Electric power informatization data flow abnormal state detection system

Abstract

The invention relates to the field of abnormal state detection, and particularly discloses an electric power informatization data flow abnormal state detection system, which comprises the following steps: firstly, acquiring heterogeneous OT monitoring data and IT service data in real time, and generating a unified feature matrix and event flow; and then, taking a basic knowledge graph containing entity assets, a topological structure and a business process as a skeleton, dynamically attaching real-time features to graph nodes, and generating a dynamic association edge according to an event flow, thereby constructing a time sequence graph sequence capable of continuously evolving. On the basis, a time sequence diagram coding prediction technology is utilized to carry out spatio-temporal feature learning on a diagram sequence to calculate a node anomaly score. Once an anomaly is detected, the system performs reverse traceability based on a time sequence diagram structure, and utilizes clear physical and logic connection paths in a graph to accurately position potential root cause nodes causing a fault chain reaction, thereby realizing causal association analysis of cross-domain data streams and full-link abnormal state perception.

Description

Technical Field

[0001] This application relates to the field of abnormal state detection, and more specifically, to an abnormal state detection system for power information data streams. Background Technology

[0002] With the in-depth construction of new power systems, the power grid has evolved into a complex cyber-physical system deeply coupled with IT (Information Technology) and OT (Operational Technology). The stable operation of power services highly depends on the collaborative interaction of cross-domain data flows. In practical application scenarios, such as the chain reaction triggered by a surge in distributed photovoltaic power generation, not only will it cause voltage rise and power flow reversal on the OT side of the distribution network, but it will also cause a surge in data throughput in the data acquisition and settlement system on the IT side. If the IT side database experiences delays due to excessive processing pressure, the power prediction data of the upstream dispatching system will not be updated in a timely manner, thus misleading dispatchers to make incorrect judgments and seriously threatening grid security. Therefore, there is an urgent need for a technical solution that can penetrate the boundaries between IT and OT to perform full-link anomaly monitoring and status awareness of power information data flows.

[0003] However, existing power information data flow anomaly detection schemes suffer from significant model fragmentation and limited perspectives when dealing with cross-domain cascading failures and hidden process anomalies. Current technologies typically employ singular data models to process data of different natures separately. For example, they use time-series models like LSTM to process continuous OT telemetry values, or graph neural networks to handle the topological dependencies of IT systems. These two approaches operate independently, failing to form a unified cognitive view. This approach lacks a dynamic knowledge model capable of uniformly describing the entities, relationships, and dynamic temporal behavior of a mixed system, making it difficult for the system to reconstruct the cross-domain propagation path of anomalies at the data level. Furthermore, most existing methods only focus on correlation analysis between indicators, failing to characterize the temporal dynamics and causal delays of data flow, and thus unable to perform effective causal inference. When an alarm storm occurs, maintenance personnel often struggle to distinguish the root cause from the symptoms of the anomaly, making accurate root cause localization impossible, thereby hindering the overall operational efficiency and security capabilities of the power information system. Summary of the Invention

[0004] To address the aforementioned technical challenges, this application is proposed. According to this application, a power information data stream abnormality detection system includes: The real-time data acquisition module is used to acquire real-time OT data streams and real-time IT data streams; The data alignment and characterization module is used to perform real-time alignment and characterization of multi-source heterogeneous data streams such as real-time OT data streams and real-time IT data streams to obtain aligned feature matrices and event streams. The time sequence graph generation module is used to attach node features and generate dynamic event edges to the aligned feature matrix and event stream based on the basic knowledge graph to obtain a time sequence graph sequence. The temporal graph encoding and prediction module is used to perform temporal graph encoding and future state prediction on the temporal graph sequence to obtain a dictionary of node anomaly scores. The root cause node generation module is used to trace the source of anomalies in the node anomaly score dictionary and time series sequence based on anomaly thresholds to obtain potential root cause nodes.

[0005] Compared with existing technologies, this application provides a power information data flow anomaly detection system to address the difficulties in anomaly detection and the lack of causal inference caused by the disconnect between IT and OT systems. First, it acquires heterogeneous OT monitoring data and IT business data in real time. Through multi-source alignment and feature processing, it eliminates differences in time series frequency and data modality, generating a unified feature matrix and event flow. Then, using a basic knowledge graph containing entity assets, topology, and business processes as its framework, it dynamically attaches real-time features to graph nodes and generates dynamic association edges based on the event flow, thereby constructing a continuously evolving time-series graph sequence. Based on this, it uses time-series graph encoding prediction technology to learn the spatiotemporal features of the graph sequence, calculating node anomaly scores by analyzing the deviation between predicted future states and actual states. Once an anomaly is detected, the system performs reverse tracing based on the time-series graph structure, using the explicit physical and logical connection paths in the graph to accurately locate the potential root cause nodes leading to a chain reaction of failures, thus achieving causal correlation analysis of cross-domain data flows and end-to-end anomaly state perception. Attached Figure Description

[0006] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0007] Figure 1 This is a block diagram of a power information data stream abnormal state detection system according to an embodiment of this application.

[0008] Figure 2 This is a schematic diagram of the data flow of the power information data flow abnormality detection system according to an embodiment of this application.

[0009] Figure 3 This is a block diagram of the data alignment feature module in the power information data stream abnormal state detection system according to an embodiment of this application.

[0010] Figure 4This is a schematic diagram of the data flow in the root cause node generation module of the power information data flow abnormal state detection system according to an embodiment of this application. Detailed Implementation

[0011] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0012] This application is made in response to the problems of the prior art mentioned above. Figure 1 This is a block diagram of a power information data stream abnormal state detection system according to an embodiment of this application. Figure 2 This is a schematic diagram of the data flow in a power information data flow anomaly detection system according to an embodiment of this application. Specifically, as shown... Figure 1 and Figure 2 As shown, the power information data flow abnormal state detection system 100 according to an embodiment of this application includes: a real-time data acquisition module 110, used to acquire real-time OT data flow and real-time IT data flow; a data alignment and feature generation module 120, used to perform real-time alignment and feature generation of multi-source heterogeneous data flow on the real-time OT data flow and real-time IT data flow to obtain an aligned feature matrix and event flow; a time series graph generation module 130, used to perform node feature attachment and dynamic event edge generation on the aligned feature matrix and event flow based on a basic knowledge graph to obtain a time series graph sequence; a time series graph encoding and prediction module 140, used to perform time series graph encoding and future state prediction on the time series graph sequence to obtain a node abnormality score dictionary; and a root cause node generation module 150, used to perform abnormal source tracing on the node abnormality score dictionary and time series graph sequence based on an abnormality threshold to obtain potential root cause nodes.

[0013] Specifically, the real-time data acquisition module 110 is used to acquire real-time OT data streams and real-time IT data streams. It is understood that as the new power system architecture develops in depth, the energy flow at the physical layer of the power grid and the business data interaction at the information layer exhibit an unprecedentedly close coupling. Single-dimensional monitoring data can no longer objectively reflect the evolution logic of cross-domain faults. When facing complex scenarios such as voltage fluctuations caused by distributed energy access and the resulting high-concurrency settlement requests, sudden changes in telemetry values ​​on the physical side are often the cause of database blockage on the logical side, while instruction delays on the information side, in turn, restrict the timeliness of physical equipment control. Relying solely on isolated SCADA monitoring or independent IT operation and maintenance monitoring will lead to a break in the causal chain, causing the system to fall into a data silo blind spot when facing cross-domain cascading faults. Therefore, in order to construct a unified panoramic view that can penetrate the physical and digital boundaries, this application synchronously ingests continuous state quantities from the operational technology domain and discrete behavioral logs from the information technology domain from the source. By comprehensively capturing the underlying heterogeneous data streams, it provides a unique original evidence and data foundation for subsequently reconstructing the spatiotemporal propagation path of faults across different system levels.

[0014] In a feasible technical solution, the real-time data acquisition module 110 processes data as follows: The implementation mainly relies on a distributed probe acquisition architecture and multi-protocol adaptation middleware to complete the parallel extraction and caching of underlying heterogeneous source data. In the initial stage of implementation, the module first loads the communication protocol drivers of various devices through a pre-configured strategy, and establishes dedicated data transmission channels to the physical control layer and the information management layer respectively.

[0015] For the acquisition of real-time OT data streams, this module initiates data gateways deployed at substations, distribution terminals, or distributed power monitoring units. Utilizing industrial control protocols such as IEC61850, IEC104, or ModbusTCP, it performs high-frequency polling or subscription-based acquisition of the operating status of physical devices. Since OT-side data primarily reflects instantaneous changes in grid physical quantities, it features high-frequency sampling and temporal continuity. The module reads analog and digital quantities transmitted by sensors with millisecond-level time resolution. For example, when monitoring distributed photovoltaic access points in a region, the module continuously reads the inverter's output active power, the voltage amplitude at the grid connection point, and the line current phasor. These data points often arrive continuously at a frequency of 50 frames per second or higher. Due to the hybrid mechanism of variable or periodic data transmission used by on-site intelligent electronic devices, the data arriving at the gateway exhibits non-uniform temporal distribution. Therefore, upon receiving the original message, the module immediately parses its payload, extracting core fields such as the measurement point ID, acquisition timestamp, physical values, and quality flags. It then encapsulates these data packets, containing not only amplitude information but also precise timing information, into a real-time OT data stream. For example, the system collects data at a certain moment when the voltage of phase A at the grid connection point rises to 11.8kV due to a surge in photovoltaic output, with the timestamp accurate to 10:00:00.020. Immediately afterwards, at 10:00:00.040, a current value of 200A is collected. These continuous numerical sequences constitute the basic profile reflecting the health of the physical power grid.

[0016] To acquire real-time IT data streams, this module monitors and captures operational metrics and business logs of information systems through lightweight agents deployed on server operating systems, database instances, middleware containers, and network switches, or by utilizing standard interfaces such as SNMP, Syslog, and JMX. Unlike the continuous nature of OT data, IT data is more often represented by low-frequency statistical indicators or sparse event-triggered logs. The module monitors key nodes in the power marketing system, dispatch management system, or cloud platform in real time, capturing relevant records immediately once a business process triggers a specific action or system resources change. For example, when the marketing settlement system processes an electricity purchase transaction, the database generates a transaction commit log, or when the application server's CPU utilization exceeds a set threshold, a performance alarm record is generated. This data is unstructured text or semi-structured key-value pairs, and its generation frequency depends on the business concurrency; there may be no data for several minutes during off-peak hours at night, while it explodes during peak hours. The module extracts this discrete information in real time through a log collector, extracting elements such as hostname, service type, log generation time, log content, and key performance indicator values. For example, the module might capture a log from an Oracle database showing that an SQL query timed out, with a lock time of 3000ms and a timestamp of 10:00:00.050, or that the CPU load of the data collection server was reported to be stable at 92% at 10:00:05.

[0017] After completing the parallel acquisition of the two types of data mentioned above, the real-time data acquisition module uses its internal high-throughput message buffer to perform preliminary cleaning and out-of-order correction on the incoming data, ensuring that all data comes with a unified high-precision timestamp for timing alignment in subsequent steps. The module ultimately outputs the encapsulated OT stream containing timing values ​​such as voltage and current, and the IT stream containing text or metric information such as web response latency, database lock wait times, and server load, as standardized outputs.

[0018] Specifically, the data alignment and characterization module 120 is used to perform real-time alignment and characterization of multi-source heterogeneous data streams of real-time OT data streams and real-time IT data streams to obtain aligned feature matrices and event streams. Correspondingly, in the operation monitoring of the power information-physical fusion system, OT data streams originating from the physical power grid exhibit high-frequency continuous sampling at the nanosecond or millisecond level, possessing extremely high temporal resolution and numerical density; while IT data streams originating from information business systems present as low-frequency indicators at the minute level or sparse discrete logs triggered by specific events, exhibiting not only a large time span but also significant uncertainty. This huge difference in temporal granularity and the heterogeneity of data modalities prevent the direct mapping of transient fluctuations at the physical level and logical states at the information level to the same time dimension, severely hindering the discovery of cross-domain causal relationships and the synchronous perception of the entire link state. Therefore, the data alignment and characterization process aims to eliminate frequency barriers and spatiotemporal misalignments between heterogeneous data sources. By constructing a unified time benchmark and standardized feature expressions, the fragmented original data streams are reconstructed into a temporally synchronized and semantically related feature matrix.

[0019] Figure 3 This is a block diagram of the data alignment feature module in the power information data stream abnormal state detection system according to an embodiment of this application. Figure 3 As shown, in a feasible technical solution, the data alignment and feature module 120 includes: a raw data preprocessing unit 121, used to perform multi-granularity time-series window alignment and aggregation on real-time OT data streams and real-time IT data streams to obtain a synchronized raw data vector set; a heterogeneous modal feature mapping unit 122, used to perform heterogeneous modal feature mapping and matrix construction on each synchronized raw data vector in the synchronized raw data vector set to obtain an aligned feature matrix; and an event stream generation unit 123, used to perform discrete event pattern recognition on the aligned feature matrix to obtain an event stream.

[0020] Specifically, the data alignment and characterization module 120 processes the data as follows: The raw data preprocessing unit 121 first continues the real-time data stream containing high-precision timestamps obtained by the previous module. Given the high-frequency characteristics of OT data and the sparse characteristics of IT data, this unit first performs a global clock reference setting operation, that is, sets a unified time window step size. It is determined based on the sampling period of OT data and the response latency characteristics of IT services, combined with the system's real-time requirements for anomaly detection (such as setting it to 10 seconds to balance computational load and detection accuracy), through pre-configuration or adaptive algorithms. For example, it is set to 10 seconds, and this step size divides the continuous physical time axis into a series of discrete and continuous time slices. Each time window This constitutes a basic processing unit used to carry out subsequent data aggregation operations. For real-time OT data streams, this unit performs high-frequency downsampling aggregation processing. For each sensor node i in the power grid, within the current time window... Within this range, the system will retrieve all original sampling points falling within that interval. The appropriate aggregation function will be selected based on the physical properties of the data. For example, the mean function (Mean) is used to reflect the central trend for steady-state indicators such as voltage and frequency, while the maximum value function (Max) is used to preserve extreme value characteristics for over-limit sensitive indicators such as line load and current. Based on the formula... Perform calculations, where This represents the aligned standard value of node i within the time window t. This is the kth original value collected. The timestamp of the k-th original value. Used to identify data source IDs. For example, within a time window from 10:00:00 to 10:00:10, the voltage sensor at the photovoltaic grid-connected point in the distribution network may upload 500 data points fluctuating between 11.78kV and 11.85V. After applying the mean aggregation using this formula, a unique representative value of 11.815kV is generated within this window, thus transforming the high-frequency sequence into a single feature value synchronized with the time window. For real-time IT data streams, this unit implements low-frequency / sparse data alignment processing. Since IT data (such as server CPU utilization, database lock logs) may have missing data or only a few records within the current window, the processing strategy is divided into two categories: if data exists within the window, the latest value or mean is taken according to business needs; if there is no data within the window, a zero-order hold strategy is adopted, that is, the state value of the previous time window is used for filling, or for text log data, it is left empty or the text within the window is concatenated. For example, if the CPU utilization of a marketing settlement server is reported as 92% at 10:00:05, falling within the current 10-second window, then the CPU characteristic value for that window is set to 92%. If no new data is reported during the next window from 10:00:10 to 10:00:20, the system automatically carries over the 92% from the previous window to the current window to maintain state continuity and ensure that all nodes have corresponding numerical descriptions at any time slice t. Finally, this unit performs the synchronization vector assembly step. After completing the above processing, for each discrete time window t, the system concatenates the aggregated values ​​of all OT nodes (e.g., 11.815kV) and the aligned state values ​​of all IT nodes (e.g., 92%) according to a predetermined node order, assembling a high-dimensional unnormalized original vector, i.e., the synchronized original data vector. Each element in this vector strictly follows a uniformly defined mathematical form, accurately mapping the global state snapshot of the power information physical system at a specific time slice. This series of vectors arranged in chronological order constitutes the synchronized original data vector set.

[0021] Heterogeneous Modal Feature Mapping Unit 122: For the synchronized original data vector corresponding to each time window t in the set, this unit first performs a numerical feature space transformation operation. Since the vector contains components with significantly different dimensions, such as voltage (in kV) and CPU utilization (in %), direct calculation would introduce bias due to the different numerical magnitudes. Therefore, the system first separates the numerical components in the vector and, for each type of physical quantity i, uses the mean value pre-calculated using historical statistical data. and standard deviation Apply the Z-Score standardization formula , and perform the conversion. Among them, These are the original values. It is the average level of node i during its historical normal operation cycle. This corresponds to the fluctuation range. For example, if the average voltage of a photovoltaic grid-connected point output by the previous unit is 11.815kV, while the historical average voltage of that node is... =10.0kV, standard deviation =0.5kV, then the standardized eigenvalue after conversion =(11.815-10.0) / 0.5=3.63, which means that the current voltage deviates from the mean by 3.63 standard deviations in the positive direction. This transforms the original numerical value with physical units into a dimensionless feature that follows a standard normal distribution with a mean of 0 and a variance of 1, eliminating the influence of magnitude between different physical quantities. Subsequently, this unit performs text feature semantic embedding operations, which aims to process unstructured text components in the synchronized original data vector, such as log fragments generated by IT systems (Error: SQL query wait timeout). To extract its deep semantics, the system calls the pre-trained domain language model ElecBERT. ElecBERT is a deep neural network model built on the Transformer architecture, whose core structure includes a multi-layer bidirectional self-attention mechanism and a feedforward neural network. This model has been pre-trained on a large-scale unsupervised basis on a massive power industry corpus (such as equipment operation and maintenance manuals, accident analysis reports, and system operation logs), thereby learning professional terminology and contextual logical relationships in the power field. During the processing, the input original text string First, the text is processed by a word segmenter, and a special classification marker [CLS] is added at the beginning of the sentence. Then, this sequence is fed into the ElecBERT model, where it undergoes complex computation through multiple layers of encoders. Finally, the output vector corresponding to the [CLS] position is extracted as the global semantic representation of the text segment. According to the formula The originally discrete character sequence is mapped to a dense real-number vector of fixed dimension (e.g., 768-dimensional). This vector can capture high-level semantic intents such as network interruption or service unavailability implied by connection timeouts, allowing textual information and numerical features to undergo mathematical operations in the same vector space. Next, this unit performs multimodal feature concatenation processing. In power information systems, some key nodes (such as SCADA servers responsible for data acquisition and processing) may simultaneously possess numerical monitoring indicators (e.g., CPU load) and textual operation logs. For such composite nodes i, the system uses their standardized numerical feature vectors... Text feature vectors after semantic embedding The system performs cascading concatenation to form a comprehensive feature vector that integrates physical state and logical intent. For example, if a server's CPU feature value at time t is 3.2 (e.g., historical mean 60%, standard deviation 10%, hence (92-60) / 10=3.2), and a transaction latency log vector is generated, the concatenated vector will simultaneously contain numerical information about high load and semantic information about transaction obstruction, providing a complete perspective for subsequent correlation analysis. Finally, this unit performs feature matrix instantiation. After constructing the feature vectors of all nodes i (whether purely numerical, purely textual, or hybrid nodes), the system, according to the predefined global node index order in the basic knowledge graph, concatenates the feature vectors of all N nodes at the same time t. Arrange the rows to construct the feature matrix at time t. Its formal definition is Each row of the matrix corresponds to a full-dimensional feature description of a power system entity at the current moment. This aligned feature matrix... As a standardized mathematical object, it not only retains all the information entropy of the original data, but also eliminates the barriers between heterogeneous modes through a unified feature space.

[0022] In a feasible technical solution, the event stream generation unit 123 includes: a numerical state determination subunit 1231, used to perform numerical state determination based on adaptive statistical boundaries on the aligned feature matrix to obtain a set of numerical abnormal events; a text intent recognition subunit 1232, used to perform text intent recognition based on semantic space projection on the aligned feature matrix to obtain a set of text semantic events; and a multimodal event fusion subunit 1233, used to perform multimodal event fusion on the set of text semantic events and the set of numerical abnormal events to obtain an event stream.

[0023] The first step of the numerical state determination subunit 1231 is to perform a feature slicing operation, that is, to extract the numerical feature vector of each node i at the current time t from the matrix one by one according to the row index. For example, for a photovoltaic grid-connected voltage node, the extracted characteristic value might be 3.63, which means that the voltage value at that moment deviates from the historical mean by 3.63 standard deviations. The second step is to perform bilateral threshold determination, where a dynamic threshold parameter is introduced. This parameter is adaptively set based on the statistical distribution characteristics of the system's historical operating data, according to the normal distribution. Rule 3 is set, meaning that data deviating from the mean by more than three times the standard deviation is considered a statistically rare outlier. Since the numerical data in the preceding unit has been standardized using Z-Score to a standard distribution with a mean of 0 and a variance of 1, the decision process directly detects the absolute value of the feature values. The third step is to perform a status indicator function mapping, utilizing the indicator function. When the judgment condition is met, such as |3.63|>3 being true, or if the eigenvalue is 3.2 then |3.2|>3 being true, the indicator function... Set to 1 otherwise, set to 0. The fourth step is to instantiate transient events. For all nodes marked as 1, the system automatically generates a preliminary numerical event object, recording not only the fact that the event was triggered but also extracting the specific deviation at that moment as an event attribute. Finally, based on the formal definition... Construct a set of numerical anomaly events, in which It is the node ID. It is an event type identifier. The function maps continuous deviations to discrete levels (such as Level-1, Level-2), thereby discretizing continuous numerical out-of-limit behaviors into concrete event records.

[0024] The text intent recognition subunit 1232 is implemented by expanding the nodes containing text vectors in the feature matrix. This subunit predefines a set of event prototype centers. These prototype centers were obtained by training on a historical fault log database using a clustering algorithm (such as K-Means), and each center vector... This represents the cluster centroid of a known failure mode, such as database deadlock, network communication interruption, or insufficient disk space, in the semantic vector space. For example, for deadlock-type failures, its prototype centroid... The standard semantic coordinates are obtained by averaging hundreds or thousands of vectors containing logs indicating deadlocks, transaction timeouts, etc. The first step involves spatial projection and similarity calculation for the text vector of a node at time t. (This vector was generated by the preceding ElecBERT model), and its cosine similarity with all K pre-defined prototype centers is calculated. The second step involves maximum likelihood classification, selecting the prototype category with the highest similarity score as the candidate semantic label for the text vector. A confidence threshold is then introduced. This threshold is determined by balancing precision and recall on a large-scale validation set, for example, by setting it to 0.85. If the maximum similarity... If the value is below the threshold, the identification is considered successful; otherwise, it is marked as an unknown anomaly to avoid misjudgment caused by forced classification. The third step involves extracting key entity slots. After confirming the event type, the system will backtrack to the original log text to extract specific error codes, such as ORA-00060 (Oracle deadlock error code), or key parameters as supplementary attributes. Finally, based on the formal definition... The identified fault type label is assigned to the node, thereby generating a set of textual semantic events containing a clear intent.

[0025] The multimodal event fusion subunit 1233 aims to merge the two parallelly generated event sets into a unified output stream. The first step involves performing a set union operation, seamlessly merging numerical limit-exceeding events from the numerical anomaly event set with semantic events obtained from text intent recognition, ensuring that all anomaly clues at the physical and information layers are treated equally. The second step involves injecting severity levels, establishing a mapping rule table from event type to severity level based on power industry standards. For example, voltage rise events (triggered by 3.63) and CPU overload events (triggered by a value exceeding 3σ) from the numerical event set are classified as Level-4 (relatively severe) and Level-2, respectively, according to the rules; while database deadlock or query timeout events (triggered based on the similarity between log semantic vectors and fault prototypes) from the text event set are classified as Level-3. The system automatically looks up the table and injects a severity level attribute into each merged event object. The third step involves performing quadruple encapsulation, encapsulating each graded event into a standardized quadruple structure. Where t is a uniform timestamp. The ID of the node involved. For specific event types, such as voltage dips or database deadlocks, This step involves determining the severity level. It also includes deduplication logic to remove redundant events reported repeatedly within the same time window. Finally, based on the formal definition... , This operator represents the universal set traversal and union operation, indicating the operation on the set. Each node in Iterate through them and combine the events they each generated into a single collection. Indicates the type identifier of numerical anomalies. Indicates the severity level of numerical anomalies. Indicates the type of text intent event identified. Indicates the severity level of the text anomaly. Outputs the final event stream. ,this It not only contains all detected atomic events, but also carries precise spatiotemporal labels and hierarchical information.

[0026] Specifically, the time sequence graph generation module 130 is used to attach node features and generate dynamic event edges on the aligned feature matrix and event stream based on the basic knowledge graph to obtain a time sequence graph sequence. It should be understood that although the preceding steps have successfully transformed the chaotic heterogeneous source data into a standardized feature matrix and discrete event stream, these data are essentially isolated information islands, only describing snapshots of the state of certain monitoring points at specific times, lacking a structured context that can explain the correlation between these states. Actual power grid operational faults often do not erupt independently in a vacuum, but rather propagate in a chain along physical transmission lines, logical network topology, and business process execution paths. For example, overload of a physical transformer may originate from an erroneous instruction in the logical scheduling algorithm, which in turn may begin with data latency caused by server performance degradation. If the system lacks a topology model that can accurately map physical connections, digital communication, and business logic, it is impossible to establish a causal connection in the spatial dimension between the seemingly independent events of discrete voltage grid connection anomalies and high server CPU load. Therefore, constructing a basic knowledge graph and generating a time-series graph sequence can provide a static, full-dimensional digital skeleton for dynamically evolving data streams. By dynamically attaching real-time features and events to the graph nodes, the system can not only know what happened, but also deduce where it came from and where it is going based on the topological structure.

[0027] In a feasible technical solution, the construction process of the basic knowledge graph includes: S1, extracting heterogeneous entities from the IT asset database, OT equipment list, and business process definition from multiple sources and performing node-based modeling to obtain a global entity node set; S2, extracting topology-business two-layer static relationships from the system topology graph and business process definition to obtain a static edge set; S3, fusing the global entity node set and the static edge set into a graph structure to obtain the basic knowledge graph.

[0028] S1 is the primary cornerstone for building this digital framework. This process ingests metadata from different dimensions through three parallel channels and, through a series of standardized processing logics, maps entities from both the physical and digital worlds into node objects in a unified graph. First, data source acquisition and initial cleaning are implemented. The system acquires three core foundational data sets through dedicated interfaces or periodic export mechanisms. The IT asset database comes from the enterprise's Configuration Management Database (CMDB) or the asset ledger of the automated operations and maintenance platform, containing tens of thousands of servers, switches, storage devices, and their detailed configuration information, such as IP addresses, MAC addresses, and operating system versions; it is the physical carrier record of the information layer. The OT equipment list comes from the Production Management System (PMS) or Geographic Information System (GIS), providing a detailed list of physical assets in the power grid, such as transformers, circuit breakers, inverters, and relay protection devices, including key parameters such as rated voltage, installation location, and equipment model; this is the entity list of the physical layer. The business process definition is extracted from the XML configuration file of the Business Process Management (BPM) system or workflow engine, describing the logical sequence of steps for business activities such as electricity billing, fault repair, and remote switching operations. After acquiring this raw data, the system performs rigorous data cleaning and standardization operations. Addressing naming convention differences between different vendors or systems—for example, the same server might be recorded as Svr-Bill-01 in the CMDB but as Host-192.168.1.10 in the monitoring log—the module introduces the Common Information Model (CIM), a standard used in the power industry, as its metadata standard. Through fuzzy matching and a rule mapping engine, duplicates and invalid null values ​​are removed, and all entity identifiers and attribute names are uniformly converted to the standard format, ensuring semantic consistency across multiple data sources. Subsequently, entity type mapping operations are performed. To enable the computer to distinguish nodes of different natures and apply different propagation rules in subsequent inference, the system establishes a unified ontology type system. The system iterates through each cleaned data record, classifying and mapping them according to their source and attribute characteristics. For IT asset data, it maps physical machines, virtual machines, and database instances that host computing tasks to computing resource nodes. For example, settlement servers that experience abnormal CPU load in the preceding steps are marked as this type; processes running on them, such as marketing management software and SCADA front-end services, are mapped as application service nodes. For OT device data, all physical equipment directly involved in power transmission and control is mapped as physical device nodes. For example, photovoltaic inverters or grid-connected circuit breakers that detect voltage fluctuations in the preceding steps belong to this category. Based on the business process definition, each independent business operation step, such as initiating calculations, writing invoices, and issuing instructions, is mapped to a logical business node. This classification mapping transforms the chaotic asset list into structured objects with clearly defined functions, laying the type foundation for subsequent definitions of connections between nodes (such as physical connections, data connections, and logical connections). Next, node attribute encapsulation and set construction are performed. The system assigns a globally unique identifier (UUID) to each identified entity; for example, uuid-server-bill-001 is assigned to the settlement server, and uuid-inv-pv-003 to the photovoltaic inverter. This UUID will serve as the primary key of the node in the graph and establish a strict anchoring relationship with the column index in the preceding feature matrix generation step, ensuring that the k-th column feature in the matrix accurately flows into the k-th graph node. Simultaneously, the system extracts and encapsulates the entity's static core attributes from the original data, forming an attribute set. .for This type of inverter node may have attributes including rated power = 500kW and grid connection point = Substation_A; for Server nodes of this type have attributes including IP=10.20.1.5 and OS=Linux_CentOS. These static attributes complement the dynamic real-time feature stream, together forming a complete profile of the node. All encapsulated node objects are ultimately aggregated to form a global entity node collection containing all components of the power information system. Finally, based on the formal definition... The above process is described mathematically. This formula shows that the output global set of entity nodes... It is a finite set containing the totals within the system. Each measurable entity. Each element in the set. Both are triples, in which It is the only link connecting static graphs and dynamic data streams. The functional roles and potential behavioral patterns of nodes are defined (e.g.) The nodes follow Kirchhoff's laws. Nodes follow causal time order. This provides background information that aids in root cause localization. This set This constitutes the vertex set of the basic knowledge graph.

[0029] S2 extracts the intrinsic relationships between nodes from existing system architecture documents and process definition files. The core of this process lies in two-layer extraction: simultaneously covering the underlying physical / network topology and the upper-layer business logic processes, weaving them into a single relational network. First, a physical / logical topology parsing operation is performed. This sub-step primarily processes system topology data from the Network Management System (NMS) or system architecture diagrams. These diagrams are stored in XML, JSON, or Visio file formats, describing physical connections between hardware devices (such as network cables and fiber optic cables) and logical calls between software components (such as RPC calls and database connections). The system traverses these topology files, parsing each connection entry. For each connection record, the system uses the global entity node set generated in the previous steps. The system anchors the record to the ID index. For example, when a record describing a primary billing server Server-A connected to aggregation switch Switch-B via port GigabitEthernet1 / 0 / 1 is parsed, the system will anchor the record to the aggregation switch. Search for the corresponding Type Node and Type Node Once the existence of the node is confirmed, a physical connection edge is generated. and its relation type The attribute is marked as connected to `connects_to`. Similarly, for application-level call relationships, such as the marketing application App-Marketing reading the Oracle database DB-Bill, a logical connection edge is generated, marked as `calls`. This layer of parsing reconstructs the infrastructure architecture of the power information system and clarifies the physical channels for data flow. Next, the business process chain parsing operation is performed. This process delves into the business logic level, parsing process definition files (such as BPEL or BPMN) from the Business Process Management (BPM) system. These definition files describe in detail the flow sequence of power business activities. The system traverses each step in the process, identifying the temporal dependencies between steps. For example, in the distributed photovoltaic fee control settlement process, the definition file stipulates that the grid-connected electricity data collection step must be completed before the grid-connected electricity fee calculation step can be triggered. The system finds the corresponding two in the graph. Type Node and And establish a directed edge between them. , and its relation type Marked as preceding steps. This establishment of temporal dependency edges allows the graph to understand the causal sequence of business activities, knowing that if an upstream step is blocked, a downstream step will inevitably stall, providing a logical basis for subsequent causal inference. Next, cross-domain association mapping is performed. This is a crucial step connecting IT and OT, logic and physical. The system analyzes the attribute descriptions of each step in the business process definition, identifying the specific IT / OT assets supporting the execution of that step. For example, the logical step of electricity bill calculation does not execute in a vacuum but must run on a specific marketing database and application server. Based on these binding relationships, the system... node and Edges are established between nodes. If a business step depends on a data asset, an edge of type `depends_on` is generated; if the business logic runs on a host, an edge of type `executed_on` is generated. Through this step, the abstract process of the business layer is anchored to the infrastructure of the physical layer, enabling the model to quickly infer the affected business processes when IT equipment (such as servers) fails. Finally, an edge aggregation operation is performed. The system summarizes all relationships (physical connections, business sequence, cross-domain dependencies) parsed from the above three steps, filters and removes noise, forming a unified static edge set. Formally, this process follows a formula. .in, Indicates a line from the source node Point to target node The directed edge, It records the semantics of the relationships (such as connects_to, depend on, precede), This is the initial weight of the edges, initialized to 1, representing that in the default state, the density or transmission capacity of all connections is equal. However, in the subsequent evolution of the dynamic graph, this weight may be adjusted according to real-time traffic or abnormal intensity. This set It includes not only connections between homogeneous nodes (such as servers connecting to switches), but also cross-layer connections between heterogeneous nodes (such as business steps depending on servers), forming the complete network of a complex cyber-physical system.

[0030] S3 assembles the aforementioned disparate components into a functional whole. First, it performs the graph structure assembly operation. The system calls the underlying storage interface of a high-performance graph database (such as Neo4j) or graph computing library (such as NetworkX) to create an empty graph container. Then, the global entity node set Import all node objects in batches as vertices of the graph, and import the static edge set. All edge objects are imported in batches as edges in the graph. During the import process, the system automatically constructs an adjacency list or adjacency matrix to ensure that each node in the graph can quickly access its neighboring nodes, thus forming a connected graph structure. For example, in NetworkX, the system executes instructions like G.add_nodes_from(U) and G.add_edges_from(E_static) to instantiate graph objects in memory. Next, isolated node pruning and integrity checks are performed. Due to quality issues with the original data or delays in configuration updates, the generated preliminary graph may contain some isolated nodes—idle nodes that do not belong to any business process and have no physical connection records, such as an old server that has been taken offline but not removed from the asset repository. The system traverses the assembled graph structure and checks the degree of each node. For nodes with a degree of 0, or nodes with only self-loops, the system processes them according to preset rules. If a node is confirmed to be an abandoned asset, it is directly removed; if data is suspected to be missing, it is marked as unconnected and does not participate in subsequent propagation calculations to prevent noise from interfering with the connectivity and inference efficiency of the graph model. At the same time, the integrity of the graph is verified to ensure that there are no dangling edges, that is, the endpoints of the edges are not in the set of nodes. Next, the graph index is constructed. To support high-frequency attachment and querying of node features in the subsequent time-series graph generation module, the system provides a graph index. Construct an efficient inverted index. Specifically, establish a mapping from NodeID to MemoryAddress (node ​​identifier to memory address index) to quickly locate graph nodes based on IP addresses in logs; establish a mapping from NodeType to NodeList (node ​​type to node list index) to quickly retrieve all nodes of a specific type (e.g., find all transformers); and establish a mapping from RelationType to EdgeList (relation type to edge list index) to quickly traverse edges of a specific type (e.g., find all business dependencies). These indexing mechanisms reduce the time complexity of graph queries, meeting the high-throughput requirements of real-time monitoring. Finally, based on a formal definition... The system has completed the construction of a basic knowledge graph. It's not just a static data structure; it's a holographic map of the power information physical system. On this map, every entity has clear coordinates (nodes), and every relationship has a clear path (edges).

[0031] After the basic knowledge graph is constructed, the time sequence graph generation module 130 is executed. Specifically, the time sequence graph generation module 130 processes the following: its implementation is an iterative operation that dynamically and continuously transforms the static graph. This module uses the basic knowledge graph... Using the underlying template as the driving axis, the following core steps are executed cyclically.

[0032] First, a node feature attachment operation is performed. At each discrete time step t (e.g., t=10:00:10), the module extracts the feature data of all nodes at that moment from the aligned feature matrix. Each column vector This precisely corresponds to the full-dimensional state of the i-th entity node in the system at time t (including numerical features such as voltage and CPU load after Z-Score normalization, as well as semantic features of the log text after ElecBERT embedding). The system utilizes the NodeID mapping relationship established in the graph indexing construction step to paste these feature vectors one by one into the basic knowledge graph. On the corresponding node object in the graph. Through this operation, the graph node that originally only had static attributes (such as IP, rated power) will have its attributes changed. It was given dynamic attributes This forms the state enhancement node at that moment. For example, in the graph, the settlement server node A is attached with a normalized CPU load characteristic value (e.g., 3.2, corresponding to the original value of 92%) and a feature vector of log semantics = database deadlock at time t, thus enabling it to express its current health status in the graph.

[0033] Secondly, dynamic event generation operations are performed. Besides static physical connections and logical dependencies, power information systems also contain a large number of transient, non-fixed interactive behaviors, which are generated by the event streams generated previously. As described. Within time step t, the system traverses all interaction events recorded in the event stream. For each event that records an interaction relationship, it's worth noting that the event stream here includes not only single-point anomalies but also communication events parsed from the interaction logs in practical applications. If the preceding sequence only contains an anomaly event, this mainly handles potential connections on the anomaly propagation path (or based on the call relationships parsed from the logs). For example, if the event stream or auxiliary log stream shows that application service node A initiated an API call to database node B at time t, and this call is recorded in the log, the system will dynamically generate a temporary directed edge between these two nodes in the graph, with the edge type marked as API call api_call. Unlike static edges, this dynamic edge only exists within the current time step or its influence period, and the edge will be accompanied by dynamic parameters extracted from the event attributes, such as response latency = 300ms and data packet size = 2KB. This dynamic edge generation mechanism allows the sequence graph to capture temporary traffic bursts or specific call chains during system runtime, compensating for the inability of static topology to describe dynamic load balancing or temporary routing. Finally, a snapshot sequence construction operation is performed. After completing the node feature updates and dynamic edge additions described above, all information at the current time t (static topology + real-time node features + dynamic interaction edges) is encapsulated into a complete graph snapshot. This snapshot ,in It is a set of nodes with attached features. It is the intrinsic edge set in the basic graph. This is the temporary edge set generated at that moment. As time step t continues to advance ( The system continuously generates such graph snapshots and arranges them in chronological order, eventually forming a time-series graph sequence. This sequence is like a high-definition movie recording the entire operation of a power system, frame by frame. Each is a panoramic image containing rich semantic and topological information.

[0034] Specifically, the time-series graph encoding and prediction module 140 is used to perform time-series graph encoding and future state prediction on the time-series graph sequence to obtain a node anomaly score dictionary. Correspondingly, although the time-series graph sequence completely records the topology and node states of the system at each moment, this frame-by-frame archiving method is merely a static replay of historical facts. To identify potential hidden dangers or sudden anomalies from this historical data, a cognitive model capable of understanding the system's evolutionary laws needs to be established. Normal power system operation follows physical laws and predetermined business logic; whether it's voltage fluctuation trends or server CPU load cycles, they all imply specific spatiotemporal patterns. If the system can learn these normal patterns and possess the ability to predict future states, then when the actual operating state deviates from this prediction, it signifies the occurrence of an anomaly. However, traditional single prediction models (such as isolated time-series prediction) cannot perceive the impact of topology on state changes (for example, photovoltaic fluctuations inevitably lead to load changes in the transformers connected to them), while static graph models cannot capture the dynamic evolution of the time dimension. Therefore, this application uses time-series graph encoding prediction to fuse spatiotemporal information, and uses deep learning technology to capture the evolution of node states with topology and time, constructing a digital twin dynamic behavior model of the system. This allows the deviation between predicted and actual values ​​to quantify the degree of anomaly of each node, achieving a shift from passive monitoring to proactive perception.

[0035] In a feasible technical solution, the processing of the time series graph encoding and prediction module 140 is as follows: the module uses the input time series graph sequence as the data basis and calculates the health of all network nodes time by time through a closed-loop process of encoding-prediction-evaluation.

[0036] First, temporal graph encoding is performed. This module introduces a time-aware graph neural network, specifically employing the T-GAT architecture. T-GAT is an advanced graph neural network model whose core lies in combining graph attention mechanisms with temporal encoding. Its architecture consists of multiple stacked attention layers, each equipped with a learnable weight matrix (such as...). ) and time-specific bias parameters. A snapshot of the graph at each time step t. At that time, for each target node in the graph For example, for a distribution transformer node, the model not only focuses on its current characteristics. It will also search for its first-order and higher-order neighbors in the graph. Examples include connected circuit breakers and upstream buses. Unlike ordinary GNNs, T-GAT dynamically calculates attention coefficients based on the timestamp distance and topological connection strength of neighboring nodes when aggregating neighbor information. This means that neighbors with recent data interactions and physically close neighbors will have a greater influence on the node's attention. The hidden state updates have a greater impact. Through this aggregation process, the model will... The surrounding local topological information, the feature information of the neighbors, and the decay effect of the time dimension are compressed into a high-dimensional hidden state vector. This vector not only encodes the nodes The current state also implies the nodes. What changes are taking place in the environment? The weight parameters in T-GAT are obtained through unsupervised or self-supervised training on a large amount of historical normal operation data (such as link prediction tasks) and optimized through the backpropagation algorithm to ensure that the model can accurately capture the normal spatiotemporal dependency patterns of the power system.

[0037] Secondly, perform the future state prediction operation. This is done after obtaining the node... The historical hidden state sequence up to time t Next, the module needs to predict the behavior of the node at the next time step t+1. To this end, a sequence prediction component is cascaded into the module, using a gated recurrent unit (GRU). GRU is an optimized recurrent neural network (RNN) that effectively captures short- and long-term temporal dependencies through its internal update and reset gate mechanisms, while avoiding the vanishing gradient problem. As input to the GRU unit, the model outputs a prediction of the hidden state at the next time step based on historical evolution trends. This predicted value represents the node's performance under the premise that the system operates according to normal logic (i.e., conforms to physical laws and business specifications). The state that should be present at time t+1. For example, if historical data shows that photovoltaic output continues to increase steadily and the related IT system load is normal, the model will predict that the transformer load will also rise steadily to a certain position in the vector space at the next moment.

[0038] Finally, the anomaly score calculation is performed. When time progresses to t+1, the actual monitoring data (feature matrix) is... and event flow Upon arrival, the system calculates the node based on real data through the first step of the time sequence diagram encoding process. The actual hidden state at time t+1 At this point, the system has two vectors: one representing the expected normal state. and representing the actual observed state The module utilizes the Euclidean distance formula. To quantify the difference between the two. This represents the L2 norm operation, which calculates the square root of the sum of the squares of the differences between corresponding elements of two vectors. The result... That is, a node The anomaly score at time t+1. If the system is functioning correctly, the predicted and actual values ​​should highly overlap. The value approaches 0; conversely, if an anomaly occurs (such as a sudden voltage drop or database deadlock), the actual state will deviate drastically from the normal evolutionary trajectory, leading to... Far away in vector space Thus making This increases significantly. For example, if a server predicts a hidden CPU load of 40%, but actually spikes to 92% (at which point its eigenvalue is approximately 3.2), the vector distance between the two increases dramatically, resulting in a high anomaly score. Finally, the module aggregates the anomaly scores of all nodes at time t+1, forming a key-value pair dictionary of node anomaly scores, such as {'node_A':0.95,'node_B':0.88,'node_C':0.02,...}.

[0039] In particular, the anomaly scoring mechanism of the above embodiments has inherent technical flaws, stemming from the context-independent nature of its scoring process. This mechanism quantifies the degree of anomaly by calculating the Euclidean distance between the predicted and actual hidden states of each node, essentially treating interconnected entities in the power information system as independent atoms for isolated scoring. This atomized and decontextualized approach directly leads to the neglect of specific and critical causal dependencies within the system. In the complex network architecture of deeply integrated power IT / OT (Information Technology and Operational Technology), devices, application software, and business processes do not exist independently but rather form a tightly interdependent network through physical connections and logical calls. Faults often propagate along these dependencies in a hidden and highly destructive chain. For example, a core database lockout may propagate through middleware, ultimately manifesting as a timeout in the front-end business system. If only isolated monitoring of each node is performed, only anomalies in the business system at the end of the propagation chain can be detected, while the root cause hidden upstream and its propagation path are ignored. Conventional Euclidean distance-based difference calculations can only measure the numerical deviation between a node's current state and its expected state. This atomized and decontextualized approach severs the connection between a node and its topological environment, resulting in a lack of ability to distinguish between source-related anomalies and passively affected propagated anomalies. This easily leads to alarm storms without being able to pinpoint the root cause. Therefore, a dependency-weighted anomaly propagation and score fusion mechanism is introduced to construct a context-aware deep scoring system. By organically aggregating the deviation of a node's local state with the anomaly propagation pressure from upstream dependent nodes, the system quantifies the flow effect of faults in the network, thereby giving the final anomaly score a clear causal orientation and improving the identification of the root causes of cascading failures.

[0040] Based on this, in a feasible preferred technical solution, the time series graph encoding and prediction module 140 includes: a hidden state vector generation unit 141, used to perform time series graph encoding and future state prediction on the time series graph sequence to obtain a predicted hidden state vector; a local anomaly signal calculation unit 142, used to calculate the local anomaly signal between the predicted hidden state vector and the actually calculated hidden state vector; a propagation influence score calculation unit 143, used to perform upstream dependency anomaly propagation aggregation on the local anomaly signal in the basic knowledge graph to obtain a propagation influence score; and an anomaly score fusion unit 144, used to perform context-aware anomaly score fusion on the propagation influence score and the local anomaly signal to obtain a node anomaly score dictionary.

[0041] Specifically, the hidden state vector generation unit 141 serves as the starting point for computation. Continuing from the previously generated time-series graph sequence, it utilizes a built-in T-GAT (Time-Sequence Graph Attention Network) and GRU (Gated Recurrent Unit) combination model to encode the hidden state of each node at the current time step after topological aggregation. T-GAT captures the spatial influence of neighboring nodes on the current node, while GRU captures the temporal evolution. For any node u at time t+1, this unit outputs two key high-dimensional vectors: one is the predicted hidden state vector derived from historical states. One represents the ideal behavior pattern that the node should exhibit under normal logic; the other is the actual hidden state vector calculated based on the feature data flowing in in real time at the current moment. This represents a snapshot of the node's current operation. These two vectors reside in the same embedding space, with dimensions set to 64 or 128, and contain compressed representations of multimodal features such as node voltage, frequency, CPU load, and log semantics.

[0042] In a feasible preferred embodiment, the local anomaly signal calculation unit 142 is used to: calculate the local anomaly signal between the predicted hidden state vector and the actually calculated hidden state vector using the following formula: in, This represents the predicted hidden state vector of node u at time t+1. This represents the actual computed hidden state vector of node u at time t+1, while This represents the L2 norm, i.e., the Euclidean distance. This is a local anomaly signal. The physical meaning of this formula lies in measuring the displacement distance of a node in the feature space. If the node operates smoothly, the actual value and the predicted value highly overlap, and the distance approaches 0. If a sudden change occurs (such as a voltage drop or CPU spike), the actual vector will drift drastically in the high-dimensional space, causing the distance value to increase significantly. For example, the predicted state of a SCADA server corresponds to a low-load operating range, while the actual state jumps to a high-load range due to a network attack. The Euclidean distance between the two vectors might be calculated to be 0.85, and this value constitutes the server's most basic local anomaly signal.

[0043] Next, the propagation impact score calculation unit 143 is key to introducing context awareness, aiming to simulate the process of a fault spilling down the dependency chain from upstream to downstream, quantifying the environmental pressure borne by the current node. This unit first identifies all upstream dependent neighbors of the current node u based on the static edge set in the basic knowledge graph. For example, for an electricity billing application node, its upstream dependencies might include a marketing database and a private cloud server. The system then calculates the propagation impact score of each upstream neighbor k on the current node u. The calculation formula is: Among them, propagation weight It is not equally distributed, but is jointly determined by the static relation weights and the dynamic attention weights, that is... Static relation weights Based on preset expert rules, this distinguishes the strength of different dependencies. For example, the weight of a strong dependency (depends_on) is set to 0.9, while the weight of a weak connection (connects_to) is set to 0.3. Dynamic attention coefficient. The attention matrix generated by the T-GAT model at time t is directly extracted, reflecting the activity level of data interaction between the two nodes at the current time. If a serious failure occurs in the upstream marketing database ( =0.9S), and it is a strong dependency of electricity billing applications ( If the score is approximately 0.8, then the database will pass a propagation score of up to 0.9 × 0.8 = 0.72 to the application, indicating that the application is on an active fault propagation chain.

[0044] Finally, the anomaly score fusion unit 144 dialectically unifies internal factors (local bias) and external factors (propagation impact) to generate the final judgment basis. The system uses a linear weighted approach for combination, with the specific formula as follows: In the formula, It is a context fusion factor hyperparameter between 0 and 1. The setting of this parameter directly determines the system's detection preference: if set to... =0.7 (biased to local), the system focuses more on finding the source of the fault, i.e., those nodes with high local signal but low propagation signal; if set to =0.3 (biased propagation) means the system focuses more on assessing the scope of the fault's impact, highlighting the affected victim nodes. In real-world root cause localization scenarios, ... Set it between 0.6 and 0.8 to ensure that nodes marked as highly anomaly are primarily the instigators of faults. For example, for the marketing database mentioned above, which itself is severely faulty ( =0.9), and being at the top of the chain, it is less affected by others ( ≈0), the final score calculated is 0.6×0.9+0.4×0=0.54; while for downstream electricity bill calculation applications, although its local fluctuations may be slight ( =0.1), but is strongly influenced by the database ( =0.72), and its final score is 0.6×0.1+0.4×0.72=0.348. By comparing the final scores, the system can clearly identify the database as the primary root cause, thus achieving accurate differentiation of the nature of the fault, and ultimately all calculated... The values ​​are encapsulated as a dictionary output, providing high-confidence data support for subsequent automated root cause tracing.

[0045] Specifically, the root cause node generation module 150 is used to trace the anomaly sources of the node anomaly score dictionary and time series sequence based on anomaly thresholds to obtain potential root cause nodes. It should be understood that in the anomaly detection system of the power information system, although the preceding modules have accurately quantified the anomaly scores of all nodes in the network, this only reveals the superficial distribution of faults, not the causal logic. Faced with cross-domain cascading faults, maintenance personnel are often overwhelmed by massive amounts of alarm information. Most of these alarms are symptoms at the end of the fault propagation chain, rather than the source that triggers the avalanche. For example, the power prediction deviation (symptom) seen by the dispatcher may originate from a locked marketing database, which in turn may originate from network packet loss in the underlying storage. At this point, only investigating the dispatch system is futile. To unravel the complex concurrent alarms, it is necessary to trace back along the opposite direction of data flow, utilizing the spatiotemporal topology. Only by eliminating irrelevant background noise and reconstructing a clear propagation link from the symptom node directly to the source node can the root cause of the fault be truly located. Therefore, the purpose of using the anomaly tracing step is to establish causal connections in a massive amount of anomaly signals. By filtering out appearances, tracing paths, and reconstructing fault subgraphs, scattered point-like anomalies are restored into chain-like causal facts, thereby accurately pinpointing the potential root cause nodes that trigger network-wide fluctuations.

[0046] Figure 4This is a schematic diagram of the data flow in the root cause node generation module of the power information data flow anomaly detection system according to an embodiment of this application. Figure 4 As shown, in a feasible technical solution, the root cause node generation module 150 includes: a node filtering instantiation unit 151, used to perform characterization node filtering and anomaly set instantiation on the node anomaly score dictionary based on anomaly threshold to obtain a characterization node set; an anomaly propagation subgraph generation unit 152, used to perform spatiotemporal causal subgraph inverse extraction on each characterization node in the characterization node set in the time series graph sequence to obtain an anomaly propagation subgraph; and a root cause measurement unit 153, used to perform multi-dimensional root cause measurement scoring on the anomaly propagation subgraph to obtain potential root cause nodes.

[0047] Specifically, the root cause node generation module 150 processes the following: The node filtering instantiation unit 151 aims to filter out the core objects that are currently exhibiting fault symptoms from tens of thousands of nodes across the entire network. This process first receives the node anomaly score dictionary output by the previous module, such as {'node_A':0.95,'node_B':0.88,'node_C':0.02,...}. This unit sets a key parameter, the anomaly threshold. This threshold The statistical boundary is calculated based on historical normal operation data and is set as the 99th percentile or mean of all node anomaly scores plus three standard deviations (M). ), for example, setting =0.8. During implementation, the first step is to perform a numerical filtering operation. The system iterates through every key-value pair in the dictionary, filtering each node... At the present moment abnormal scores With threshold A point-by-point comparison is performed. For example, for node A (corresponding to the aforementioned voltage anomaly node), its score is 0.95, which is greater than 0.8, and it is judged as an anomaly; for node C, its score is 0.02, which is less than 0.8, and it is judged as normal. The second step is to perform a set construction operation. The system extracts all nodes with scores exceeding the limit, i.e. > The nodes are identified and defined as representation nodes. These nodes are the explicit victims of the fault at the current moment, forming the starting point for tracing the source. Finally, based on the formal definition... Instantiate all nodes that meet the conditions into a set of representation nodes. (For example ).

[0048] The anomaly propagation subgraph generation unit 152 is implemented as a reverse tracing operation in the spatiotemporal dimension. This unit relies on a time-series graph sequence containing rich historical information. For sets Each representation node in Initiate the tracing process. The first step in the process is to perform a recursive reverse search operation to characterize the nodes. If an anomaly node in the power prediction data is taken as the starting point, the system performs a reverse traversal of the graph using either breadth-first search (BFS) or depth-first search (DFS). Here, "reverse" refers to traversing along the opposite direction of the edges; for example, if an edge database exists in the graph... For predictive applications, the search direction is from the predictive application back to the database. The second step involves dynamic adjacency determination. To ensure the tracing path is physically and logically feasible, the search process only follows edges that actually exist at the corresponding historical moment. Edge set It includes two types: one is static edges. For example, `depends_on` indicates a dependency relationship that always exists, representing inherent business logic such as settlement depending on meter reading; secondly, there are dynamic time-series edges. For example, `api_call`, which refers to an API call, only exists at the specific moment the interaction occurs. The system checks the backtracking time window. Within the database, is there a valid connection? For example, if application A did indeed call database B within 5 seconds before the failure occurred, this path is considered valid; if there is no call record, even if the two are logically related, it may not be triggered in this failure. The third step is to implement anomaly correlation pruning strategies. This is crucial to prevent false positives and noise interference. This involves backtracking to the previous node. (Right now When this happens, the system not only checks if the connection exists, but also checks the preceding node. Are the outlier scores significant at the corresponding historical time points? An auxiliary threshold is introduced here. Slightly lower For example, 0.5 is used to capture subtle early signs of a fault, and is also obtained based on historical data analysis. If the preceding node... abnormal scores ,illustrate Although connected However, it is functioning normally on its own, so it is unlikely to be the source of the fault (it could be...). (Due to its own problems or influence from other nodes), the system will cut off further searching of that branch (pruning). Conversely, if Then retain the node. As an intermediate propagation node, and continue to use Starting from the beginning, the process traces backwards. The fourth step involves subgraph reconstruction. After the recursive search and pruning described above, the system reassembles all remaining nodes (representation nodes, intermediate propagation nodes, and potential root cause nodes) and the valid edges connecting them. This reassembled structure forms a directed acyclic graph (DAG) or a locally connected graph, known as the anomaly propagation subgraph. This subgraph removed 99% of irrelevant nodes from the entire network graph, retaining only the causal chains directly related to this failure. Finally, based on the formal definition... Provide a mathematical description. Among them, The function represents a recursive backtracking process, that is, for each element belonging to... nodes Search forward for the predecessor node that meets the conditions. .condition It is clearly stipulated that only when At time t, it is connected via an edge. ,and Only when its own abnormal score exceeds a low threshold is it included in the source tracing path. The final output... This is the anomaly propagation subgraph, which clearly shows how the fault propagates step by step from the root cause node at the bottom layer and leads to the final characterization node experiencing an anomaly.

[0049] Root cause measurement unit 153 focuses on the propagation subgraph of the generated anomalies. In-depth numerical analysis is performed. This unit assigns a quantified confidence score to each node in the subgraph by calculating composite indicators. The first step in implementation is to perform root cause feature calculation. The system traverses the subgraph. Each node in And calculate the feature values ​​for it in three key dimensions. The first is the anomaly intensity. The system queries historical data on node anomaly scores (this data is stored in the historical dictionary sequence generated by the time series graph coding prediction module) and extracts the nodes. Abnormal score peaks during the fault window. For example, At 10:00:05, it reached an extremely high outlier score of 0.99. =0.99. This feature reflects the severity of node failures, with the root cause node exhibiting the most significant anomalies. The second most significant feature is time-series lead. The system records nodes The first occurrence of an anomaly (i.e., a score exceeding a low threshold) timestamp In a causal chain, the cause must precede the effect; therefore, the earlier the event occurs, the greater the likelihood that the node is the root cause. For example, if node A becomes abnormal at 10:00:01 and node B becomes abnormal at 10:00:03, then A is more likely to be the root cause. Finally, there is topological influence. System computing nodes The out-degree in the anomaly propagation subgraph, i.e. Out-degree indicates how many subsequent anomalous nodes a node directly points to. A root cause node that triggers a widespread chain reaction (such as a core switch) often points to multiple downstream nodes in the subgraph and has a high out-degree; while symptom nodes at the end of the chain have an out-degree of 0. The second step is to perform a weighted scoring operation. After obtaining the above three features, the system uses a linear weighted comprehensive formula to calculate the node's score. The final root cause confidence score The formula is: In this formula: This is the anomaly strength item, which directly uses the node's score at the moment the anomaly was triggered. It is the time-series decay term, where It is the starting point of the entire anomaly propagation cycle where the anomaly is first detected. It is the start time of the anomaly of the current evaluation node k. This is a preset time decay coefficient, determined through training and optimization on a historical fault dataset using algorithms such as grid search or gradient descent, with the goal of optimizing root cause localization accuracy. For example, it might be set to 0.5. This term utilizes the properties of an exponential function to... The smaller the value, the closer the time of the anomaly at node k is to the beginning of the entire failure chain, the larger the value of this item, thus giving higher weight to early abnormal nodes in the score. This is consistent with the temporal logic of root cause analysis, where the root cause occurs before the derivative symptoms. It is the normalized topological influence term, where This is the total number of nodes in the subgraph, which measures the proportion of influence of each node on the subgraph as a whole. , and These are weighting parameters, set through expert experience (e.g.) =0.4, =0.3, =0.3) or obtained through reverse training using historical failure cases to balance the importance of the three dimensions. The third step is to perform sorting and reporting operations. The system calculates the value of all nodes in the subgraph. Then, they are sorted in descending order of their scores. The system extracts the top-K nodes, such as the top-3, and marks them as potential root cause nodes. Finally, the system encapsulates the information of these root cause nodes, along with their complete propagation paths pointing to the representative nodes in the subgraph (e.g., Root_A->Mid_B->Symptom_C), into a JSON-formatted data packet or a visual chart report. This report not only tells the operations personnel who is faulty (Root_A), but also clearly shows how the anomaly propagated (path), providing the most direct decision-making basis for rapid fault isolation and repair.

[0050] In summary, the power information data flow anomaly detection system 100 based on the embodiments of this application is explained to solve the problems of difficulty in detecting data flow anomalies and lack of causal inference caused by the separation of IT and OT systems. First, heterogeneous OT monitoring data and IT business data are acquired in real time. Through multi-source alignment and feature processing, differences in time series frequency and data modality are eliminated, generating a unified feature matrix and event flow. Then, using a basic knowledge graph containing entity assets, topology, and business processes as the framework, real-time features are dynamically attached to graph nodes, and dynamic association edges are generated based on the event flow, thereby constructing a continuously evolving time-series graph sequence. On this basis, time-series graph encoding prediction technology is used to learn the spatiotemporal features of the graph sequence, calculating node anomaly scores by predicting the deviation between future states and actual states. Once an anomaly is detected, the system performs reverse tracing based on the time-series graph structure, using the clearly defined physical and logical connection paths in the graph to accurately locate the potential root cause nodes leading to a chain reaction of failures, thereby achieving causal correlation analysis of cross-domain data flows and full-link anomaly state perception.

[0051] To further achieve closed-loop operation and maintenance from fault location to intelligent handling, the system also includes a handling plan recommendation module. This module receives the potential root cause nodes and anomaly propagation subgraphs as input and uses a large language model and retrieval augmented generation (RAG) technology to generate specific maintenance strategies. Specifically, this module first constructs an alarm handling knowledge base based on ontology theory. It performs Chinese word segmentation and stop word removal on massive, multi-source, heterogeneous business alarm information, uses the Skip-Gram model in Word2Vec for distributed word vector training to extract semantic features, and extracts scenario fields using the Horspool pattern matching algorithm. Combining a tree structure matching mechanism of scenario, equipment, and event information, the alarm information is standardized and classified into accident level, anomaly level, displacement level, or notification level. Then, a six-tuple (alarm event, trigger condition, response measure, responsible role, time series, status information) is used to standardize and store historical faults and contingency plans. Subsequently, for the identified root cause node features, a hybrid retrieval technology combining sparse and dense vectors is used. On the one hand, the BM25 algorithm is used to construct a sparse index to accurately match keywords; on the other hand, BGEEm is used... The bedding model encodes text fragments to capture dense vectors of deep semantic information. Candidate fragments are selected by calculating the mixed score of the inner product of the two. Furthermore, a ROM semantic relevance model is introduced to rearrange the preliminary search results, selecting the historical handling cases with the highest semantic relevance. Finally, through search enhancement generation technology, before merging the retrieved key text fragments with the current fault context, the content validity is judged by a text filter. If the search results are insufficient to answer the question, a query rewriting mechanism based on synonym expansion is initiated to prevent semantic drift. Subsequently, the filtered and denoised valid text blocks are merged with the question. Under the premise of complying with the context window constraints, a prompting engineering input generative large language model is used to output specific handling suggestions for the root cause node (such as restarting the service, isolating the device, switching the route, or adjusting parameters), thereby assisting the operation and maintenance personnel to quickly complete the fault repair.

Claims

1. A power information data stream abnormality detection system, characterized in that, include: The real-time data acquisition module is used to acquire real-time OT data streams and real-time IT data streams; The data alignment and characterization module is used to perform real-time alignment and characterization of multi-source heterogeneous data streams such as real-time OT data streams and real-time IT data streams to obtain aligned feature matrices and event streams. The time sequence graph generation module is used to attach node features and generate dynamic event edges to the aligned feature matrix and event stream based on the basic knowledge graph to obtain a time sequence graph sequence. The temporal graph encoding and prediction module is used to perform temporal graph encoding and future state prediction on the temporal graph sequence to obtain a dictionary of node anomaly scores. The root cause node generation module is used to trace the source of anomalies in the node anomaly score dictionary and time series sequence based on anomaly thresholds to obtain potential root cause nodes.

2. The power information data stream abnormality detection system according to claim 1, characterized in that, The data alignment and characterization module includes: The raw data preprocessing unit is used to perform multi-granularity time-series window alignment and aggregation on real-time OT data streams and real-time IT data streams to obtain a synchronized raw data vector set. The heterogeneous modal feature mapping unit is used to perform heterogeneous modal feature mapping and matrix construction on each synchronized original data vector in the synchronized original data vector set to obtain the aligned feature matrix; An event stream generation unit is used to perform discrete event pattern recognition on the aligned feature matrix to obtain an event stream.

3. The power information data stream abnormal state detection system according to claim 2, characterized in that, The event stream generation unit includes: The numerical state determination subunit is used to perform numerical state determination on the aligned feature matrix based on adaptive statistical boundaries to obtain a set of numerical anomaly events. The text intent recognition subunit is used to perform text intent recognition based on semantic space projection on the aligned feature matrix to obtain a set of text semantic events. The multimodal event fusion subunit is used to perform multimodal event fusion on the text semantic event set and the numerical anomaly event set to obtain the event stream.

4. The power information data stream abnormal state detection system according to claim 1, characterized in that, The construction process of the basic knowledge graph includes: Multi-source heterogeneous entity extraction and node-based modeling are performed on the IT asset database, OT equipment list and business process definition to obtain a global entity node set; A static edge set is obtained by extracting two-layer static relationships between the system topology diagram and the business process definition. A graph structure fusion is performed on the global entity node set and the static edge set to obtain a basic knowledge graph.

5. The power information data stream abnormal state detection system according to claim 1, characterized in that, The time-series graph coding prediction module includes: The hidden state vector generation unit is used to perform time-series graph encoding and future state prediction on the time-series graph sequence to obtain the predicted hidden state vector. The local anomaly signal calculation unit is used to calculate the local anomaly signal between the predicted hidden state vector and the actually calculated hidden state vector. The propagation impact score calculation unit is used to perform upstream dependency anomaly propagation aggregation on local anomalous signals in the basic knowledge graph to obtain the propagation impact score. The anomaly score fusion unit is used to perform context-aware anomaly score fusion on the propagation impact score and the local anomaly signal to obtain the node anomaly score dictionary.

6. The power information data stream abnormal state detection system according to claim 5, characterized in that, The local anomaly signal calculation unit is used to calculate the local anomaly signal between the predicted hidden state vector and the actually calculated hidden state vector using the following formula: in, This represents the predicted hidden state vector of node u at time t+1. This represents the actual computed hidden state vector of node u at time t+1, while This represents the L2 norm, i.e., the Euclidean distance. This is a local anomaly signal.

7. The power information data stream abnormal state detection system according to claim 1, characterized in that, The root cause node generation module includes: The node filtering instantiation unit is used to perform node filtering and anomaly set instantiation on the node anomaly score dictionary based on the anomaly threshold to obtain the node representation set. An anomaly propagation subgraph generation unit is used to extract an anomaly propagation subgraph from each of the representation nodes in the set of representation nodes by performing a spatiotemporal causal subgraph inverse extraction from the time sequence graph sequence. The root cause measurement unit is used to perform multi-dimensional root cause measurement scoring on the anomaly propagation subgraph to obtain potential root cause nodes.

Images