A knowledge graph-based power data blood relationship anomaly intelligent early warning method and system

Abstract

The application provides a kind of power data blood relation abnormality intelligent early warning method and system based on knowledge graph, it is related to data processing technical field, the method includes: using hierarchical dynamic knowledge graph, adopting normal vector field consistency analysis real-time check cross-link data flow logic, output the check result with direction characteristic;According to the check result of direction characteristic, abnormal data entity is identified by manifold curvature mutation detection algorithm, and a semantic level anomaly label set is generated;Based on the semantic level anomaly label set, along the topological structure of hierarchical graph, a geodesic abnormal propagation model is constructed;Through the geodesic abnormal propagation model, the problem link coordinate sequence is locked by using gradient descent backtracking algorithm;According to the problem link coordinate sequence, the multi-dimensional environmental factors in the historical work order are associated to obtain a multi-dimensional environmental factor association graph;Based on the multi-dimensional environmental factor association graph, a hierarchical early warning strategy is dynamically generated.The application improves the accuracy of operation and maintenance resource scheduling.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a power data blood relation abnormality intelligent early warning method and system based on a knowledge graph. BACKGROUND

[0002] In the substation data monitoring scene, when the current data of a certain power transmission line is abnormal, the data blood relation link can only be traced back to the corresponding current sensor and communication module, and the topological connection relationship of the line and the associated transformer and circuit breaker is ignored.

[0003] Due to the lack of fusion of device topology, the existing method cannot verify whether the current abnormality is logically associated with the transformer load mutation and circuit breaker state switching, and can only judge the abnormality of a single data link in isolation, resulting in the misjudgment of current abnormality caused by transformer overload as sensor failure, and further generating incorrect maintenance instructions, which not only increases the cost of invalid operation and maintenance, but also may expand the scope of the fault due to the failure to timely address the root problem. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a power data blood relation abnormality intelligent early warning method and system based on a knowledge graph, so that the early warning result is more in line with the actual operation scene of the power grid, reduces redundant early warning, and improves the accuracy of operation and maintenance resource scheduling.

[0005] To solve the above technical problems, the technical solution of the present application is as follows:

[0006] In a first aspect, a power data blood relation abnormality intelligent early warning method based on a knowledge graph comprises:

[0007] Step 1: Based on the metadata of the power data blood relation link, the spatial embedding maps the data entity into a high-dimensional point cloud;

[0008] Step 2: Fuse the high-dimensional point cloud with the device topology relationship to construct a hierarchical dynamic knowledge graph;

[0009] Step 3: Using the hierarchical dynamic knowledge graph, use the normal vector field consistency analysis to verify the cross-link data flow logic in real time, and output the verification result with direction features;

[0010] Step 4: According to the verification result of the direction features, identify the abnormal data entity through the manifold curvature mutation detection algorithm to generate a semantic level abnormality marking set;

[0011] Step 5: Based on the semantic level abnormality marking set, construct a geodesic line abnormality propagation model along the hierarchical graph topology;

[0012] Step 6: Through the geodesic line abnormality propagation model, use the gradient descent backtracking algorithm to lock the problem link coordinate sequence;

[0013] Step 7, according to the lock problem link coordinate sequence, the multi-dimensional environmental factors in the historical work order are associated to obtain a multi-dimensional environmental factor association graph;

[0014] Step 8, based on the multi-dimensional environmental factor association graph, a hierarchical early warning strategy is dynamically generated.

[0015] The second aspect is an intelligent early warning system for power data bloodline abnormalities based on a knowledge graph, comprising:

[0016] The construction module is configured to map data entities into high-dimensional point clouds based on the metadata of the power data bloodline links; and to construct a hierarchical dynamic knowledge graph by fusing the high-dimensional point clouds with device topology relationships.

[0017] The verification module is configured to use the hierarchical dynamic knowledge graph to analyze the consistency of the normal vector field to verify the cross-link data flow logic in real time, and output a verification result with directional features.

[0018] The marking module is configured to identify abnormal data entities by using a manifold curvature mutation detection algorithm according to the verification result with directional features, and generate a semantic-level abnormal marking set.

[0019] The processing module is configured to construct a geodesic abnormal propagation model along the topology of the hierarchical graph based on the semantic-level abnormal marking set; and to lock the problem link coordinate sequence by using a gradient descent backtracking algorithm through the geodesic abnormal propagation model.

[0020] The early warning module is configured to associate multi-dimensional environmental factors in historical work orders according to the locked problem link coordinate sequence to obtain a multi-dimensional environmental factor association graph; and to dynamically generate a hierarchical early warning strategy based on the multi-dimensional environmental factor association graph.

[0021] The above-mentioned scheme of the present application has at least the following beneficial effects:

[0022] The method has the beneficial effects of improving the accuracy and intelligence level of power data abnormal early warning. By constructing a dynamic knowledge graph that fuses topology relationships, the comprehensiveness of data correlation analysis is enhanced; the normal vector field verification and manifold curvature detection improve the accuracy and semantic clarity of abnormal identification; the geodesic propagation model and gradient backtracking realize efficient positioning of abnormal sources; and the super-spherical matching of environmental factors and device risks makes the hierarchical early warning more targeted and reduces redundant early warning. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 is a knowledge graph-based power data bloodline abnormal intelligent early warning method flowchart provided by an embodiment of the present application.

[0024] Figure 2An intelligent power data blood relation abnormality early warning system based on a knowledge graph is provided. DETAILED DESCRIPTION

[0025] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be accurately conveyed to those skilled in the art.

[0026] As Figure 1 shown, an intelligent power data blood relation abnormality early warning method based on a knowledge graph is provided, including:

[0027] Step 1, based on the metadata of the power data blood relation link, the spatial embedding mapping data entity is a high-dimensional point cloud;

[0028] Step 2, the high-dimensional point cloud is fused with the device topology relationship, and a hierarchical dynamic knowledge graph is constructed;

[0029] Step 3, using the hierarchical dynamic knowledge graph, the normal vector field consistency is analyzed to check the cross-link data flow logic in real time, and the checking result with direction features is output;

[0030] Step 4, according to the checking result of the direction features, the abnormal data entity is identified by a manifold curvature mutation detection algorithm, and a semantic level abnormality marking set is generated;

[0031] Step 5, based on the semantic level abnormality marking set, a geodesic abnormality propagation model is constructed along the hierarchical graph topology;

[0032] Step 6, through the geodesic abnormality propagation model, the gradient descent backtracking algorithm is used to lock the problem link coordinate sequence;

[0033] Step 7, according to the locked problem link coordinate sequence, the multi-dimensional environmental factors in the historical work order are associated to obtain a multi-dimensional environmental factor association graph;

[0034] Step 8, based on the multi-dimensional environmental factor association graph, a hierarchical early warning strategy is dynamically generated.

[0035] In the embodiment of the application, by space embedding mapping and topology fusion, the metadata of the power data blood relationship link is converted into a high-dimensional point cloud and is deeply combined with the device topology relationship to construct a hierarchical dynamic knowledge graph. This process breaks through the limitations of traditional static data blood relationship management, realizes multi-dimensional association of data entities, blood relationship and device physical topology, and enables the knowledge graph to reflect the dynamic changes in power grid operation in real time. The normal vector field consistency analysis is used to perform real-time checking on the cross-link data flow logic, and the result with direction characteristics is output. Compared with the traditional artificial rules or simple statistical methods, this method can accurately capture the logical dependence and direction characteristics of the data flow in the complex topology relationship, effectively identify the abnormal patterns of implicit association, reduce the missed judgment and misjudgment problems caused by isolated analysis of data links, and improve the comprehensiveness and reliability of data flow logic checking. Based on the direction characteristic checking result, the abnormal data entities are identified by the manifold curvature mutation detection algorithm and a semantic level abnormal label set is generated. This method uses the geometric characteristics of the manifold to quantitatively analyze the data anomalies, which can not only accurately locate the abnormal data entities, but also determine the abnormal type and characteristics through semantic annotation.

[0036] In this embodiment, the geodesic abnormal propagation model constructed is combined with the gradient descent backtracking algorithm to realize the visualization tracking of the abnormal propagation path and the accurate locking of the problem link along the hierarchical graph topology. With the shortest path characteristics of the geodesic in the topology space, the key nodes of the abnormal diffusion can be efficiently located, and the gradient descent algorithm is used to backtrack to the problem source, which greatly improves the abnormal source tracing efficiency and avoids the disadvantages of blind investigation in the traditional method in the complex topology. The multi-dimensional environmental factors associated with the historical work orders are used to construct the association graph, which is combined with the device risk level through the hyperspherical space matching to dynamically generate a hierarchical early warning strategy. This process fully considers the influence of environmental factors on device anomalies and formulates early warning schemes according to the differences in device risk levels, so that the early warning results are more suitable for the actual operation scene of the power grid, reduce redundant early warning, and improve the accuracy of operation and maintenance resource scheduling.

[0037] In a preferred embodiment of the application, step 1, based on the metadata of the power data blood relationship link, the data entities are mapped into a high-dimensional point cloud, including:

[0038] Step 1.1, parse the metadata of the power data bloodline link, extract the type identifier of the data entity, the spatial coordinates of the processing node and the direction vector of the transmission path, specifically including: carrying out structured parsing work on the metadata file of the power data bloodline link; reading various data records stored in the file, classifying the metadata according to the preset field format, and ensuring that all information related to the data entity is extracted completely; then, traverse all data entity entries recorded in the metadata, identify the existence form and association of each entity in the bloodline link one by one; for each data entity traversed, extract its unique type identifier from the entity attribute field of the metadata; the identifier needs to be determined by standardized naming rules to distinguish the category of the entity.

[0039] Then, focus on the spatial attribute module of the metadata, read the physical installation location coordinates of the processing node corresponding to each data entity from it. These coordinates follow the standard of the spatial coordinate system preset by the power grid. If it is an outdoor power transmission line equipment, the coordinates record the specific geographic location based on the latitude and longitude coordinate system. If it is equipment in a substation, the installation location is marked using the local coordinate system in the station, ensuring that the coordinate data can accurately reflect the actual spatial distribution of the equipment. At the same time, according to the field in the metadata that specially records the data flow transmission relationship, sort out the data flow path of each data entity in the bloodline link, determine the starting and ending points of the transmission path of each data entity by matching the source node ID and target node ID in the data transmission record, and on this basis, combined with the spatial coordinate difference between the starting point and the ending point, calculate and extract the direction vector of the transmission path. The numerical change trend of the vector needs to be completely consistent with the actual flow direction of the data from the source node to the target node, ensuring that the direction information can truly reflect the transmission characteristics of the data flow.

[0040] Step 1.2, input the type identifier of the data entity into the pre-trained entity encoder to generate an entity feature vector with dimension d. In order to realize the conversion of the type identifier of the data entity into an entity feature vector with fixed dimension, the implementation process of the pre-trained entity encoder includes data sample preparation stage, text preprocessing stage, network structure construction stage and pre-training optimization stage. The specific steps of each stage are as follows:

[0041] The data sample preparation stage is used to construct the training sample set of the entity type identifier in the power field, providing basic data support for the pre-training of the encoder, specifically including:

[0042] Collect type identification samples of various data entities from the substation operation and maintenance management system, power equipment meta-database and data bloodline link records; the samples include but are not limited to: device class entities (such as 110kV current sensor, 220kV main transformer, 10kV circuit breaker, communication transmission module), data processing node class entities (such as edge computing gateway, data aggregation server, in-station data forwarding node), and the total amount of samples is not less than a preset threshold (such as 100,000), and covers all types and subtypes of common data entities in the power system.

[0043] Clean and standardize the collected samples, specifically including:

[0044] Filter samples with format errors, missing key information or duplicate records; uniformly convert type identification text into a preset format, for example, 110kv current sensing device and 110KV current sensor are uniformly standardized as 110kV current sensor, to ensure that the text description of the same entity type is completely consistent; associate core attribute labels with each standardized sample, the attribute labels include the functional type of the entity (such as current monitoring, voltage conversion, data transmission), technical parameters (such as voltage level = 110kV, data accuracy = 0.5 level), interaction characteristics (such as historical interaction frequency, data processing delay), to form a training sample pair associated with type identification and attribute labels.

[0045] The text preprocessing stage is used to convert the text information of entity type identification into an input form recognizable by the encoder, specifically including:

[0046] The standardized type identification text is subjected to word segmentation operation to extract core feature words. For example, 220kV and transformer are reserved after word segmentation of 220kV main transformer; data and acquisition module are reserved after word segmentation of data acquisition module, and virtual words (such as main and the) without actual semantics are filtered; based on the word segmentation results of all samples, a power field exclusive vocabulary (Vocabulary) is constructed, which contains core technical words (such as 110kV, circuit breaker, acquisition and transmission) in entity type identification; each word in the vocabulary is assigned a unique index number, and the word segmented text sequence is converted into an index sequence, for example, the index sequence [5, 8] corresponding to 110kV current sensor (where 110kV corresponds to index 5 and current sensor corresponds to index 8); the index sequence is mapped to a low-dimensional dense word vector by using a word embedding (Word Embedding) technology; specifically, a pre-trained general word vector model (such as Word2Vec and GloVe) is used as a basis, and the power field samples are fine-tuned to make the word vectors of semantically related words (such as current sensor and voltage sensor) close to each other, and the word vectors of semantically different words (such as sensor and transformer) far from each other; each word is mapped to an initial word vector of a fixed dimension (such as 128 dimensions), and the word vector combination of the text sequence forms an input matrix of the encoder.

[0047] The entity encoder adopts a multi-layer neural network structure to realize deep extraction of text semantics through multi-layer feature mapping, and its network structure includes:

[0048] The input layer receives the preprocessed word vector matrix, and the matrix dimension is the number of word segmentation x word vector dimension. For example, 110kV current sensor contains 2 core words after word segmentation, and the input matrix dimension is 2x128. The feature extraction layer is composed of a multi-layer convolutional neural network (CNN) and a fully connected network, which is used to extract deep semantic features of the text layer by layer:

[0049] The first layer (local feature fusion) performs convolution operation on the input word vector matrix through a convolution kernel (such as 3x3 size) to extract local correlation features between words (such as voltage level correlation between 220kV and transformer), and outputs an intermediate feature vector with a dimension of 256; the second layer (semantic feature deepening) applies a nonlinear activation function (such as ReLU) to the feature vector output by the first layer to further extract abstract semantic features and distinguish the functional differences of entity types (such as the functional distinction between current monitoring and data transmission), and outputs a feature vector with a dimension of 128; the high layer mapping layer maps the deep semantic features to a preset dimension d (such as 64 dimensions) through 1-2 layers of fully connected network, and the dimension d corresponds to the number of core attributes of the entity, and each dimension is associated with one core attribute of the entity (such as dimension 1 corresponding to voltage level, dimension 2 corresponding to functional type, and dimension 3 corresponding to data precision).

[0050] An output layer outputs an entity feature vector of a fixed dimension d, and the numerical value of each dimension in the vector quantitatively represents the characteristics of the core attributes of the entity.

[0051] A large number of labeled samples are used to train the network parameters, so that the feature vector output by the encoder accurately matches the core attributes of the entity, specifically including:

[0052] The matching degree of the feature vector and the entity core attribute label is taken as the optimization goal. For example, for the sample 110kV current sensor, the attribute label voltage level = 110kV, function type = current monitoring, the target value of the preset dimension in the corresponding feature vector (such as the voltage level dimension target value is standardized to 0.6, and the function type dimension target value is standardized to 0.8), the training goal is to minimize the difference between the output vector and the target value.

[0053] The mean square error (MSE) is used to calculate the difference between the output feature vector and the attribute label target value, and the loss value is the average of the errors of each dimension; for example, if the output value of the voltage level dimension is 0.58 and the target value is 0.6, then the error of this dimension is (0.58-0.6) 2 , and the overall loss is the arithmetic mean of all dimension errors.

[0054] The gradient descent optimization algorithm (such as the Adam optimizer) is used to calculate the gradient of the loss function with respect to the parameters of each layer of the network (convolution kernel weight, fully connected layer weight); the parameters are adjusted in the negative direction of the gradient to reduce the loss value, for example, the convolution kernel weight that causes the voltage level feature extraction bias is corrected; the sample set is divided into a training set (80%) and a validation set (20%), and the training is iterated in batches (such as 32 samples per batch) until the loss of the validation set converges stably (such as no significant decrease in loss for 100 consecutive iterations); the encoder performance is evaluated by the test set (new samples not involved in training), and samples of entity types with insufficient feature extraction accuracy (such as circuit breakers) are supplemented for secondary fine-tuning to ensure that the feature vectors of all entity types accurately represent their core attributes. When the encoder is pre-trained, the following operations are performed on the type identifier extracted in step 1.1:

[0055] The type identifier text is converted into an index sequence according to the rules in the text preprocessing stage, and then mapped into a word vector matrix; the word vector matrix is input into the pre-trained encoder to extract semantic features in the text through multiple layers of feature mapping; a numerical entity feature vector of dimension d is output, and the numerical value of each dimension in the vector corresponds to the core attribute characteristics of the entity, such as function type, data processing capacity, and historical interaction frequency; through the above process, the entity encoder realizes the conversion of the power data entity type identifier from abstract text to quantitative feature vector.

[0056] Step 1.3, spherical coordinate system conversion of the spatial coordinates of the processing node and the direction vector of the transmission path, calculation of the longitude angle and the latitude angle; in order to convert the spatial parameters in the Cartesian coordinate system into quantifiable angle characteristics and realize accurate representation of the spatial position and direction, the spherical coordinate system conversion process includes two sub-processes of processing node spatial coordinate conversion and transmission path direction vector conversion, the specific steps are as follows:

[0057] With the origin of the global coordinate system of the power grid as the reference datum, the Cartesian coordinate parameters of the processing node are converted into angle parameters in the spherical coordinate system, which specifically includes:

[0058] The spatial coordinates of the processing node analyzed in step 1.1 are extracted, which are represented in the form of three-dimensional components (x, y, z) in the Cartesian coordinate system, where x and y are the horizontal direction transverse and longitudinal components, and z is the vertical direction component, representing the physical installation position of the processing node in the global coordinate system; taking the origin (0, 0, 0) of the global coordinate system of the power grid as the starting point and the processing node coordinates (x, y, z) as the ending point, the straight-line distance between the two points (i.e. the radial parameter r in the spherical coordinate system) is calculated, which is used to represent the spatial distance feature of the processing node relative to the global origin; the longitude angle is defined as the rotation angle of the processing node in the spherical coordinate system around the polar axis (z axis of the global coordinate system), and the calculation method is:

[0059] The projection coordinates (x, y, 0) of the processing node coordinates on the horizontal plane (x-y plane) are extracted; taking the positive direction of the x-axis of the global coordinate system as the reference, the included angle between the projection coordinates and the x-axis positive direction (vector (x, y, 0)) is calculated, which is the longitude angle θ1, with a value range of 0°-360°, used to represent the azimuth feature of the processing node on the horizontal plane; the latitude angle is defined as the included angle between the line connecting the processing node and the origin (vector (x, y, z)) and the equatorial plane (x-y plane), and the calculation method is:

[0060] Taking the x-y plane as the reference of the equatorial plane, the acute angle between the line connecting the processing node and the origin (vector (x, y, z)) and the plane is calculated, which is the latitude angle φ1, with a value range of -90°-90° (or 0°-90°, adjusted according to the vertical direction), used to represent the vertical height direction feature of the processing node; through the above steps, the conversion of the processing node from the Cartesian coordinates (x, y, z) to the angle parameters (longitude angle θ1, latitude angle φ1) in the spherical coordinate system is completed, and the angle parameters are used to quantitatively represent the spatial position feature of the processing node.

[0061] With the starting point of the transmission path as the local reference origin, the Cartesian components of the direction vector are converted into angle parameters in the spherical coordinate system, which specifically includes:

[0062] Extract the direction vector of the transmission path resolved in step 1.1, which is represented in three-dimensional components in the Cartesian coordinate system as (dx, dy, dz), where dx, dy, dz are the components of the vector in the x, y, z axis directions, respectively, representing the transmission direction trend of the data from the starting point to the ending point; taking the starting point of the transmission path as the origin (0, 0, 0) of the local coordinate system, and the direction vector (dx, dy, dz) as the vector from the origin, which is used to represent the spatial pointing characteristics of data transmission; the direction vector longitude angle is defined as the angle between its projection on the horizontal plane and the reference direction, and the calculation method is:

[0063] Extract the projection component (dx, dy, 0) of the direction vector on the x-y plane; taking the positive direction of the x-axis of the local coordinate system as the reference, calculate the angle between the projection component and the positive direction of the x-axis, which is the direction vector longitude angle θ2, with a value range of 0°-360°, used to represent the azimuth trend of data transmission on the horizontal plane.

[0064] The direction vector latitude angle is defined as the angle between the direction vector and the horizontal plane, and the calculation method is:

[0065] Taking the x-y plane as the reference, calculate the acute angle between the direction vector (dx, dy, dz) and the plane, which is the direction vector latitude angle φ2, with a value range of -90°-90° (or 0°-90°), used to represent the vertical direction trend of data transmission. Through the above steps, the conversion of the transmission path direction vector from the Cartesian component (dx, dy, dz) to the spherical coordinate system angle parameter (longitude angle θ2, latitude angle φ2) is completed, and the angle parameter is used to quantitatively represent the spatial pointing characteristics of data transmission.

[0066] Step 1.4, tensor splicing the entity feature vector and the longitude and latitude angles to form a three-dimensional space expansion vector; to realize the fusion of data entity semantic attribute features and spatial features, the entity feature vector and the spherical coordinate system angle parameter need to be spliced in tensor dimension, the specific steps are as follows:

[0067] Extract the entity feature vector generated in step 1.2, which is a fixed-dimensional numerical vector, denoted as V = [v1, v2,..., vd], where d is the preset dimension, and v1 to vd correspond to the core attribute features (such as function type, data processing capacity, historical interaction frequency, etc. Semantic attributes) of the data entity; the spherical coordinate system angle parameter calculated in step 1.3 includes but is not limited to the longitude angle θ1 and the latitude angle φ1 of the processing node, or the longitude angle θ2 and the latitude angle φ2 of the transmission path direction vector (determined according to the association between the data entity and the spatial feature); In the splicing process, the original dimension arrangement order of the entity feature vector V is strictly preserved, i.e. the order of v1 to vd is unchanged, ensuring the integrity and traceability of the semantic attribute features.

[0068] The selected angle parameter values are sequentially appended at the end of the entity feature vector V:

[0069] If the spatial position angle of the concatenation processing node is concatenated, the vector V1=[v1, v2,..., vd, θ1, φ1] is formed; if the transmission path direction angle is concatenated, the vector V2=[v1, v2,..., vd, θ2, φ2] is formed; the vector obtained after concatenation is a three-dimensional space expansion vector, and the dimension is d+2 (the sum of the original entity feature vector dimension d and the two angle parameter dimensions); the vector contains:

[0070] The semantic attribute features (v1 to vd) from the entity feature vector;

[0071] The spatial features (longitude angle, latitude angle) from the spherical coordinate system angle parameter, realizing multi-dimensional feature fusion of data entity semantic attributes and spatial position / transmission direction; through the spherical coordinate system conversion in step 1.3, the spatial coordinates and direction vectors in the Cartesian coordinate system are converted into quantifiable angle parameters; through the tensor concatenation in step 1.4, the semantic features and spatial features are organically integrated.

[0072] Step 1.5, generating a high-dimensional point cloud coordinate set according to the three-dimensional space expansion vector, specifically including:

[0073] Collecting three-dimensional space expansion vectors of all data entities, for each dimension in the vector, including semantic attribute dimensions (such as dimensions representing function types, data processing capabilities) from the entity feature vector, and spatial angle dimensions (such as longitude angle, latitude angle) converted from the spherical coordinate system, respectively calculating the average value and dispersion degree of the corresponding values of all data entities in this dimension; then, for the specific value of each data entity in this dimension, it will be adjusted to conform to the unified distribution standard, ensuring that the values of each dimension after processing present an average level of the middle value and a consistent dispersion range, avoiding the influence of the characteristics of other dimensions being masked due to the original value range of some dimensions being too large.

[0074] In order to let each point in the high-dimensional space correspond to the original data entity, a unique identity will be assigned to each data entity, which will be bound with the type identifier extracted from the metadata earlier, facilitating subsequent tracing of which specific entity a high-dimensional coordinate corresponds to; then, the three-dimensional space expansion vector after normalization is directly used as the coordinate of the entity in the high-dimensional space, that is, each data entity corresponds to a point in the high-dimensional point cloud, and the coordinates of the point are composed of the normalized semantic attribute dimension values and spatial angle dimension values, the number of dimensions of the coordinates is consistent with the number of dimensions of the three-dimensional space expansion vector, ensuring that the features of each entity are completely converted into position information in the high-dimensional space.

[0075] After that, all valid data entities in the power data bloodline link are traversed, and the high-dimensional coordinates corresponding to each entity are collected one by one. These coordinates are arranged into a structured set, usually stored in the form of a table: each row of the table corresponds to a data entity, and the identification of the row is the unique identity of the entity; each column of the table corresponds to a dimension of the high-dimensional coordinates, and the identification of the column is the feature type corresponding to the dimension (for example, a column corresponds to the function type dimension, and another column corresponds to the longitude angle dimension); and each cell in the table records the specific coordinate value of the entity in the corresponding dimension. In this way, a complete coordinate set is formed, clearly presenting the position distribution of all entities in the high-dimensional space; the distance between the coordinates of different entities in the high-dimensional space is calculated, and the closer the distance, the closer the association between the entities. For entities that are known to have strong association, such as data collection nodes and data processing nodes belonging to the same device, their distance in the high-dimensional space should be significantly smaller than the distance between entities without association; if it is found that some entities that should have strong association have a too large distance, it is necessary to backtrack to the previous entity coding step or spherical coordinate conversion step to check whether there is a deviation in the feature extraction or parameter calculation process, and then correct these deviations until the distance feature in the high-dimensional point cloud accurately reflects the inherent association between entities.

[0076] In the embodiment of the application, this step extracts key features by structured analysis of metadata, converts type identification into semantic feature vectors through entity coding, quantizes space and direction information through spherical coordinate conversion, and then fuses attribute and spatial features through tensor splicing. This process realizes the deep fusion of semantic attributes, spatial positions and transmission directions of data entities, preserves the core association relationship between entities, and enhances the distinguishability of hidden relationships through high-dimensional space mapping.

[0077] In a preferred embodiment of the application, step 2, the high-dimensional point cloud is fused with the device topology relationship to construct a hierarchical dynamic knowledge graph, including:

[0078] Step 2.1, obtain the power device topology relationship, analyze and generate the connection weight matrix between device entities, specifically including: obtaining complete power device topology relationship data from the topology database of the power system, the device operation and maintenance management system or the power grid design drawing. These data include the physical connection relationship (such as cable connection, bus connection) between device entities (such as transformers, circuit breakers, sensors, servers, etc.), communication connection relationship (such as optical fiber transmission link, wireless communication link) and functional dependency relationship (such as the association between control nodes and controlled devices).

[0079] Then, the connection type between each pair of device entities is combed one by one to determine whether it is a direct physical connection, an indirect communication connection or a functional dependency; at the same time, key factors affecting the connection strength are collected, including the physical distance of the connection (the closer the distance, the higher the weight), the historical data transmission frequency (the more frequent the transmission, the higher the weight), the importance level of the connection (such as the main line connection weight higher than the branch line), and the historical failure correlation degree (the higher the probability of simultaneous failure in the past, the higher the weight); then, the connection strength of each pair of device entities is quantitatively evaluated according to the above factors, and the basic weight of different types of connections is set (such as the basic weight of direct physical connection is 0.8, and the basic weight of indirect communication connection is 0.5), and then adjusted combined with specific factors (such as the connection with higher transmission frequency than the average value increases the basic weight by 0.2, and the connection with too long physical distance decreases the basic weight by 0.1); finally, all device entities are taken as rows and columns of the matrix to construct a square connection weight matrix: the value of each cell in the matrix is the quantitative connection weight between the two device entities corresponding to the row and column, which directly presents the correlation strength between device entities.

[0080] Step 2.2, tensor fusion of high-dimensional point cloud coordinate set and connection weight matrix to generate device-data association tensor, specifically including: determining the device entity to which each high-dimensional point cloud coordinate (representing a data entity) belongs (such as the data point cloud of a current sensor corresponds to a 110kV transformer device) through the unique identity bound in step 1.5, establishing a mapping table of data entities and device entities; splitting the high-dimensional coordinates of each data entity by dimension to determine the feature type corresponding to each dimension (such as semantic attribute dimension, spatial angle dimension), forming a feature set of data entities; taking the device entity as the core dimension, taking the connection relationship between devices in the connection weight matrix as one dimension, and taking the feature dimension of the data entity in the high-dimensional point cloud as another dimension, to ensure that the topological association of the device and the feature information of the data are compatible in dimension; integrating the three types of information of device entities, connection weights between devices, and high-dimensional features of data entities according to the three-dimensional structure of devices, connection weights, and data features to form a multi-dimensional device and data association tensor, which contains not only the topological association strength between device entities, but also the high-dimensional features of each device corresponding data entity, realizing the deep binding of device topological relationship and data features.

[0081] Step 2.3, based on the device-data association tensor, calculate the similarity matrix between device clusters and data point cloud clusters, specifically including: according to the type of device (such as power transmission equipment, power transformation equipment, communication equipment) and the functional attribute of data entity (such as monitoring data, control data, transmission data), the device entity is divided into initial device clusters, and the data entity in the high-dimensional point cloud is divided into initial data point cloud clusters; the core topology features of each device cluster (such as the average connection weight of the devices in the cluster, the main connection type) and the core data features of each data point cloud cluster (such as the average semantic feature of the data entities in the cluster, the spatial angle distribution) are separated from the tensor; for the device clusters, the similarity is calculated by comparing the matching degree of the core topology features (such as the coincidence degree of the connection weight distribution, the consistency of the connection type); for the data point cloud clusters, the similarity is calculated by comparing the closeness of the core data features (such as the similarity of the semantic feature vector, the consistency of the spatial angle distribution); for the device cluster and the corresponding data point cloud cluster, the similarity is calculated by verifying the association degree of the device topology features and the data features (such as whether a certain power transformation equipment cluster is highly matched with a monitoring data point cloud cluster); the similarity matrix is obtained by quantifying the similarity between all clusters, and the rows and columns of the similarity matrix correspond to all device clusters and data point cloud clusters respectively, and the numerical value of each cell represents the similarity between the corresponding two clusters, and the higher the numerical value, the closer the association between the clusters.

[0082] Step 2.4, perform agglomerative hierarchical clustering through the similarity matrix, iteratively merge the adjacent clusters with the highest similarity, and generate a cluster merging sequence, specifically including: each initial device cluster and initial data point cloud cluster divided in step 2.3 is taken as an independent initial cluster, and each cluster is self-contained at the beginning of clustering; find the two adjacent clusters with the highest numerical value from the similarity matrix (adjacent means clusters with direct association in topology relationship or data features), and merge the two clusters into a new cluster; at the same time, record the identification of the two clusters and the similarity value at the time of merging as the first record of the merging sequence; after merging, the original two clusters are removed from the initial cluster set, and the new cluster is added to the set; re-calculate the similarity between the new cluster and all other clusters in the set (based on the matching degree of the comprehensive features of the new cluster and the features of other clusters), and update the similarity matrix to ensure that the matrix can reflect the latest association strength between all clusters; based on the updated similarity matrix, find the adjacent clusters with the highest similarity again for merging, and record the merging information; update the cluster set and the similarity matrix after each merging until all clusters are finally merged into a total cluster containing all devices and data entities. Finally, integrate all merging records to generate a cluster merging sequence, which is arranged in time (iteration order) and clearly records the cluster pair of each merging step, the similarity at the time of merging, and the features of the new cluster, fully presenting the aggregation process from fine-grained clusters to coarse-grained clusters.

[0083] Step 2.5, constructing a hierarchical dynamic knowledge graph according to the cluster merging sequence, specifically including: taking the cluster state before each merging as a level of the knowledge graph according to the iteration steps of the cluster merging sequence; the initial level (the bottom layer) corresponds to the fine-grained initial cluster at the beginning of clustering, containing the detailed attributes, connection relationships and high-dimensional features of each device and data entity; with the iteration of merging, each upward level corresponds to the state after each cluster merging, and the granularity of the cluster gradually becomes coarse.

[0084] Next, the nodes and relationships of each level are constructed. In each level, the clusters of the level are taken as the core nodes of the knowledge graph, and the node attributes include the comprehensive features of all devices and data entities in the cluster (such as core functions, main connection types, and data feature averages). According to the device topology relationship and data association characteristics, edge relationships are established between nodes, and the weight of the edge is determined based on the similarity or connection weight between clusters, directly presenting the association strength between clusters. Then, a real-time data updating mechanism is associated with the knowledge graph. When new devices, data entities or topology relationships in the power system change, the connection weight matrix and similarity matrix are recalculated, and the cluster merging sequence is adjusted. According to the updated merging sequence, the node composition, attributes and edge relationships of each level are updated in real time, ensuring that the knowledge graph can dynamically reflect the latest state of the power grid.

[0085] Finally, a complete hierarchical dynamic knowledge graph is formed. The hierarchical dynamic knowledge graph presents a hierarchical structure from the fine-grained association of specific devices and data entities to the macro association of coarse-grained clusters from bottom to top. Each level not only retains the core association information at that granularity, but also realizes the linkage between upper and lower levels through the mapping relationship between levels, making it easy to trace the association of devices and data from macro to micro.

[0086] In the embodiment of the application, the high-dimensional point cloud data features are bound with the device topology connection weight depth through tensor fusion to construct a device and data correlation tensor, organically integrating data entity semantics / space features with device physics / function correlation for the first time, solving the problem of data isolation in device topology in traditional management; based on the cluster merging sequence generated by the condensed hierarchical clustering, the knowledge graph forms a multi-level structure from the bottom layer of fine-grained entities (single device, single data point) to the top layer of macro clusters (full-system device and data set). Different levels retain the core correlation information of the corresponding granularity (such as device detail attributes at the bottom layer and global correlation trends at the top layer), improving the explainability of the correlation relationship. Through the real-time data update mechanism, when devices are added, topology is adjusted, or data features change, the knowledge graph can dynamically update node composition and relationship weight by recalculating the weight matrix and adjusting the clustering sequence, ensuring that the graph always reflects the latest state of the power grid, breaking through the limitations of traditional static knowledge graphs that are difficult to adapt to dynamic power grid scenarios. The combination of hierarchical structure and dynamic updating enables the knowledge graph to focus on both local correlation of fine-grained entities (such as the matching of devices and monitoring data in a substation) and global correlation across levels (such as the dependency relationship between a power transmission line cluster and a communication data cluster), significantly improving the efficiency of mining implicit and cross-link associations.

[0087] In a preferred embodiment of the application, step 3 uses a hierarchical dynamic knowledge graph to perform real-time verification of cross-link data flow logic using normal vector field consistency analysis, and outputs verification results with direction features, including:

[0088] Step 3.1 extracts the spatial trajectory tangent vector of the cross-link data flow from the hierarchical dynamic knowledge graph, specifically including: in the hierarchical dynamic knowledge graph, filtering out data flows that cross different device clusters or data clusters (such as data flows from a power transmission device cluster to a substation device cluster, and data flows from a monitoring data cluster to a control data cluster), determining the start node, intermediate node, and target node involved in these data flows, and forming a complete list of cross-link paths.

[0089] Next, based on the node correlation relationship (edge weight and direction) of each level of the knowledge graph, the order of each node through which the data flow passes in the path is recorded, as well as the transmission direction of the data between nodes (such as from node A to node B, and then from node B to node C), forming a visual spatial flow trajectory.

[0090] Then, for each node in the trajectory, a vector representing the direction of data flow is generated based on the node as the starting point and the connection direction between the node and the next adjacent node (based on the direction feature of the knowledge graph edge). For example, if data flows from node M (coordinate feature X1, Y1) to node N (coordinate feature X2, Y2), the tangent vector direction at node M is the direction from M to N, and the vector feature includes the spatial trend of the direction (such as horizontal position and vertical angle change). The tangent vectors of all nodes are sorted in the order of the trajectory to form a set of spatial trajectory tangent vectors of the cross-link data flow.

[0091] Step 3.2, based on the spatial trajectory tangent vector, calculate the theoretical normal vector field of each graph node, specifically including: taking the spatial trajectory tangent vector of each node extracted in step 3.1 as the reference, the theoretical normal vector must be perpendicular to the tangent vector, that is, the direction of the two is strictly 90°, this perpendicular relationship is the primary constraint condition for the calculation of the normal vector, which ensures that the normal vector can accurately reflect the vertical direction feature of the trajectory at the node; in actual operation, the direction of the tangent vector of each node is accurately positioned (such as recording the horizontal position and vertical trend of the tangent vector through spatial angle parameters), and the possible direction range of the normal vector is determined with reference to this, all directions that meet the perpendicular condition with the tangent vector are included in the preliminary candidate set.

[0092] For each node in the knowledge graph, obtain the core features from the cluster attributes of its level, including the physical connection rules of the device cluster (such as the connection order of busbar, circuit breaker, and transformer in the substation), and the transmission protocol of the data cluster (such as the path transmission of monitoring data according to the collection node, aggregation server, and control center); at the same time, analyze the association relationship between the node and the adjacent node, including the connection weight (the higher the weight, the closer the association) and the function dependency direction (such as A node is the data source of B node, then B depends on A). Then, based on the above topological features, exclude the directions that conflict with the logic of power grid data flow; for example, for a substation device node, if all its adjacent nodes are located on the west side and the connection weight is concentrated on the west side, then the west vertical direction is selected from the candidate set (not east), ensuring that the normal vector direction meets the inherent specification of the signal interaction of the in-station device; for a data transmission node, if the data flow needs to flow along the direction of high-voltage level equipment and low-voltage level equipment, then the normal vector needs to match this function dependency trend to avoid directions that conflict with the transmission protocol; finally, each node determines a unique optimized normal vector direction, which not only meets the perpendicular constraint with the tangent vector, but also conforms to the topological logic of the node.

[0093] The optimized theoretical normal vector of each node is accurately mapped according to its position coordinates (such as high-dimensional point cloud coordinates or topological level coordinates) in the hierarchical dynamic knowledge graph, that is, the coordinate position of each node corresponds to a normal vector, forming a one-to-one correspondence between coordinates and vectors; all nodes are traversed to check whether the normal vector directions of adjacent nodes in the same device cluster or data cluster show a continuous trend, for example, the node normal vectors of the same power transmission line cluster should gradually change along the line direction, rather than suddenly reverse; the transition of normal vectors between different level clusters needs to comply with the level mapping relationship (such as the bottom fine-grained node normal vector and the top macro cluster normal vector maintaining logical consistency); if there is a sudden change in the normal vector of a certain area, it needs to be traced back to the direction optimization step to adjust again until the normal vectors of all nodes form a coherent and unified distribution rule; finally, the theoretical normal vector field covering all related nodes of the cross-link data flow is formed.

[0094] Step 3.3, the actual tangent vector and the theoretical normal vector are subjected to vector dot product operation to generate a direction consistency coefficient, which specifically includes: through the sensors, data acquisition terminals and transmission link monitoring tools deployed in the power system, the actual flow state of the cross-link data flow at each node is captured in real time, and the real direction of data transmission from the current node to the next node (such as the physical transmission path from node P to node Q, the actual flow direction of signals in the communication link) is recorded; the actual flow direction collected is converted into vector features, including the horizontal angle (such as 30° east longitude), the vertical angle (such as 5° elevation angle) and the transmission intensity trend (such as the stability characteristics of signal transmission), forming the actual trajectory tangent vector of each node, which directly reflects the real transmission direction of data at the node, and corresponds to the preset trajectory tangent vector extracted based on the knowledge graph preset path in step 3.1, together constituting the basis reference for subsequent direction comparison.

[0095] For each node in the knowledge graph, the actual trajectory tangent vector is compared with the theoretical normal vector calculated in step 3.2 in multiple dimensions, which specifically includes:

[0096] The horizontal angle difference (e.g., 5°) between the actual tangent vector and the theoretical normal vector is calculated by comparing the horizontal azimuth angle of the actual tangent vector with that of the theoretical normal vector (e.g., whether the actual eastward direction is also eastward in the theoretical direction); the vertical angle deviation is checked by checking whether the vertical trend of the actual direction is consistent with that of the theoretical direction (e.g., whether the actual upward transmission is also upward in the theoretical direction); the overall trend of the actual direction is judged by combining the topological characteristics of the cluster to which the node belongs (e.g., the transmission rule of the device cluster and the interaction logic of the data cluster) to determine whether the actual direction conforms to the overall trend expected by the theoretical direction (e.g., whether it is transmitted along the preset high-weight link direction); and the degree of fit between the actual direction and the theoretical direction is comprehensively evaluated according to the comparison results of the above dimensions. If the horizontal angle difference is small, the vertical direction is consistent, and the topology trend is met, the degree of fit is high; if the angle deviation is large, the vertical direction is opposite or violates the topology logic, the degree of fit is low.

[0097] Based on the quantitative evaluation results of the degree of fit, a mapping relationship between the degree of fit and the numerical value is established. When the horizontal angle of the actual tangent vector and the theoretical normal vector completely coincides, the vertical direction is consistent, and all topology trends are met, the directions are completely consistent, and the coefficient value tends to 1; when there is a slight deviation between the two (e.g., the angle difference is within 10°, and the vertical direction is basically consistent), the coefficient value is between 0.7 and 0.9; when the deviation is moderate (e.g., the angle difference is between 10° and 45°, and the vertical direction has a small conflict), the coefficient value is between 0 and 0.7; when the deviation is large (e.g., the angle difference is between 45° and 90°, and the vertical direction is obviously opposite), the coefficient value is between -0.7 and 0; and when the directions of the two are completely opposite (e.g., the angle difference is 180°, and the vertical direction is completely conflicting), the coefficient value tends to -1. Then, the coefficient is calculated and output, and the degree of fit of each node is converted into a specific numerical direction consistency coefficient according to the above rules; for example, the horizontal angle deviation between the actual tangent vector and the theoretical normal vector of a certain node is 5°, the vertical direction is consistent, and the topology trend is met, and the corresponding coefficient is 0.9; the actual direction of another node is opposite to the theoretical direction, and the corresponding coefficient is -0.9; finally, each node generates a unique direction consistency coefficient, which intuitively quantifies the degree of consistency between the actual data flow direction and the theoretical logical direction.

[0098] Step 3.4, threshold verification according to the direction consistency coefficient, if the direction consistency coefficient < first threshold, mark as direction conflict, specifically including: combining the normal fluctuation range of the historical data stream of the power grid and the analysis of abnormal cases, preset the critical value of the direction consistency coefficient (i.e. the first threshold), for example, set the threshold to 0.6 (indicating that when the direction deviation exceeds 53°, it is determined to be abnormal), the threshold can be dynamically adjusted according to the actual scene of the power grid; traverse all nodes involved in the cross-link data stream, compare the direction consistency coefficient of each node with the first threshold, if the coefficient of a node is greater than or equal to the first threshold, it means that the data stream direction at the node is basically consistent with the theoretical logic, and is marked as normal; if the coefficient is less than the first threshold, it means that there is a significant deviation between the actual direction and the theoretical expectation (such as reverse transmission of data stream, deviation from the preset path), and is marked as direction conflict; for the nodes marked as direction conflict, record their position in the knowledge graph (belonging level, cluster identifier), actual tangent vector direction, theoretical normal vector direction and coefficient value in detail.

[0099] Step 3.5, integrate the direction conflict mark, output the verification result with direction characteristics, specifically including: collecting all node records marked as direction conflict in step 3.4, sorting according to the path order of the cross-link data stream, forming a conflict node list, determining the position of each conflict node, the link it belongs to and the conflict degree (specific coefficient value); supplement the direction characteristic description for each conflict node, including the deviation direction of the actual data stream (such as east deviation, upward deviation), the angle trend with the theoretical direction (such as continuous increase, sudden reverse), and the topological role of the node in the knowledge graph (such as key transmission node, edge node); integrate the conflict list and direction characteristics into a standardized report, including: the overall verification conclusion of the cross-link data stream (such as there are 3 direction conflicts), the detailed position and identifier of the conflict nodes, the direction deviation characteristics of each conflict, the consistency coefficient value and the threshold comparison.

[0100] In the embodiment of the application, by comparing the spatial trajectory tangent vector extraction with the actual data stream state in real time, combining the normal vector field vertical constraint and the topological logic screening, the problems such as direction deviation and path anomaly in the cross-link data stream can be quickly located, and the lag or missed detection in the traditional verification can be avoided; the direction consistency coefficient converts the deviation of the actual and theoretical direction into a direct numerical value (-1 to 1), and through threshold verification, the conflict nodes are marked, and the deviation direction, topological role and other characteristics are supplemented, so that the abnormal reason can be traced back, and the operation and maintenance personnel can be targeted; when the theoretical normal vector is calculated, the device cluster physical rules (such as connection order) and data cluster transmission protocol (such as path specification) are fused, so that the verification benchmark conforms to the actual operation logic of the power grid, and the false positive anomaly caused by the topological characteristics is effectively excluded, and the verification reliability is improved; based on the hierarchical dynamic knowledge graph, the dynamic changes (such as node addition and deletion, link weight adjustment) of the power grid device / data cluster can be flexibly adapted, and the continuous trend verification of the normal vector field and the hierarchical transition logic guarantee that the verification mechanism can still operate stably in a complex dynamic environment; the overall cross-link data stream verification conclusion and detailed abnormal information are output through the standardized conflict report.

[0101] In a preferred embodiment of the application, step 4, according to the verification result of the direction feature, the abnormal data entity is identified through the manifold curvature mutation detection algorithm, and a semantic level abnormality marking set is generated, including:

[0102] Step 4.1, according to the verification result of the direction feature, the graph node coordinate set corresponding to the direction conflict marking is extracted, specifically including: according to the verification result with direction features output in step 3.5, the result contains the verification state (normal or direction conflict) of all nodes in the cross-link data stream; then, from the verification result, all node records marked as direction conflict are filtered out, these records usually contain the basic information (such as node name, link, etc.) of the node, so as to determine the target node range that needs to be further analyzed; for each direction conflict node record filtered out, the unique identification information of the node in the hierarchical dynamic knowledge graph is extracted from the record. These identifiers include but are not limited to node ID (such as Node-2023-056) and cluster identifier (such as Transmission-Cluster-03), which ensures that each node can be accurately located in the knowledge graph, avoiding confusion of information of different nodes.

[0103] The unique identifier of the node is taken as the retrieval basis to perform query matching in the hierarchical dynamic knowledge graph. If the node is constructed based on high-dimensional point cloud, the complete high-dimensional coordinates of the node are extracted from the coordinate storage module of the knowledge graph, which cover semantic attribute dimensions (such as dimension values corresponding to functional types and data processing capabilities) and spatial angle dimensions (such as values corresponding to longitude and latitude angles). If the node is constructed based on topology hierarchy, the position coordinates of the node in the hierarchical structure are extracted, including the hierarchical number (such as Level-2) to which the node belongs and the relative position information (such as the sorting sequence number in the cluster and the relative distance from the cluster center) of the node in the cluster. The coordinate information of all direction conflict nodes is classified and arranged according to the unique identifier of the node, and an independent coordinate entry is established for each node, which clearly records the node ID, the cluster identifier to which the node belongs, and the corresponding complete spatial coordinate data. Finally, these entries are stored as a structured data set (such as a table form), i.e., a direction conflict node coordinate set, to ensure that the coordinate information of each conflict node can be quickly calculated in subsequent calculations.

[0104] Step 4.2, based on the node coordinate set of the graph, the Gaussian curvature value in the neighborhood of each node is calculated, which specifically includes:

[0105] For each node in the coordinate set, the neighborhood range is determined according to the topological association relationship recorded in the hierarchical dynamic knowledge graph. Specifically, the connection weight between nodes is taken as the judgment basis to select the adjacent nodes connected to the target node with a connection weight greater than or equal to a preset association threshold. At the same time, the near neighbor nodes indirectly associated with the target node are included, usually selecting the nearest 5-10 nodes (distance determination is based on the spatial coordinate distance or topological path length in the knowledge graph) to the target node. In this way, it is ensured that the defined neighborhood range can fully reflect the local spatial distribution characteristics around the target node.

[0106] For each target node in the defined neighborhood range, the complete spatial coordinate information of all nodes in the neighborhood (including the target node itself) is collected. The relative position relationship between each neighborhood node and the target node is recorded in detail, including the difference between the two nodes in each coordinate dimension (such as the difference in semantic attribute dimension and spatial angle dimension in high-dimensional point cloud coordinates, or the difference in hierarchical level and relative position in the cluster in topology hierarchical coordinates), and the direction vector feature from the target node to the neighborhood node. These coordinate information and relative position relationship are arranged into a structured neighborhood coordinate matrix, which clearly presents all coordinate dimension data of the target node and each neighborhood node in the matrix, ensuring that the matrix can fully reflect the spatial distribution details in the neighborhood.

[0107] Based on the constructed neighborhood coordinate matrix, the bending degree of the local space where the target node is located is analyzed; by observing the overall distribution pattern of the nodes in the neighborhood, it is determined whether the nodes are distributed along a smooth surface, whether there are local protrusions, depressions or sudden turns, etc. According to these distribution pattern characteristics, the bending characteristics of the local manifold where the target node is located are quantitatively evaluated: if the neighborhood nodes are distributed along a continuous smooth trajectory as a whole, without obvious protrusions or turns, it indicates that the local space has a low bending degree, and the corresponding bending feature value is small; if the neighborhood nodes are distributed with sudden turns, dense aggregation or dispersion fracture, etc., it indicates that the local space has a high bending degree, and the corresponding bending feature value is large.

[0108] According to the quantitative evaluation result of the bending degree of the local space, the corresponding Gaussian curvature value of each target node is calculated and output, which directly reflects the bending degree of the neighborhood space of the target node. The numerical value is positively correlated with the bending characteristics of the local space. The smoother the neighborhood distribution, the smaller the Gaussian curvature value; the more severe the bending of the neighborhood distribution or the existence of abnormal protrusions and depressions, the larger the Gaussian curvature value, which is used as a key local feature index for subsequent anomaly detection.

[0109] Step 4.3. Time window smoothing processing is performed on the Gaussian curvature value to generate a curvature change rate sequence, which specifically includes: based on the sampling frequency of the power grid data stream (such as collecting data every 5 minutes), the length of the time window (such as a window containing the last 10 sampling time points) is set to ensure that the window can cover the curvature fluctuation period under normal state and reduce transient noise interference; the Gaussian curvature values of each node are arranged in time sequence, and the sliding calculation is performed in time window units. The average value (or weighted average value, with higher weight for recent data) of the multiple curvature values in the window is taken to obtain the smoothed curvature value, which eliminates the influence of short-term random fluctuations on the curvature feature; the curvature difference of adjacent time points after smoothing is calculated, and the difference is compared with the curvature value of the previous time point to obtain the curvature change rate (i.e. the change amplitude of curvature per unit time) of each time point. All change rates are arranged in time sequence to form the curvature change rate sequence of each node. Each value in the sequence reflects the change trend of the curvature at that time point.

[0110] Step 4.4, according to the curvature rate sequence, the mutation point is detected, when the absolute value of the rate of change is greater than the second threshold, it is marked as the curvature mutation point, and specifically comprises: based on the curvature rate range of the historical normal operation data, the maximum value (such as the upper limit value of the 95% confidence interval) of the rate of change in the normal state is counted, and the value is set as the second threshold, which ensures that the rate of change of the normal fluctuation will not exceed this threshold; the rate of change sequence of each node is checked point by point, the absolute value of the rate of change at each time point is calculated, and compared with the second threshold. If the absolute value of the rate of change at a certain time point is greater than the second threshold, it indicates that the Gaussian curvature of the node has suddenly and significantly changed (such as the curvature changes from gentle to sharp bending) at this time, and then the node and the corresponding time point are marked as the curvature mutation point; for the marked curvature mutation point, the node identification, mutation time, rate of change value and threshold comparison result are recorded to form a mutation point list.

[0111] Step 4.5, map the curvature mutation point to the data entity to generate a semantic level abnormality marking set, specifically comprising: finding the specific data entity (such as the data entity of the 110kV current sensor corresponding to a certain mutation node) corresponding to each curvature mutation point through the node and data entity unique identification corresponding table bound in step 1.5, determining the type, function and belonging device of the entity; adding semantic description to the matched data entity, including the core attributes of the entity (such as device type, voltage level, data function), the context of abnormality occurrence (such as mutation time, link, associated device), abnormality characteristics (such as the spatial distribution change corresponding to the curvature mutation, the associated relationship conflicting with the direction); integrating the data entity identification, semantic attribute, mutation point information (time, position, rate of change) into a structured mark, storing according to the abnormality severity or entity type to form a semantic level abnormality marking set, which not only contains the position information of the abnormal entity, but also clearly shows the type and characteristics of the abnormality through semantic description.

[0112] In the embodiment of the application, the target node is first screened through the direction conflict marking, the analysis range is reduced, and then the neighborhood is delineated in combination with the topological association relationship, so as to ensure that the abnormality analysis focuses on the key node and the local space around it, and to reduce invalid calculation; the bending degree of the node neighborhood space is quantified through the Gaussian curvature, and the subtle abnormalities (such as convexity and turning) of the node distribution are captured, thereby breaking through the limitations of traditional topological analysis and improving the description accuracy of local space characteristics; the time window smoothing processing effectively filters transient fluctuations, so that the curvature rate sequence is more consistent with the real trend, and the risk of misjudgment is reduced; the curvature mutation point is detected based on the second threshold, which can quickly identify the significant change of the curvature, and realize early warning of the abnormality.

[0113] In a preferred embodiment of the application, step 5, based on the semantic level abnormality marking set, a geodesic abnormality propagation model is constructed along the hierarchical graph topology, comprising:

[0114] Step 5.1, based on the semantic level anomaly marking set, locate the abnormal source node in the hierarchical dynamic knowledge graph, specifically including: according to the semantic level anomaly marking set output in step 4.5, the marking set contains the node identification of abnormal data entity, mutation time, abnormal feature and other information; extract all node unique identifiers (such as NodeID, cluster identifier) marked as curvature mutation point from the marking set, and sort them by mutation time in chronological order, and preferentially select the node with the earliest curvature mutation, which is preliminarily determined as the potential abnormal source node.

[0115] Then, the topological position of these potential abnormal source nodes in the hierarchical dynamic knowledge graph is checked, and the topological level (such as Level-1 core layer, Level-2 transmission layer) and the connection state of the surrounding direct associated nodes are confirmed through the hierarchical structure information of the graph; combined with the abnormal context in the semantic description (such as the link and associated device), the secondary mutation nodes caused by the abnormal propagation of other nodes are excluded, and the node that appears earliest in time and has no pre-abnormal association is finally determined as the abnormal source node, and its precise topological coordinates and association relationship in the graph are recorded.

[0116] Step 5.2, taking the abnormal source node as the starting point, calculating the geodesic distance to each sub-node along the graph topology, specifically including: determining the starting point of the calculation as the abnormal source node located in step 5.1; starting from the abnormal source node, comprehensively traversing the topological structure of the hierarchical dynamic knowledge graph, checking the node connection relationship recorded in the graph one by one; in this process, the nodes directly connected with the abnormal source node are accurately identified, including parent nodes (associated nodes with higher level than the source node) and child nodes (associated nodes with lower level than the source node); at the same time, the nodes indirectly associated through 1-2 topological links are sorted out, i.e. the nodes that need to pass through 1 or 2 intermediate nodes to establish connection with the source node, so as to clearly define the range of all possible associated nodes.

[0117] Then, based on the topological association information recorded in the graph, filter the effective propagation path; focus on viewing the connection weight value and link type description of each node link, compare the connection weight with the preset propagation threshold; only the link with connection weight greater than or equal to the propagation threshold is recognized as an effective link with actual data interaction or logical association; for the link with connection weight less than the propagation threshold, since its association strength is weak, it is determined to have no actual propagation significance, and it is excluded from the calculation range, ensuring that the subsequent path calculation is only carried out around the effective link.

[0118] Then, for each sub-node that can be reached through the effective link (i.e. the node that the abnormal source node can propagate to), the geodesic distance from the abnormal source node to the sub-node is calculated; if there are multiple effective propagation paths from the source node to the target sub-node, the characteristics of each path need to be analyzed and compared: on the one hand, the number of links contained in each path is counted to measure the total link length of the path; on the other hand, the cumulative connection weight of each path is calculated, which is the sum of the connection weights of all links in the path, the higher the cumulative weight, the higher the propagation priority of the path; by combining the two indicators of total link length and cumulative connection weight, the path with the shortest total link length and the highest cumulative connection weight is selected, and the path is determined as the shortest and most likely propagation path, and the total link length is the geodesic distance corresponding to the sub-node.

[0119] For cross-level sub-nodes at different levels in the hierarchical structure, the calculation process needs to be further refined: first, the path length of the abnormal source node to the boundary node of the level is calculated separately; then the length of the cross-level link is calculated, which is the link length from the boundary node to the corresponding node in the target sub-node's level; finally, the two lengths are added together to get the complete geodesic distance from the abnormal source node to the cross-level sub-node; finally, detailed records are established for each sub-node, including the unique identification of the sub-node, the corresponding geodesic distance value, and the path composition information that constitutes the distance, i.e. the order of all nodes and link information in the path, ensuring that the geodesic distance of each sub-node can be traced back to its calculation basis.

[0120] Step 5.3, according to the geodesic distance, construct the abnormal propagation probability density field, specifically including: based on the geodesic distance between each sub-node and the abnormal source node calculated in step 5.2, formulate the attenuation rule of abnormal propagation probability; determine the correlation between distance and probability, the closer the sub-node to the abnormal source node, the higher the probability of abnormal propagation to the node, and the larger the corresponding propagation probability value; as the geodesic distance between the sub-node and the source node gradually increases, the propagation probability decreases in a gradient manner; for example, when the distance increases by one preset unit length, the propagation probability is adjusted by a fixed percentage (such as 10% per unit distance), ensuring that the influence of distance on propagation probability presents a continuous and regular attenuation trend.

[0121] Next, the propagation probability calculated based on the distance is adjusted in combination with the topological correlation strength between nodes in the layered dynamic knowledge graph; by checking the node connection weight data recorded in the graph, the sub-nodes with large connection weights to the abnormal source node are identified, and such nodes are usually key nodes in the core link. In the case of the same distance to other nodes, they are given a higher propagation probability to reflect their importance in topological correlation; for weakly correlated nodes with low connection weights, even if the distance to the source node is the same, their propagation probability value is appropriately reduced to make the probability distribution more in line with the actual topological correlation strength.

[0122] Then, a specific propagation probability value is assigned to each node in the topological space of the knowledge graph; for nodes within the same level, the corresponding probability value is calculated and assigned according to the distance decay rule and correlation strength adjustment standard based on the geodesic distance to the abnormal source node and the connection weight between nodes, ensuring that the probability distribution within the same level presents a uniform transition feature and avoids abrupt probability fluctuations; for nodes across levels, in addition to considering the distance and correlation strength within their own level, the propagation efficiency factor between levels also needs to be adjusted, such as the existence of certain propagation loss in the jump between different levels. The probability gradient is corrected according to the preset level jump loss coefficient, so that the probability value of the cross-level node can reflect both the influence of the distance and the weakening effect of the level jump on the propagation.

[0123] Finally, the propagation probability values of all nodes are integrated into the topological space of the knowledge graph to form a continuous probability distribution area covering the entire graph. Through such distribution, the propagation possibility of the anomaly at different node positions can be intuitively presented: the area with high probability value indicates that the anomaly is more likely to propagate to that position, and the area with low probability value indicates that the propagation possibility is low. The finally constructed abnormal propagation probability density field completely reflects the propagation probability distribution characteristics of the anomaly in the entire knowledge graph topology after starting from the source node.

[0124] Step 5.4, generate key propagation paths connected by equipotential lines through the propagation probability density field, specifically including: determining a preset key threshold in the constructed abnormal propagation probability density field, which is used to define the core range where the anomaly is most likely to propagate; traverse all nodes in the probability density field and filter out nodes with a propagation probability density value higher than the key threshold, which together constitute the core area of abnormal propagation; then, classify the nodes in the filtered core area according to the principle of equal or approximate probability density values, compare the probability density values of the nodes in the area one by one, and group the nodes with the same or within a preset small range of values. Then, connect the nodes in each group in sequence through lines to form multiple closed or continuous equipotential lines, and all nodes on each equipotential line have the same or similar abnormal propagation possibility, which intuitively presents the distribution rule of the probability density.

[0125] After that, along the extension direction of each equipotential line, the propagation path starting from the abnormal source node is tracked in combination with the topological connection relationship of the layered dynamic knowledge graph. The distribution characteristics of the equipotential line are observed, and the area with dense equipotential line distribution is preferentially selected because the probability density changes rapidly in this area, indicating that the abnormal propagation trend is more significant. At the same time, it is checked whether the topological link in this direction is continuous to ensure that there is an effective connection relationship between the nodes on the path (such as the connection weight meeting the propagation requirements). In the tracking process, the key nodes in the path are marked, including the intersection points between equipotential lines (connection points of nodes with different probability levels) and level conversion nodes (transition nodes for cross-level propagation), which are important turning points of the propagation path.

[0126] Then, the propagation path obtained by preliminary tracking is verified, and the propagation probability cumulative value of all nodes on each path is calculated, that is, the sum of the probability density values of the nodes in the path. At the same time, the topological integrity of the path is checked to confirm that there is no link breakage or invalid connection in the path (such as the connection weight of a certain link being lower than the propagation threshold), and the path with the highest cumulative propagation probability value and complete topological structure without breakage is retained. For the path with low cumulative probability value, link breakage, or missing key nodes, it is determined as a non-key path and removed.

[0127] Finally, all the verified paths are integrated to form a set of key propagation paths connected by equipotential lines. Detailed annotations are added to each path, and the starting point of the annotated path is determined as the abnormal source node. All nodes on the path are listed in the order of propagation, including the types and positions of key nodes. The end point of the path (usually the node at the edge of the core area) is marked. At the same time, the probability density value change of each node on the path is recorded to clearly present the probability decay or fluctuation trend from the abnormal source to the end point. The finally generated key propagation path set fully reflects the main propagation direction and path characteristics of the anomaly in the core area.

[0128] Step 5.5, integrate the key propagation paths to construct the geodesic abnormal propagation model, specifically including: summarizing all the key propagation paths generated in step 5.4, and comprehensively analyzing the correlation between these paths; checking the node composition of each path one by one to identify the branch points in the path, that is, the nodes that extend two or more different propagation direction paths from the same node; at the same time, mark the intersection points, that is, the nodes that are passed through by two or more different paths; by comparing the starting points, passing nodes and end points of each path, the propagation direction of each path is determined, such as from the core layer node to the edge layer node of the knowledge graph, or from the main link node to the branch link node, so as to clarify the mutual correlation and distribution characteristics between the paths.

[0129] Next, all key propagation paths are classified according to the hierarchy to which they belong in the hierarchical dynamic knowledge graph. According to the main distribution of nodes in the hierarchy (such as core layer, transmission layer, and edge layer), the paths are divided into corresponding hierarchical categories, and the propagation characteristics of the paths in each hierarchy are analyzed. For example, core layer paths usually have a high propagation speed due to the close association of nodes and high link weights. Edge layer paths may have a slower propagation speed due to the dispersed distribution of nodes and lower link weights. In addition, in cross-hierarchy paths, the propagation interface nodes responsible for connecting different hierarchies are marked. These nodes are key transition nodes for the abnormal transfer from one hierarchy to another, and their positions and connection relationships in the hierarchy structure need to be clearly recorded.

[0130] Then, the specific location information of the abnormal source node, the geodesic distance data of each node calculated in step 5.2, the distribution of the propagation probability density field constructed in step 5.3, and the key propagation path information determined in step 5.4 are integrated to form the basic structure of the geodesic abnormal propagation model. The model clearly includes the following core elements: the initial propagation intensity of the abnormal source node, which is the propagation energy of the anomaly from the source node; the propagation efficiency of each key propagation path, which quantifies the propagation speed and stability of the path based on the connection weight of the link and the hierarchy characteristics; the influence range of key nodes in the path (such as branch points, intersection points, and interface nodes), which is the coverage range of each key node that can propagate anomalies to surrounding nodes; and the probability decay law, which is the specific decay trend of the probability density with distance and hierarchy in the abnormal propagation process.

[0131] Finally, by integrating all the above information, a complete geodesic abnormal propagation model is constructed. This model can intuitively describe the propagation process of anomalies from the source node along the key propagation paths in the topology structure of the knowledge graph: including the propagation speed difference in different hierarchies, the cross-hierarchy transfer through interface nodes, the propagation direction change at branch points and intersection points, and the real-time change trend of the propagation probability density. The model finally presents the starting point (abnormal source), passing nodes, and end point of all key propagation paths, as well as the corresponding propagation characteristics, in a clear structure.

[0132] In the embodiment of the present application, by sorting and topological correlation checking according to the mutation time, the earliest abnormal source node without pre-association can be accurately locked, and the secondary abnormal node is avoided to be misjudged as the source; based on the topological correlation, the effective link is screened, the shortest propagation path is determined by combining the path length and the connection weight, the distance is calculated by stages across the hierarchical nodes, and the geodetic distance is ensured to accurately reflect the actual path cost of abnormal propagation; by double adjustment of the distance attenuation rule and the topological correlation strength, combined with the hierarchical propagation efficiency correction, the probability density field constructed can truly reflect the propagation possibility of the anomaly at different nodes and different levels, and avoid the probability deviation caused by a single factor; by screening the core area through the equipotential line, tracking the high-probability continuous link and verifying the path integrity, the finally generated key propagation path set can accurately capture the main direction of abnormal diffusion, eliminate invalid path interference and improve the propagation analysis efficiency.

[0133] In a preferred embodiment of the present application, step 6, the geodetic line abnormal propagation model is used to lock the problem link coordinate sequence by using the gradient descent backtracking algorithm, including:

[0134] Step 6.1, based on the geodetic line abnormal propagation model, the gradient descent energy function is initialized, specifically including: based on the geodetic line abnormal propagation model constructed in step 5, the core role of the gradient descent energy function is determined: quantifying the abnormal energy of the node in the abnormal propagation process, the higher the energy value, the more significant the node is affected by the anomaly, and the lower the energy value, the closer to the problem root.

[0135] The key parameters are extracted from the model as input variables of the energy function, including the geodetic distance of each node (the closer to the abnormal source, the higher the initial energy basic value), the propagation probability density (the higher the probability, the greater the energy weight), the node correlation strength (the node with greater connection weight has higher energy transfer coefficient) and the hierarchical propagation efficiency (the cross-level node needs to be included in the hierarchical loss coefficient).

[0136] The initial form of the energy function is set: based on the abnormal propagation probability density of the node, the reciprocal of the geodetic distance (the closer the distance, the greater the reciprocal) and the correlation strength coefficient are combined for weighted calculation to obtain the initial energy value of each node; at the same time, the constraint conditions of the energy function are clarified, such as the energy value needs to be in the interval of 0-1 (0 represents no abnormal energy, and 1 represents the highest abnormal energy), to ensure that the function output conforms to the actual physical meaning; finally, the initialization of the energy function is completed, so that it can output the energy value reflecting the abnormal influence degree of the node through the input topological characteristics and propagation properties of the node.

[0137] The formula of the energy function can be: E=P×1 / D×W×L;

[0138] Wherein, E represents the abnormal energy value of the node (the value range is 0≤E≤1); P represents the abnormal propagation probability density of the node, which is derived from the abnormal propagation probability density field constructed in step 5.3, is the core parameter reflecting the possibility of the node being affected by abnormal propagation, and the value range is 0≤P≤1, the higher the value, the greater the possibility of the node being affected in abnormal propagation (such as the P value of the core link node is usually higher than that of the edge node); D represents the geodesic distance of the node to the abnormal source, which is derived from the geodesic distance calculated in step 5.2, is the length of the shortest propagation path between the node and the abnormal source node (which can be understood as the physical distance quantitative value in the topological path), the greater D represents the farther the node is from the abnormal source, and 1 / D decreases with the increase of distance, which embodies the rule that the closer the distance, the higher the abnormal energy basic value; W represents the node association strength coefficient, which is determined based on the connection weight between nodes in the hierarchical dynamic knowledge graph, and reflects the topological association tightness between the current node and the adjacent node, the node with large connection weight (such as core link node, key interface node) W value is higher (usually 0<W≤1.2), and the weakly associated node W value is lower (usually 0.5≤W<1), which is used to correct the different energy transfer efficiencies caused by the difference in association strength; L represents the level propagation efficiency coefficient, which is used to correct the energy loss of cross-level propagation, and the value is related to whether the node crosses the level, if the node and the abnormal source are in the same level, L=1 (no level loss); if the node is a cross-level node (needs to propagate through the level interface node), L takes the value of 0.7 to 0.9 (the specific value is preset according to the level jump loss, the greater the level span, the lower the L value), which embodies the energy attenuation characteristics in cross-level propagation.

[0139] Step 6.2, calculate the energy gradient value of each node along the propagation path by the energy function, specifically including: selecting all the key propagation paths generated in step 5.4 as the calculation range, ensuring that the gradient calculation focuses on the main channel of abnormal propagation; numbering the nodes on each path in the order of propagation (from the direction of the abnormal source extending outward), and determining the adjacent nodes (i.e. the upstream and downstream nodes directly connected in the path) of each node; using the energy function initialized in step 6.1, calculate the energy values of the current node and its adjacent nodes respectively; for each node in the path, subtract the energy value of the upstream node from the current node (forward gradient, reflecting the energy change in the direction of abnormal propagation), and calculate the energy difference between the current node and the downstream node (backward gradient, providing direction basis for backtracking search), the size of the gradient value represents the rate of energy change, a positive value indicates that the energy rises in that direction, and a negative value indicates that the energy decreases; the larger the absolute value of the gradient, the more intense the energy change; for the nodes in the cross-level path, additional layer propagation efficiency coefficient is included in the calculation of the gradient to correct the energy loss caused by layer jumping, ensuring that the gradient value can accurately reflect the actual energy change between cross-level nodes, and finally assigning each node on each key propagation path with a corresponding energy gradient value to form a gradient distribution map.

[0140] Step 6.3, according to the energy gradient value, iteratively perform backtracking search, select adjacent nodes in the gradient descent direction, update the current node to the local energy minimum point, and output the minimum energy node set when the convergence condition is reached, specifically including: selecting the endpoints of the key propagation paths in step 5.4 (i.e. the most marginal nodes of abnormal propagation) as the initial search nodes, these nodes are usually the end of abnormal influence, and the energy value is at a relatively high level; based on the energy gradient value calculated in step 6.2, among the adjacent nodes of the current node, select the nodes with negative gradient (i.e. the nodes in the gradient descent direction, with energy value lower than the current node), and select the node with the largest absolute value of gradient (the direction with the fastest energy drop) as the next search node, complete the update of the current node, and take the newly updated node as the current node, and again find the nodes in the gradient descent direction (nodes with lower energy) among its adjacent nodes, continue to select the next node according to the principle of the largest absolute value of gradient, and gradually backtrack to the direction with lower energy; in each iteration, record the energy value of the current node, when the energy value difference of two consecutive iterations is less than a preset threshold (such as energy change less than 0.01), determine that the node is a local energy minimum point (i.e. the node with the lowest energy in the local range), and stop the iteration in that branch; perform the above backtracking search on the endpoints of all key propagation paths, collect all found local energy minimum points, remove duplicate nodes (if different paths backtrack to the same minimum point), and finally form the minimum energy node set.

[0141] Step 6.4, mapping the minimum energy node set to the blood link, locking the problem link coordinate sequence, specifically including: determining the definition of the blood link, that is, the causal link between nodes recorded in the knowledge graph, including the physical location coordinates of the nodes (such as device installation location, network topology coordinates), logical association relationship (such as upstream and downstream relationship of data transmission, transmission link of control instruction) and time sequence association (such as trigger and triggered relationship of node anomaly); match the minimum energy node set output in step 6.3 with the blood link, locate the specific position of each minimum energy node in the blood link through the node unique identifier (such as NodeID), extract its physical coordinates, link level and sequence number in the link; analyze the association relationship of the minimum energy node in the blood link, check whether there is a direct causal connection between the nodes (such as the anomaly of A node directly causing the anomaly of B node), sort the nodes according to the time sequence and logical dependence, and form a preliminary coordinate sequence; ensure that the sorted node sequence can completely reflect the propagation logic of the anomaly from the root to the end, that is, the anomaly of the previous node can directly trigger the anomaly of the next node through the blood link; if there is a break (a node cannot be associated with the next node through the blood link), return to step 6.3 to recheck the backtracking process and supplement the missing key nodes; list the physical coordinates of each node, the position in the blood link and the corresponding abnormal energy value in sequence, clearly present the path of the problem from the root node to each link, and provide accurate coordinate basis for locating the specific fault point.

[0142] In the embodiment of the application, the energy function integrates the geodesic distance, propagation probability, association strength and level efficiency, etc. The node anomaly influence is converted into a quantifiable energy value, which provides objective numerical basis for anomaly tracing, and avoids subjective judgment deviation; the energy gradient calculation focuses on the key propagation path, accurately captures the energy change trend through forward and reverse gradient values, reduces blind search, and improves backtracking efficiency; the iterative backtracking algorithm based on gradient descent preferentially selects the path with the fastest energy decline, accurately identifies the local energy minimum point (the node closest to the problem root) through the convergence condition, and ensures that the selected minimum energy node set has clear fault directionality; the minimum energy node set is mapped to the blood link, and the coordinate sequence is generated according to the cause-effect relationship and time sequence, and the propagation path of the anomaly from the root to the end is completely presented; the integrity of the cause-effect connection between the nodes is verified, and the missing nodes are supplemented in time to avoid the interruption of the tracing caused by the broken link, and ensure that the output problem link coordinate sequence completely reflects the anomaly propagation logic, greatly improving the accuracy and reliability of fault location.

[0143] In a preferred embodiment of the application, step 7, according to the locked problem link coordinate sequence, associate the multi-dimensional environmental factors in the historical work order to obtain a multi-dimensional environmental factor association graph, including:

[0144] Step 7.1, according to the problem link coordinate sequence locked in step 6.5, extract the space-time position feature vector, specifically including: from the problem link coordinate sequence locked in step 6.4, extract the physical position information of each problem node: including the latitude and longitude coordinates of the node (outdoor equipment) or the local coordinate system position in the substation (equipment in the substation), the hierarchical number in the hierarchical knowledge graph and the cluster identifier, and the spatial distribution characteristics of the node; Then, extract the time characteristics of the occurrence of each node anomaly: record the time stamp (accurate to the minute) when the anomaly is first detected, the time period (such as the early morning peak period, the night period) and the time interval with the same type of historical anomaly, and the time dimension characteristics; Then, the spatial characteristics (physical coordinates, hierarchical position) and time characteristics (time stamp, time period label) are structured and integrated: the spatial characteristics are converted into numerical coordinate components, and the time characteristics are converted into time series encoding (such as the time period corresponding to the normalized value of 0-1), and finally a multi-dimensional space-time position feature vector containing spatial dimensions (such as latitude, longitude, level) and time dimensions (such as time stamp, time period) is formed. Each vector uniquely corresponds to a node in the problem link.

[0145] Step 7.2, input the space-time position feature vector into the index engine of the historical work order knowledge base to retrieve the associated environmental factors to obtain the retrieval result, specifically including: input the space-time position feature vector generated in step 7.1 as the retrieval keyword into the index engine of the historical work order knowledge base. The index engine has pre-established a mapping relationship between the work order and the space-time characteristics, supporting retrieval according to the spatial range (such as within 5 kilometers of a certain latitude and longitude) and the time range (such as within 24 hours before and after the occurrence of the anomaly); Then, set the retrieval threshold, spatially, retrieve historical work orders within a pre-set range (such as 3 kilometers) from the physical location of the problem node; Temporally, retrieve work orders within a pre-set time period (such as 48 hours) from the occurrence time of the anomaly, to ensure that work orders with close space-time correlation are retrieved; Then, extract multi-dimensional environmental factors from the retrieved historical work orders, including meteorological factors (such as temperature, humidity, rainfall, wind force level), equipment operating environment factors (such as equipment load rate, heat dissipation state, installation altitude), external interference factors (such as construction influence, lightning record) and environmental hazard factors (such as vegetation coverage, pollution level), forming a preliminary environmental factor list, removing duplicate or irrelevant factors (such as environmental records unrelated to power equipment).

[0146] Step 7.3, based on the search results, construct the environmental factor tensor, specifically including: classifying the environmental factors retrieved in step 7.2: dividing by factor type into meteorological, equipment state, geographic, interference, etc. dimensions, each dimension containing specific sub-factors (such as temperature, humidity in meteorological class); then, adding time labels and space labels to each dimension of environmental factors, the time label corresponds to the time stamp of the factor occurrence (the time difference with the problem node abnormal time), the space label corresponds to the position coordinates of the factor occurrence (the spatial distance with the problem node); then, construct a three-dimensional tensor structure, the first dimension is the environmental factor type (such as meteorology, equipment state), the second dimension is the time dimension (time difference sequence), the third dimension is the space dimension (spatial distance sequence), each element in the tensor records the specific value of the environmental factor under the corresponding type, time and space (such as temperature 25℃, humidity 60%), ensuring that the tensor completely contains the type, space-time distribution and quantitative value of the environmental factor.

[0147] Step 7.4, calculate the space-time correlation weight matrix with the problem node through the environmental factor tensor, specifically including: defining the calculation basis of correlation weight, including space-time overlap (coincidence rate of environmental factor occurrence time and problem node abnormal time, distance inverse of spatial position) and historical influence frequency (the number of times that this environmental factor causes similar abnormalities in historical work orders); then, quantify the correlation strength of each environmental factor with the problem node, the higher the space-time overlap (such as time difference <1 hour, spatial distance <1 km), the higher the weight base value; the higher the historical influence frequency (such as the probability of a certain temperature range causing similar abnormalities >30%), the greater the weight correction coefficient, the correlation weight of a single environmental factor and a single problem node is calculated by weighting the two; then, construct a matrix, the rows of the matrix represent the nodes in the problem node, the columns represent the environmental factor types, and the numerical value in each cell of the matrix is the correlation weight of the corresponding node and environmental factor, the weight value range is 0-1 (1 represents the strongest correlation), forming a space-time correlation weight matrix, which intuitively presents the influence strength of environmental factors on each problem node.

[0148] Step 7.5, integrating the spatio-temporal correlation weight matrix, outputting a multi-dimensional environmental factor correlation graph, specifically including: taking the spatio-temporal correlation weight matrix of step 7.4 as the core, taking the nodes (problem link nodes) and environmental factors in the matrix as the core nodes of the graph, and labeling the node attributes of the problem nodes with physical coordinates, environmental factor types and quantitative values; then, according to the weight values in the weight matrix, edges between nodes are drawn, and the thickness of the edges corresponds to the weight (the higher the weight, the thicker the edge), and the color of the edge labels the correlation type (such as red for meteorological factor correlation and blue for device state factor correlation); then, key correlation information is labeled, and strong correlation pairs with a weight greater than a preset threshold (such as 0.6) are highlighted in the graph, and specific impact descriptions of environmental factors (such as an increase of 20% in the abnormal probability of node A when the temperature is greater than 35°C) and historical case references (such as 3 similar abnormalities occurred in the same environment in 2023) are labeled, and finally a complete multi-dimensional environmental factor correlation graph is formed, clearly showing the spatio-temporal correlation strength, influence direction and historical basis of the problem link nodes and various environmental factors.

[0149] In the embodiments of the present application, through spatio-temporal feature vector retrieval and weight calculation, accurate matching of problem links and historical environmental factors is achieved, irrelevant environmental factors are avoided, and key environmental factors that may actually cause abnormalities are focused on; the spatio-temporal correlation weight matrix converts the influence of environmental factors into quantifiable weight values, and clearly shows the influence of each factor on different problem nodes; the multi-dimensional environmental factor correlation graph intuitively displays the correlation network between environmental factors and problem links, and clearly presents the correlation type and strength through the thickness and color of the nodes and edges, facilitating the quick understanding of the environmental influence mechanism by operation and maintenance personnel.

[0150] In a preferred embodiment of the present application, step 8, based on the multi-dimensional environmental factor correlation graph, a hierarchical early warning strategy is dynamically generated, including:

[0151] Step 8.1, obtaining the spatio-temporal correlation weight matrix in the multi-dimensional environmental factor correlation graph, extracting the correlation strength values of each environmental factor and problem link, specifically including: from the multi-dimensional environmental factor correlation graph generated in step 7.5, calling the spatio-temporal correlation weight matrix constructed in step 7.4, the rows of the matrix correspond to each node in the problem link coordinate sequence (i.e. the locked abnormal related nodes), and the columns correspond to each type of environmental factor (such as meteorological factors, device operating environment factors, external interference factors, etc.); then, read the numerical values in each cell in the matrix row by row and column by column, these numerical values are the correlation strength values of the corresponding environmental factors and the corresponding problem nodes; for example, the numerical value 0.75 at the intersection of the temperature factor column and the node A row indicates that the correlation strength of the temperature factor and node A is 0.75; finally, the strength values are classified and arranged according to the environmental factor types to form an environmental factor and strength value table, ensuring that the correlation strength values of each environmental factor (such as temperature, humidity, wind power, device load rate, etc.) are completely extracted and clearly correspond to specific problem link nodes.

[0152] Step 8.2, according to the correlation strength value, calculate the influence weight of each environmental factor on the propagation of the anomaly, specifically including: for each environmental factor, aggregate its correlation strength value with all problem link nodes; for example, the correlation strength of the temperature factor with node A, node B, and node C is 0.75, 0.6, and 0.5 respectively, then the aggregated strength value set of this factor is [0.75, 0.6, 0.5]; next, calculate the average correlation strength of this environmental factor, which is the arithmetic mean of the above set, as the basic influence weight; then, combine the influence frequency of this environmental factor in historical work orders for correction, if the number of times this factor causes similar anomalies in historical data accounts for 30%, then multiply the basic influence weight by a correction coefficient (such as a coefficient of 1.2 corresponding to 30%), to get the final influence weight (such as 0.62 x 1.2 ≈ 0.74); finally, repeat the above process for all environmental factors to ensure that each environmental factor has a corresponding influence weight reflecting its actual influence on the propagation of the anomaly.

[0153] Step 8.3, based on the influence weight, fuse the historical warning level configuration parameters to generate a multi-dimensional warning score, specifically including: retrieve historical warning level configuration parameters, these parameters include risk benchmark values of different environmental factors (such as a benchmark risk value when the temperature exceeds 35°C), historical warning score standards for similar anomalies (such as a factor influence weight of 0.7 corresponding to a historical score of 80 points), etc.; next, compare the influence weight of each environmental factor calculated in step 8.2 with the corresponding historical benchmark value, if the influence weight of a certain environmental factor is 0.74 and the benchmark score corresponding to this weight interval in history is 75 points, then initially assign this factor 75 points; then, adjust the score based on the real-time change trend of the environmental factor, if the environmental factor (such as temperature) is continuously rising (real-time trend is rising), then increase the benchmark score by 10% (such as 75 + 7.5 = 82.5 points); if the trend is stable, then maintain the benchmark score; if the trend is downward, then appropriately reduce the score; finally, aggregate the scores of all environmental factors and take the weighted average (weight is the proportion of each factor's influence weight) to get the multi-dimensional warning comprehensive score.

[0154] Step 8.4, dynamically divide the early warning level by comparing the multi-dimensional early warning score with the preset grading threshold, specifically including: preset grading threshold of early warning level, for example: emergency early warning corresponds to score ≥ 90 points, important early warning corresponds to 70 points ≤ score < 90 points, general early warning corresponds to 50 points ≤ score < 70 points, low risk early warning corresponds to score < 50 points (threshold can be adjusted according to the actual operation and maintenance demand of power grid); then, compare the multi-dimensional early warning comprehensive score generated in step 8.3 with the above threshold, for example, if the comprehensive score is 85 points, it falls in the interval of 70 points ≤ score < 90 points; then, combined with the importance of the problem link, secondary verification is carried out, if the problem link involves core equipment (such as main transformer), even if the score is in a certain level interval, it can be adjusted upward by one level (such as 85 points originally as important early warning, adjusted to emergency early warning); if it involves edge equipment, the original level is maintained; finally, according to the verification result, the final early warning level is determined, for example, the above case is determined as important early warning after verification.

[0155] Step 8.5, according to the early warning level, match the preset emergency plan template library, output the graded early warning strategy, specifically including: according to the early warning level determined in step 8.4, search the preset emergency plan template library, the template library is classified according to the early warning level, contains the contents such as processing flow, resource scheduling scheme, responsible department corresponding to different levels (such as emergency early warning template contains the flow of on-site dispatching within 1 hour, temporary shutdown of equipment inspection, etc.); then, combine the template corresponding to the early warning level with the specific scene, extract the key information in the multi-dimensional environmental factor correlation graph (such as the main environmental factor leading to early warning is high temperature, and the problem node is 110kV current sensor), fill these information into the corresponding position of the template, and execute the following strategy for the abnormality of 110kV current sensor in high temperature environment; then, supplement the historical case reference, retrieve the processing records of the same type of abnormality caused by the same type of environmental factor from the historical work order (such as in 2023, when the same type of sensor was abnormal in high temperature weather, it was restored to normal by strengthening the heat dissipation measures), as the auxiliary basis of the strategy; finally, integrate to form a complete graded early warning strategy, including early warning level, influencing factor, problem node, processing step, responsible department, resource allocation list and historical reference case, to ensure that the operation and maintenance personnel can directly execute the operation according to the strategy.

[0156] In the embodiment of the application, the correlation strength is accurately extracted, the correlation degree between environmental factors and problem nodes is clearly defined through the space-time correlation weight matrix; the influence weight is calculated, the average correlation strength is combined with the historical influence frequency correction, the actual effect of environmental factors on abnormal propagation is objectively reflected, the accuracy and rationality of the weight are improved; when generating multi-dimensional early warning score, historical parameters and real-time trend are fused, the score is more suitable for the current actual situation, the dynamic adaptability of early warning is enhanced, the early warning level is dynamically divided, the importance of the problem link is verified, the accuracy of level division is ensured, and the actual operation and maintenance demand of power grid is met, and level misjudgment is avoided.

[0157] An electric power data blood relationship abnormality intelligent early warning system based on a knowledge graph comprises:

[0158] A construction module is configured to map data entities into high-dimensional point clouds based on the metadata of the electric power data blood relationship links and spatial embedding; the high-dimensional point clouds are fused with device topology relationships to construct a hierarchical dynamic knowledge graph;

[0159] A verification module is configured to use the hierarchical dynamic knowledge graph to analyze the consistency of normal vector fields and verify the cross-link data flow logic in real time, and output a verification result with directional features;

[0160] A marking module is configured to identify abnormal data entities by a manifold curvature mutation detection algorithm according to the verification result with directional features, and generate a semantic-level abnormality marking set;

[0161] A processing module is configured to construct a geodesic abnormality propagation model along the topology of the hierarchical graph based on the semantic-level abnormality marking set; and lock a problem link coordinate sequence by using a gradient descent backtracking algorithm based on the geodesic abnormality propagation model;

[0162] An early warning module is configured to correlate multi-dimensional environmental factors in historical work orders according to the locked problem link coordinate sequence to obtain a multi-dimensional environmental factor correlation graph; and dynamically generate a hierarchical early warning strategy based on the multi-dimensional environmental factor correlation graph.

Claims

1. A knowledge graph-based intelligent early warning method for abnormal lineage in power data, characterized in that, The method includes: Based on the metadata of the power data lineage, spatial embedding maps data entities into high-dimensional point clouds, including: parsing the metadata of the power data lineage, extracting the type identifier of the data entity, the spatial coordinates of the processing node, and the direction vector of the transmission path; inputting the type identifier of the data entity into a pre-trained entity encoder to generate an entity feature vector of dimension d; performing spherical coordinate system transformation on the spatial coordinates of the processing node and the direction vector of the transmission path to calculate the longitude and latitude angles; concatenating the entity feature vector with the longitude and latitude angles using tensors to form a three-dimensional spatial extension vector; and generating a high-dimensional point cloud coordinate set based on the three-dimensional spatial extension vector. This paper describes a hierarchical dynamic knowledge graph constructed by fusing high-dimensional point clouds with equipment topology relationships. The process includes: acquiring the topology relationships of power equipment and generating a connection weight matrix between equipment entities; performing tensor fusion of the high-dimensional point cloud coordinate set and the connection weight matrix to generate an equipment-data association tensor; calculating the similarity matrix between equipment clusters and data point cloud clusters based on the equipment-data association tensor; performing agglomerative hierarchical clustering through the similarity matrix, iteratively merging the adjacent clusters with the highest similarity to generate a cluster merging sequence; and constructing a hierarchical dynamic knowledge graph based on the cluster merging sequence. By utilizing a hierarchical dynamic knowledge graph, a normal vector field consistency analysis is used to verify cross-link data flow logic in real time, and the verification results with directional features are output. Based on the verification results of directional features, abnormal data entities are identified through the manifold curvature mutation detection algorithm, and a semantic-level anomaly tag set is generated; Based on a semantic-level anomaly tag set, a geodesic anomaly propagation model is constructed along the hierarchical graph topology. By using the geodesic anomaly propagation model and the gradient descent backtracking algorithm, the coordinate sequence of the problem link can be identified. Based on the coordinate sequence of the identified problem links, multi-dimensional environmental factors in historical work orders are correlated to obtain a multi-dimensional environmental factor correlation map. Based on the multidimensional environmental factor correlation map, a hierarchical early warning strategy is dynamically generated.

2. The intelligent early warning method for abnormal lineage of power data based on knowledge graphs according to claim 1, characterized in that, By utilizing a hierarchical dynamic knowledge graph, normal vector field consistency analysis is employed to verify cross-link data flow logic in real time, outputting verification results with directional features, including: Extracting spatial trajectory tangent vectors of cross-link data flows from a hierarchical dynamic knowledge graph; Based on the spatial trajectory tangent vector, calculate the theoretical normal vector field of each map node; The actual tangent vector and the theoretical normal vector are multiplied by a vector dot product to generate a directional consistency coefficient. Threshold verification is performed based on the directional consistency coefficient. If the directional consistency coefficient is less than the first threshold, then it is marked as a directional conflict. Integrate directional conflict markers and output verification results with directional features.

3. The intelligent early warning method for abnormal lineage of power data based on knowledge graphs according to claim 2, characterized in that, Based on the verification results of directional features, anomalous data entities are identified using a manifold curvature mutation detection algorithm, generating a semantic-level anomaly tag set, including: Based on the verification results of the directional features, extract the coordinate set of the map nodes corresponding to the directional conflict markers; Based on the coordinate set of the graph nodes, calculate the Gaussian curvature value in the neighborhood of each node; The Gaussian curvature values ​​are smoothed using a time window to generate a curvature change rate sequence. Based on the curvature change rate sequence, abrupt change points are detected, and when the absolute value of the change rate is greater than the second threshold, it is marked as a curvature abrupt change point; Map the curvature mutation points to data entities to generate a semantic-level anomaly marker set.

4. The intelligent early warning method for abnormal lineage of power data based on knowledge graphs according to claim 3, characterized in that, Based on the semantic-level anomaly marker set, construct a geodesic anomaly propagation model along the hierarchical graph topology, including: Based on the semantic-level anomaly marker set, locate the anomaly source nodes in the hierarchical dynamic knowledge graph; Starting from the anomaly source nodes, calculate the geodesic distances to each child node along the graph topology; According to the geodesic distances, construct an anomaly propagation probability density field; Through the propagation probability density field, generate key propagation paths connected by equipotential lines; Integrate the key propagation paths to construct a geodesic anomaly propagation model.

5. The intelligent early warning method for abnormal lineage of power data based on knowledge graphs according to claim 4, characterized in that, Through the geodesic anomaly propagation model, use the gradient descent backtracking algorithm to lock the coordinate sequence of the problem link, including: Based on the geodesic anomaly propagation model, initialize the gradient descent energy function; Through the energy function, calculate the energy gradient values of each node along the propagation path; According to the energy gradient values, iteratively perform backtracking search, select adjacent nodes in the gradient descent direction, update the current node to the local minimum of energy, and when the convergence condition is reached, output the minimum energy node set; Map the minimum energy node set to the lineage link to lock the coordinate sequence of the problem link.

6. The intelligent early warning method for abnormal lineage of power data based on knowledge graphs according to claim 5, characterized in that, According to the locked coordinate sequence of the problem link, associate multi-dimensional environmental factors in historical work orders to obtain a multi-dimensional environmental factor association graph, including: According to the coordinate sequence of the problem link, extract the spatio-temporal position feature vector; Input the spatio-temporal position feature vector into the index engine of the historical work order knowledge base to retrieve associated environmental factors to obtain the retrieval results; Based on the retrieval results, construct an environmental factor tensor; Through the environmental factor tensor, calculate the spatio-temporal association weight matrix with the problem link; Integrate the spatio-temporal association weight matrix and output the multi-dimensional environmental factor association graph.

7. The intelligent early warning method for abnormal lineage of power data based on knowledge graphs according to claim 6, characterized in that, Based on the multi-dimensional environmental factor association graph, dynamically generate a hierarchical early warning strategy, including: Obtain the spatio-temporal association weight matrix in the multi-dimensional environmental factor association graph and extract the association intensity values between each environmental factor and the problem link; According to the association intensity values, calculate the influence weights of each environmental factor on anomaly propagation; Based on the influence weights, fuse the historical early warning level configuration parameters to generate a multi-dimensional early warning score; Through the comparison between the multi-dimensional early warning score and the preset hierarchical threshold, dynamically divide the early warning levels; According to the early warning levels, match the preset emergency plan template library and output the hierarchical early warning strategy.

8. A knowledge graph-based intelligent early warning system for abnormal lineage in power data, characterized in that, The system is used to execute the method described in any one of claims 1 to 7, including: A construction module, used to map data entities to high-dimensional point clouds by spatial embedding based on the metadata of the power data lineage link; fuse the high-dimensional point clouds with the device topological relationship to construct a hierarchical dynamic knowledge graph; use the hierarchical dynamic knowledge graph to perform real-time verification of the cross-link data flow logic by normal vector field consistency analysis and output a verification result with direction features; A marking module, used to identify abnormal data entities through a manifold curvature mutation detection algorithm according to the verification result of the direction features to generate a semantic-level anomaly marker set; construct a geodesic anomaly propagation model along the hierarchical graph topology based on the semantic-level anomaly marker set; use the gradient descent backtracking algorithm through the geodesic anomaly propagation model to lock the coordinate sequence of the problem link; The early warning module is used to correlate multi-dimensional environmental factors in historical work orders based on the coordinate sequence of the identified problem link to obtain a multi-dimensional environmental factor correlation map; based on the multi-dimensional environmental factor correlation map, a hierarchical early warning strategy is dynamically generated.

Images