeling that can be dynamically adjusted according to user analysis dimension switching or feature filtering commands (such as time window size, subject association threshold, abnormal feature matching threshold, etc.), supporting the generation of new comprehensive analysis data volumes. The visualization display method refers to the form in which the visualization engine presents information based on the comprehensive analysis data volume, which can be adjusted according to interactive commands (such as the node display range of the subject behavior trajectory map, the time granularity of the time window feature map, and the focused subject of the semantic heatmap), while maintaining the interactive logic between multiple components.

[0105] Step S151: Integrate the interactive event listening module into the visualization analysis interface to capture user operations in real time and parse the interaction type and target object.

[0106] The interactive event listening module continuously monitors user actions within the visualization analytics interface, including mouse clicks, keyboard input, and screen touches. In a medical scenario, users might click nodes, select time windows, or search using keywords. This module parses the type of these actions (such as clicks, selections, and input) and the target objects (such as nodes, timelines, and heatmap cells).

[0107] Step S152: Establish an interactive instruction parsing rule base to map different interactive operations into specific analysis dimension switching instructions or feature filtering instructions.

[0108] For example, step S1521: Define the type of interactive operation as mouse operation, keyboard operation and touch operation suitable for mobile devices.

[0109] The types of interactive operations are clearly defined, covering common input methods. Mouse operations include clicking, double-clicking, and dragging; keyboard operations include entering characters and pressing shortcut keys; and touch operations suitable for mobile devices include clicking, swiping, and zooming. In medical scenarios, different types of operations can meet the user's needs on different devices.

[0110] Step S1522: Set the corresponding target object for each interactive operation as time axis region, main node, and semantic feature label.

[0111] Set a corresponding target object for each interaction to accurately identify the user's intention. In a medical scenario, when a user operates in the timeline area, they may want to switch the time dimension for analysis; when clicking on a main node, they may want to view detailed information about that main entity; when selecting a semantic feature tag, they may want to filter out log entries containing that feature.

[0112] Step S1523: Construct an instruction mapping table to clarify the specific instructions triggered by each interactive operation on different target objects.

[0113] A command mapping table is constructed to clearly define the specific commands triggered by each interactive operation on different target objects. For example, clicking a time point in the timeline area may trigger an analysis dimension switching command, focusing the analysis on the time period corresponding to that time point; clicking a main node may trigger a feature filtering command, displaying only the relevant log entries for that main operation.

[0114] Step S1524: Configure user-defined interaction rules so that users can modify or add interaction command mapping relationships through the configuration interface.

[0115] To meet users' personalized needs, a user-defined interaction rule function is provided. Users can modify or add interaction command mappings through the configuration interface. In medical scenarios, users may have unique analytical needs, such as wanting a specific keyboard shortcut to trigger a specific analysis dimension switching command. The user-defined interaction rule function allows users to achieve these personalized settings.

[0116] Step S1525: Perform a validity check on the interactive command to ensure that the triggered interactive command conforms to the current analysis status and data permissions.

[0117] Validating the legitimacy of user commands is a crucial step in ensuring system security and data compliance. In healthcare settings, certain operations may require specific permissions, such as viewing sensitive patient logs. Validation prevents unauthorized user actions, ensuring data security and compliance. Furthermore, it verifies whether user commands are consistent with the current analysis state, preventing unreasonable operations from causing system errors or data corruption.

[0118] Step S153: Determine the modeling parameters and visualization components that need to be adjusted based on the received analysis dimension switching instruction or feature filtering instruction.

[0119] Based on the received analysis dimension switching or feature filtering instructions, determine the modeling parameters and visualization components that need adjustment. In a medical scenario, if an analysis dimension switching instruction is received, such as switching from daily to weekly analysis, it may be necessary to adjust the size of the time window and the modeling parameters of the temporal convolutional neural network, and correspondingly adjust the display method of the time window feature visualization module. If a feature filtering instruction is received, such as filtering log entries containing the abnormal feature of "infection," it may be necessary to adjust the display range of the semantic feature heatmap and the display of nodes and edges in the subject behavior trajectory map.

[0120] Step S154: Call the dynamic update algorithm to reprocess the preprocessed log data body and the deep semantic feature set according to the adjusted modeling parameters to generate a new comprehensive analysis data body.

[0121] The dynamic update algorithm reprocesses the preprocessed log data volume and deep semantic feature set based on the adjusted modeling parameters. In medical scenarios, when modeling parameters change, such as a change in the time window size, it is necessary to re-divide the timestamp correspondences and recalculate the time window feature tensor. Simultaneously, the deep semantic feature set is filtered and processed according to feature filtering instructions. For example, after filtering out log entries containing specific anomalous features, a semantic feature heatmap and a subject behavior trajectory matrix are regenerated. Finally, a new comprehensive analysis data volume is generated, reflecting the information under the adjusted analysis dimensions and feature filtering conditions.

[0122] Step S155: Input the new comprehensive analysis data volume into the visualization engine to trigger the update rendering of the corresponding visualization components.

[0123] The new comprehensive analytical data is input into the visualization engine, which then updates the rendering of the corresponding visualization components based on the new data. In the medical context, visualization components such as the subject behavior trajectory map, time window feature visualization graphics, and semantic feature heatmap will be redrawn and displayed according to the new data. The updated visualization interface will display the adjusted analysis results, allowing users to intuitively see the changes in subject behavior, time dimension, and distribution of abnormal features under different analytical dimensions and feature filtering conditions, thereby making more accurate decisions.

[0124] Figure 2 The illustration shows exemplary hardware and software components of a log data visualization and analysis system 100 combining RPA and AI, which can implement the ideas of this application, according to some embodiments of this application. For example, processor 120 can be used in the log data visualization and analysis system 100 combining RPA and AI and to perform the functions in this application.

[0125] The log data visualization and analysis system 100 combining RPA and AI can be a general-purpose server or a special-purpose server; both can be used to implement the log data visualization and analysis method combining RPA and AI of this application. Although only one server is shown in this application, for convenience, the functions described in this application can be implemented in a distributed manner on multiple similar platforms to balance the load.

[0126] For example, a log data visualization and analysis system 100 combining RPA and AI may include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and various forms of storage media 140, such as a disk, ROM, or RAM, or any combination thereof. Exemplarily, the log data visualization and analysis system 100 combining RPA and AI may also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The methods of this application can be implemented according to these program instructions. The log data visualization and analysis system 100 combining RPA and AI also includes an I / O interface 150 between the computer and other input / output devices.

[0127] For ease of explanation, only one processor is described in the log data visualization and analysis system 100 combining RPA and AI. However, it should be noted that the log data visualization and analysis system 100 combining RPA and AI in this application may also include multiple processors. Therefore, the steps performed by one processor as described in this application may also be performed jointly or individually by multiple processors. For example, if the processor of the log data visualization and analysis system 100 combining RPA and AI performs steps A and B, it should be understood that steps A and B may also be performed jointly by two different processors or individually by one processor. For example, the first processor performs step A, the second processor performs step B, or the first processor and the second processor jointly perform steps A and B.

[0128] Furthermore, this embodiment of the invention also provides a readable storage medium, which has computer-executable instructions pre-set in it. When the processor executes the computer-executable instructions, the above-mentioned log data visualization and analysis method combining RPA and AI is realized.

[0129] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A log data visualization and analysis method combining RPA and AI, characterized in that, The method includes: The RPA tool is used to perform automated and process-oriented processing on the log data of the target information system. According to the preset data association rules determined by the operation subject interaction mode and time series fluctuation pattern based on historical log data, the log entry unit is initially structured and mapped to generate a preprocessed log data body containing operation subject association chain, timestamp correspondence and original text feature fragments. The AI ​​semantic parsing module, constructed by a multi-layer attention mechanism network, performs contextual semantic penetration processing on the original text feature fragments in the preprocessed log data body, and extracts a set of deep semantic features including operation behavior intent identifiers, abnormal feature keywords and process node association tags. The AI ​​semantic parsing module is used to identify the implicit cross-entry semantic dependencies in the log text. The deep semantic feature set is used to perform three-dimensional spatiotemporal correlation modeling with the operation subject association chain and timestamp correspondence in the preprocessed log data body. The dynamic relationship modeling of the operation subject association chain is realized through graph neural network, and the temporal feature extraction of timestamp correspondence is realized by combining temporal convolutional network. A comprehensive analysis data body containing subject behavior trajectory matrix, time window feature tensor and semantic feature heatmap is generated. Based on the main behavior trajectory matrix, time window feature tensor, and semantic feature heatmap of the comprehensive analysis data body, a visualization analysis interface with multi-dimensional linkage characteristics is generated through a visualization engine. The multi-dimensional linkage includes the graphical display of the operation subject association chain and the interactive mapping of the semantic feature heatmap within the time window, as well as the highlighting of abnormal feature keywords in the spatiotemporal dimension. The system captures user interactions in the visualization analysis interface in real time, and dynamically adjusts the modeling parameters and visualization display methods of the comprehensive analysis data body based on the analysis dimension switching instructions or feature filtering instructions triggered by the user interactions.

2. The log data visualization and analysis method combining RPA and AI according to claim 1, characterized in that, The process of using RPA tools to automate the workflow of log data in the target information system involves performing initial structured mapping on log entry units according to preset data association rules determined based on historical log data's user interaction patterns and time-series fluctuation patterns. This generates a preprocessed log data body containing user association chains, timestamp correspondences, and original text feature fragments, including: Configure the automated data collection process of the RPA tool, set the log access path, login verification mechanism and data capture cycle of the target information system, so that the RPA tool can obtain log data and generate a set of raw log entries according to the set process on a regular basis. Construct a preset data association rule base, which includes standardized mapping rules for operation subject identifiers, unified conversion rules for timestamp formats, and rules for locating and extracting key information from log text. The RPA tool performs rule-based processing on the original log entry set, converting non-standardized operation subject identifiers into unified subject codes, converting timestamps of different formats into standard time formats, and extracting key information fragments from the log text as original text feature fragments. Based on the operation subject code and timestamp information, the order and time sequence of the main operations between log entry units are analyzed, and the operation subject association chain and timestamp correspondence are constructed. The operation subject association chain records the operation sequence of the same subject under consecutive timestamps, and the timestamp correspondence records the intersection of different subject operations in the time dimension. The processed original text feature fragments, operation subject association chains, and timestamp correspondences are integrated to generate a preprocessed log data body according to the preset data structure.

3. The log data visualization and analysis method combining RPA and AI according to claim 1, characterized in that, The AI ​​semantic parsing module, constructed using a multi-layer attention mechanism network, performs contextual semantic penetration processing on the original text feature fragments in the preprocessed log data body, extracting a deep semantic feature set containing operation behavior intent identifiers, abnormal feature keywords, and process node association tags, including: The original text feature fragments in the preprocessed log data are input into the embedding layer of the AI ​​semantic parsing module. A pre-trained language model generates a text embedding representation containing word position information and semantic vectors. The text embedding representation is used to capture the domain-specific semantics of words in the log text. The text embedding representation is processed through a multi-layer attention mechanism network of the AI ​​semantic parsing module. The first layer of attention mechanism focuses on the semantic association within the text of a single log entry and extracts word-level operational intent features. The second layer of attention mechanism performs semantic association analysis across log entries and identifies the co-occurrence patterns and semantic propagation paths of abnormal feature keywords in different entries. A process node knowledge base containing standard operation process nodes of the target information system and their associated relationships is introduced as an external semantic constraint. The operation behavior in the log text is mapped to the process node knowledge base through a knowledge graph matching algorithm to generate process node association tags. The extracted operational intent features, abnormal feature keywords, and process node association tags are fused. Feature concatenation and channel attention mechanisms are used to generate a unified-dimensional deep semantic feature vector. The deep semantic feature vectors of all log entry units are aggregated into a deep semantic feature set.

4. The log data visualization and analysis method combining RPA and AI according to claim 3, characterized in that, The text embedding representation is processed through a multi-layer attention mechanism network of the AI ​​semantic parsing module. The first layer of the attention mechanism focuses on the semantic associations within the text of a single log entry, extracting word-level operational intent features, including: The text embedding representation of a single log entry is input into the first-layer attention mechanism, and the attention weights between words are calculated. The attention weights reflect the semantic importance and interdependence of words in the log entry. By weighting and summing the semantic vectors of words using attention weights, an enhanced vector representation containing the semantic context of the words is generated to highlight the semantic features of words related to the operation behavior. The enhanced vector representation is input into the feedforward neural network for feature transformation, and key feature dimensions used to characterize the intention of the operation are extracted to generate a word-level feature vector of the intention of the operation. The feature vector of operational intent is compressed by principal component analysis or autoencoder to convert the high-dimensional feature vector into a low-dimensional dense vector in order to retain the core operational intent information. Arrange the action intent feature vectors of all words according to the order of log entries to generate the action intent feature sequence of a single log entry.

5. The log data visualization and analysis method combining RPA and AI according to claim 1, characterized in that, The process involves performing a three-dimensional spatiotemporal correlation modeling of the deep semantic feature set with the operational subject association chain and timestamp correspondence in the preprocessed log data body. This is achieved through graph neural networks to dynamically model the operational subject association chain, and by combining a temporal convolutional network to extract temporal features from the timestamp correspondence. The result is a comprehensive analysis data body containing a subject behavior trajectory matrix, a time window feature tensor, and a semantic feature heatmap. Construct an operation subject association graph with operation subject encoding as nodes and operation order and interaction number in the operation subject association chain as edge weights. Extract features from the operation subject association graph using a graph convolutional neural network to generate behavioral feature vectors for each operation subject and arrange them in order to form a subject behavior trajectory matrix. The timestamp correspondence is converted into time series data, and the time series is divided according to the preset time window size. Each time window contains log entry features of the corresponding time period. The features within the time window are modeled temporally using a temporal convolutional neural network to extract dynamic change features in the time dimension and generate a time window feature tensor. The abnormal feature keywords and process node association labels in the deep semantic feature set are mapped to the spatiotemporal dimension. A semantic feature matrix is ​​constructed with time window as the row, operation subject as the column, and semantic feature weight as the value. The semantic feature matrix is ​​converted into a semantic feature heatmap through a heatmap generation algorithm to present the distribution and changes of abnormal features in the spatiotemporal dimension. The pre-built 3D spatiotemporal correlation fusion module is invoked, and the subject behavior trajectory matrix, time window feature tensor, and semantic feature heatmap are taken as input. Cross-dimensional feature interaction is achieved through tensor fusion operation and attention mechanism to generate a comprehensive analysis data body containing spatiotemporal semantic correlation information. The comprehensive analysis data volume is normalized and format converted to adapt to the input requirements of the visualization engine.

6. The log data visualization and analysis method combining RPA and AI according to claim 5, characterized in that, The construction of an operation subject association graph, with operation subject encoding as nodes and operation order and interaction count in the operation subject association chain as edge weights, involves using a graph convolutional neural network to extract features from the operation subject association graph, generating a behavioral feature vector for each operation subject, including: Collect all operation subject codes in the preprocessed log data body, remove duplicates, and use them as the node set of the operation subject association graph. The number of nodes is equal to the number of different operation subjects. Traverse the chain of operations, count the number of consecutive operations and interaction frequency between each pair of operations in the log entries and use them as the weight of the edge between nodes. Construct an undirected weighted graph or a directed weighted graph according to the directionality of the operation order. The operation subject association graph is input into the input layer of the graph convolutional neural network. The initial features of each node are the statistical features of the number of log entries and the distribution of operation types corresponding to that operation subject. By using multi-layer convolutional operations in graph convolutional neural networks, the features of a node itself and the features of its neighboring nodes are aggregated to update the feature representation of the node, so that the feature vector of each node contains its own operational features and the interaction features of its neighboring entities. After multiple iterations of training, the final feature vector of each node is extracted as the behavioral feature vector of the operating subject.

7. The log data visualization and analysis method combining RPA and AI according to claim 1, characterized in that, The entity behavior trajectory matrix, time window feature tensor, and semantic feature heatmap based on the comprehensive analysis data body are used to generate a visualization analysis interface with multi-dimensional linkage characteristics through a visualization engine, including: A visualization component for the main behavior trajectory is constructed, which converts the main behavior trajectory matrix into a node link graph. Each node represents an operation subject. The node size is mapped based on the number of log entries corresponding to the operation subject after normalization to reflect the operation frequency. The thickness and color of the edges are mapped according to the number of interactions and interaction types between the operation subjects to reflect the interaction intensity. The preset time window feature visualization module is invoked to display the feature change trend within different time windows in a data visualization graphical form, with the time window feature tensor as the time axis as the reference, and supports the scaling and sliding operation of the time window. Construct a semantic feature heatmap display area, display the semantic feature heatmap in the form of a two-dimensional matrix, with rows corresponding to time windows, columns corresponding to operation subjects, and cell color intensity indicating the weight of semantic features. It also supports interactive viewing of specific abnormal feature keywords and process node associated tags. Through a multi-dimensional linkage mechanism, interactive responses between different visualization components are achieved. When a user selects any operation subject in the main behavior trajectory map, the time window feature visualization module and the semantic feature heatmap automatically focus on the relevant features of that operation subject. When a specific time period is selected in the time window, the main behavior trajectory map and the semantic feature heatmap synchronously display the main interaction and semantic feature distribution within that time period. The layout of the visual components was optimized, and a responsive design was adopted, along with legends and interactive guides.

8. The log data visualization and analysis method combining RPA and AI according to claim 7, characterized in that, The visualization component for constructing the subject's behavioral trajectory converts the subject's behavioral trajectory matrix into a node link graph. Each node represents an operating subject. The node size is mapped based on the number of log entries corresponding to that operating subject after normalization to reflect the operation frequency. The thickness and color of the edges are mapped according to the number and type of interactions between operating subjects to reflect the interaction intensity, including: The visual mapping parameters of the nodes are determined, the node positions are calculated using the force-directed layout algorithm, and the node sizes are mapped after normalization based on the number of log entries corresponding to the operation subject. Define the visual attributes of the edges. The thickness of the edges is mapped according to the number of interactions between the operating subjects, and the color of the edges is distinguished according to the type of interaction through a preset color coding scheme. Add interactive events to nodes and edges. Clicking a node triggers a pop-up window with detailed information about that subject, and clicking an edge displays a list of specific interaction log entries between the two subjects. The performance of the node link graph is optimized by using a graphics rendering engine to improve the drawing efficiency of large-scale nodes, and node filtering and search functions are added. Add animation effects to achieve smooth transitions when nodes and edges are generated, moved, or deleted.

9. The log data visualization and analysis method combining RPA and AI according to claim 1, characterized in that, The real-time capture of user interaction operations in the visualization analysis interface, and the dynamic adjustment of the modeling parameters and visualization display method of the comprehensive analysis data body based on the analysis dimension switching command or feature filtering command triggered by the user interaction operation, include: An interactive event listening module is integrated into the visual analysis interface to capture user actions in real time and parse the interaction type and target object. Establish an interactive command parsing rule base to map different interactive operations into specific analysis dimension switching commands or feature filtering commands; The modeling parameters and visualization components that need to be adjusted are determined based on the received analysis dimension switching instructions or feature filtering instructions; The dynamic update algorithm is invoked to reprocess the preprocessed log data body and the deep semantic feature set based on the adjusted modeling parameters to generate a new comprehensive analysis data body. Inputting the new comprehensive analysis data volume into the visualization engine triggers the update and rendering of the corresponding visualization components.

10. A log data visualization and analysis system combining RPA and AI, characterized in that, The system includes a processor and a memory, the memory being connected to the processor. The memory is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the memory to implement the log data visualization and analysis method combining RPA and AI as described in any one of claims 1-9.

Images