Virtual scene data annotation generation method, system, equipment and medium

Abstract

The invention relates to a virtual scene data annotation generation method, system and device and a medium, and belongs to the technical field of business processing, and the method comprises the steps: obtaining a multi-source log stream of a business system in real time, and generating a real-time event; according to the event type of the real-time event, generating expiration time, obtaining a set time window, and storing the set time window into an event buffer pool; searching all events which have the same entity and are in a set time window in the event buffer pool, and when the number of the events is not smaller than a threshold value, sorting the events according to timestamps to form scene events; matching the scene event with the causal atlas, searching a corresponding causal strength from the causal atlas for each continuous event pair in the scene event, and calculating a compliance score; if the compliance score is smaller than a compliance threshold value, marking the scene event to be abnormal; traversing the causal atlas, and recording the types of events which should occur and do not occur in the scene events as missing events. The method has the beneficial effects of efficiently and accurately detecting and labeling the abnormal event.

Description

Technical Field

[0001] This application relates to the technical field of business processing, and in particular to a method, system, device and medium for generating virtual scene data annotations. Background Technology

[0002] In today's digital age, the application of virtual scenes is becoming increasingly widespread, encompassing numerous fields such as gaming, virtual reality, industrial simulation, and intelligent monitoring. Virtual scene data contains a wealth of information, and accurate annotation and analysis can provide strong support for decision-making, anomaly detection, and business optimization within these scenarios. For example, in intelligent monitoring scenarios, analyzing event data within the virtual scene can promptly identify potential security threats; in industrial simulation, annotation of virtual scene data can help optimize production processes and improve efficiency. Therefore, how to efficiently and accurately annotate and generate virtual scene data has become an urgent problem to be solved.

[0003] Currently, the common approach to generating annotations for virtual scene data is based on fixed rule-based annotation methods. This method predefines a series of explicit rules, and when data meets specific rules, it is labeled as the corresponding category or event. For example, in a surveillance scenario, when a specific object appears in the scene with a certain speed, direction, or behavior pattern, it is identified as a specific event and labeled accordingly.

[0004] However, in practical applications, events in virtual scenes are often diverse and uncertain, with new event types and patterns emerging at any time. Since the rules in the methods described above are pre-defined, they cannot cover all these situations, resulting in many newly emerging events not being accurately labeled, thus affecting the comprehensive analysis and utilization of virtual scene data. Summary of the Invention

[0005] To efficiently and accurately detect and label abnormal events, this application provides a method, system, device, and medium for generating virtual scene data annotations.

[0006] Firstly, this application provides a method for generating virtual scene data annotations, employing the following technical solution: A method for generating virtual scene data annotations, comprising: It acquires multi-source log streams from business systems in real time, parses and structures each new log entry, and generates real-time events. Based on the event type of the real-time event, an expiration time is generated and stored in a preset event buffer pool; Using the entity of the real-time event as the key, search the event buffer pool for all events with the same entity and whose time is within a set time window, and generate a candidate scene set. The set time window is generated based on the expiration time. When the number of events in the candidate scene set is not less than a threshold, the events are sorted by timestamp to form scene events; The scenario events are matched with a pre-built causal graph. For each consecutive event pair in the scenario events, the corresponding causal strength is found in the causal graph, and the corresponding compliance score is calculated based on the causal strength. If the compliance score is less than the compliance threshold, the scene event is determined to be abnormal and marked. Traverse the causal graph and record the types of events that should have occurred but did not appear in the scenario events as missing events.

[0007] By adopting the above technical solutions, and through real-time acquisition of multi-source log streams from the business system and parsing and structuring new logs, raw unstructured logs can be quickly transformed into structured information, greatly improving data processing efficiency. In event management, expiration times are generated based on the type of real-time event, and events are stored in an event buffer pool, achieving effective management and storage of events. Setting expiration times avoids indefinite storage of events, saving storage space and ensuring that only valid events are processed. Furthermore, by using entities as keys to find related events and generating candidate scenario sets, related events are accurately linked to construct meaningful scenarios. Setting time windows based on expiration times ensures the rationality and accuracy of scenario construction, enabling scenarios to truly reflect the actual situation. Matching scenario events with pre-built causal graphs, calculating compliance scores, and identifying anomalies—this causal-based anomaly detection method can deeply explore the intrinsic connections between events, promptly identifying potential anomalies and security risks. When anomalies are identified, further locating missing events helps analyze the causes of the anomalies and take corresponding measures, thereby improving system stability and reliability and reducing system failures and losses caused by anomalies. Meanwhile, the generated anomaly markers and missing event information can provide valuable references for decision-makers.

[0008] Optionally, the steps following the generation of the candidate scene set may also include: When the number of events in the candidate scene set is less than a threshold, the topic similarity and type similarity between other events and the real-time event are calculated in the buffer pool, and a semantic similarity is obtained, wherein the semantic similarity = topic similarity. K1+ type similarity K2; Events with semantic similarity greater than the semantic similarity threshold and whose timestamps are close to those of the real-time events are added to the candidate scene set. The events in the new candidate scene set are then sorted by timestamp to form aggregated scene events.

[0009] By adopting the above technical solution, when the number of events in the candidate scenario set is less than a threshold, it indicates that the currently constructed scenario may not be complete enough to fully reflect the actual situation. Semantic similarity is obtained by calculating the topic similarity and type similarity between other events and real-time events. Events with semantic similarity greater than the threshold and similar timestamps are added to the candidate scenario set, supplementing more relevant events and making the scenario more complete. The semantic similarity calculation considers both the topic and type of the event, enabling a more accurate judgment of the correlation between events. This method can accurately link related events from different stages of the same business process, avoiding interference from irrelevant events and improving the accuracy of the scenario. The aggregated scenario events contain more relevant information, making it more accurate to determine whether the scenario is abnormal when matching it with the pre-built causal graph to calculate compliance scores. Because a more complete scenario can more comprehensively reflect the causal relationships between events, it reduces misjudgments caused by missing information. At the same time, the recording of missing events will be more accurate, helping to analyze the causes of anomalies more deeply and providing a more reliable basis for system optimization and improvement.

[0010] Optionally, the steps following marking the abnormal scenario include: Using the endpoint event or missing event of the abnormal scenario as the root, backtrack along the causal graph to trace all possible parent nodes and generate a causal subgraph. Calculate the contribution score of each node in the causal subgraph; The node with the highest contribution score is selected as the root cause event, and a scene annotation record is generated. The scene annotation record includes: scene event ID, event sequence, timestamp sequence, status label, and root cause event ID.

[0011] By employing the aforementioned technical solution, and using the endpoint event or missing event of the abnormal scenario as the root, the system traces back along the causal graph to all possible parent nodes and generates a causal subgraph. This allows for a comprehensive and in-depth analysis of the causal chain of events related to the abnormal scenario. Based on this, the contribution score of each node in the causal subgraph is calculated, quantifying the impact of each event on the abnormal scenario. Finally, the node with the highest contribution score is selected as the root cause event, accurately identifying the most critical factor leading to the anomaly. Accurately identifying the root cause event provides a clear direction for system optimization and improvement. Once the root cause of the anomaly is determined, targeted adjustments and optimizations can be made to the relevant processes.

[0012] Optionally, the steps following the generation of scene annotation records include: Receive feedback information from maintenance personnel to confirm root causes or false alarms; Based on the feedback information, the weight of confirmed causal edges in the causal graph is increased, the weight of confirmed non-existent edges in the causal graph is decreased, and the generation of expiration time is optimized.

[0013] By adopting the above technical solutions, the system receives feedback from operations and maintenance personnel regarding root causes or false alarms, and adjusts the weights of causal edges in the causal graph accordingly. This allows the causal graph to more accurately reflect the true causal relationships between events. With continuous adjustment and optimization of the causal graph weights, the system becomes more efficient and accurate in detecting abnormal scenarios and locating root causes. When new abnormal events occur, the system can quickly find possible root cause events based on a more accurate causal graph, reducing the scope and time of investigation. Optimizing the generation of expiration times based on feedback from operations and maintenance personnel allows for more rational management of the event buffer pool. The expiration time setting directly affects the storage and use of events in the buffer pool. If the expiration time is set too long, it will lead to an accumulation of too many invalid events in the buffer pool, increasing the system's storage burden and processing time; if the expiration time is set too short, some important related events may be lost, affecting the integrity and accuracy of the scenario. By incorporating feedback from operations and maintenance personnel and optimizing expiration times, the expiration time can be dynamically adjusted based on the actual situation and causal relationships of different types of events. This ensures that the event buffer pool can retain sufficient useful information while promptly cleaning up useless data, thereby improving system operating efficiency.

[0014] Optionally, the step of generating an expiration time based on the event type of the real-time event includes: According to the event type, a preset time is retrieved, and the time is extended according to the historical time sequence deviation corresponding to the event type to obtain an adjustment window, wherein the adjustment window = preset time + extended time; An expiration time is generated based on the timestamp of the real-time event and the adjustment window.

[0015] By adopting the above technical solution, different types of events have different effective durations in actual business operations. The preset time is set based on the general patterns of event types, while historical time series deviations reflect the time fluctuations of this type of event in the past. By combining these two factors to obtain an adjustment window, the expiration time setting can be more closely aligned with actual business scenarios.

[0016] Optionally, the steps for constructing the causal map include: Collect historical multi-source log data from business systems, and parse and structure each historical log to generate historical events; Analyze the chronological order of historical events, identify leading-lagging relationships, and generate an ordered sequence of historical events; Based on the historical event sequence, the co-occurrence frequency, conditional probability, and time interval distribution of event pairs are calculated, and potential causal relationships are mined by combining the chronological order. The causal inference method is applied to quantify the dynamic causal strength between events and to verify the reliability of causal relationships; After verification, a multi-layered causal graph is constructed, with event type as nodes, causal relationship as directed edges, and entity type as attribute association nodes.

[0017] Optionally, the virtual scene data annotation generation method further includes: Based on the generated scene annotation records, an abnormal scene case library is constructed; Periodically perform cluster analysis on the labeled records in the abnormal scenario case library to extract typical abnormal patterns and corresponding root cause features; Using the typical anomaly patterns and root cause features, the structure and causal strength of the causal graph are iteratively optimized, and the preset compliance threshold and semantic similarity threshold are updated.

[0018] By adopting the above technical solutions and closed-loop optimization mechanisms, the virtual scene data annotation generation method can not only passively detect and record anomalies, but also proactively adapt to business changes and emerging threats, continuously improving the accuracy and efficiency of anomaly detection and the precision of root cause localization, thereby continuously enhancing the stability and reliability of the business system.

[0019] Secondly, this application provides a virtual scene data annotation and generation system, which adopts the following technical solution: A virtual scene data annotation and generation system, comprising: The log acquisition module is used to acquire multi-source log streams from the business system in real time. The log parsing module is used to parse and structure each new log entry to generate real-time events; The log processing module is used to generate an expiration time based on the event type of the real-time event and store it in a preset event buffer pool; The event lookup module is used to search for all events with the same entity and whose time is within a set time window in the event buffer pool, using the entity of the real-time event as the key, and to generate a candidate scene set. The set time window is generated according to the expiration time. The judgment and processing module is used to sort the events by timestamp to form scene events when the number of events in the candidate scene set is not less than a threshold. The annotation module is used to match the scene events with a pre-built causal graph. For each consecutive event pair in the scene event, the corresponding causal strength is found from the causal graph, and the corresponding compliance score is calculated based on the causal strength. If the compliance score is less than the compliance threshold, the scene event is determined to be abnormal and marked. The causal graph is traversed, and event types that should occur but do not appear in the scene event are recorded as missing events.

[0020] Thirdly, this application provides a computer device that adopts the following technical solution: A computer device includes a memory, a processor, and a computer program stored in the memory, the processor executing the computer program to implement the virtual scene data annotation generation method as described in the first aspect.

[0021] Fourthly, this application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium storing a computer program that can be loaded by a processor and executed as described in the first aspect of the virtual scene data annotation generation method.

[0022] In summary, this application includes at least one of the following beneficial technical effects: By acquiring multi-source log streams from business systems in real time and parsing and structuring new logs, raw unstructured logs can be quickly transformed into structured information, greatly improving data processing efficiency. In event management, expiration times are generated based on the type of real-time event, and events are stored in an event buffer pool, achieving effective management and storage of events. Setting expiration times avoids indefinite storage of events, saving storage space and ensuring that only valid events are processed. Furthermore, by using entities as keys to find related events and generating candidate scenario sets, related events are accurately linked to construct meaningful scenarios. Setting time windows based on expiration times ensures the rationality and accuracy of scenario construction, enabling scenarios to truly reflect the actual situation. Matching scenario events with pre-built causal graphs, calculating compliance scores, and identifying anomalies—this causal-based anomaly detection method can deeply explore the intrinsic connections between events, promptly identifying potential anomalies and security risks. When anomalies are identified, further locating missing events helps analyze the causes of the anomalies and take corresponding measures, thereby improving system stability and reliability and reducing system failures and losses caused by anomalies. Meanwhile, the generated anomaly markers and missing event information can provide valuable references for decision-makers. Attached Figure Description

[0023] Figure 1 This is a first flowchart of an embodiment of the method of this application; Figure 2This is a second flowchart of an embodiment of the method of this application; Figure 3 This is a third flowchart of an embodiment of the method of this application; Figure 4 This is the fourth flowchart of an embodiment of the method of this application. Detailed Implementation

[0024] To make the purpose, technical solution, and advantages of this application clearer, the following description is provided in conjunction with the appendix. Figure 1-4 The present application will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the application.

[0025] The first embodiment of this application discloses a method for generating virtual scene data annotations. (Refer to...) Figure 1 The virtual scene data annotation generation method includes S110-S170: S110 acquires multi-source log streams from business systems in real time, parses and structures each new log, and generates real-time events. S120: Generate an expiration time based on the event type of the real-time event and store it in a preset event buffer pool; S130: Using the entity of the real-time event as the key, search the event buffer pool for all events with the same entity and whose time is within the set time window, and generate a candidate scene set. The set time window is generated based on the expiration time. S140: When the number of events in the candidate scene set is not less than the threshold, sort the events by timestamp to form scene events; S150 matches scene events with a pre-built causal graph. For each consecutive event pair in the scene event, it finds the corresponding causal strength from the causal graph and calculates the corresponding compliance score based on the causal strength. S160, if the compliance score is less than the compliance threshold, the scene event is judged to be abnormal and marked; S170, traverse the causal graph and record the types of events that should have occurred but did not appear in the scene events as missing events.

[0026] Specifically, log sources (including application logs, database logs, and network logs) from business systems (such as e-commerce platforms or IT operations systems) are collected in real time via Apache Kafka message queues to ensure high throughput and low latency. Each new log entry is structured using a Logstash parser: for example, the raw log text (e.g., "2023-10-01 12:00:00ERROR user_login_failed user_id=123") is converted into a JSON-formatted event object, including a timestamp, event type (e.g., "login_failure"), entity (e.g., "user_id:123"), and additional attributes (e.g., error code). These events are then stored in a Redis in-memory database as an event buffer pool, leveraging its key-value storage feature for fast read and write operations.

[0027] The steps in S120 to generate an expiration time based on the event type of a real-time event include: Based on the event type, retrieve the preset time and extend the time according to the historical time sequence deviation corresponding to the event type to obtain the adjustment window. The adjustment window = preset time + extended time. Generate expiration times based on the timestamps of real-time events and the adjusted window.

[0028] Specifically, the system retrieves a preset time based on the event type (e.g., for the "login_failure" event, the preset time is set to 2 minutes) and extends the time based on historical time series deviation: the historical deviation is calculated by analyzing similar event sequences over the past 30 days (e.g., using standard deviation to measure time fluctuation), and the extended time is 1.5 times the deviation value (e.g., if the average deviation is 30 seconds, then the extended time is 45 seconds), thus generating an adjustment window (e.g., 2 minutes + 45 seconds = 2.75 minutes). This design considers the randomness of event occurrence and avoids scene omissions or redundancy caused by fixed time windows. Subsequently, based on the real-time event timestamp (e.g., 12:00:00) and the adjustment window, the expiration time (e.g., 12:02:45) is directly calculated to define the timeliness boundary of the event.

[0029] Furthermore, the steps following the generation of the candidate scene set in S130 also include: When the number of events in the candidate scene set is less than a threshold, the topic similarity and type similarity between other events and real-time events are calculated in the buffer pool, and the semantic similarity is obtained. Semantic similarity = topic similarity. K1+ type similarity K2; Events with semantic similarity greater than the semantic similarity threshold and whose timestamps are close to those of real-time events are added to the candidate scene set. The events in the new candidate scene set are then sorted by timestamp to form aggregated scene events.

[0030] Specifically, the system uses the entity of the real-time event (such as "user_id:123") as the key and uses a range query (ZRANGEBYSCORE command) in the Redis buffer pool to retrieve all events with the same entity and whose timestamps are within a set time window [timestamp - adjustment window, expiration time] (for example, querying events between 12:00:00-2.75 minutes and 12:02:45), forming an initial candidate scenario set.

[0031] If the number of events in the candidate set is not less than the threshold (e.g., 3 events), the scene event sequence is generated directly by sorting by timestamp (using a quicksort algorithm). Otherwise, the system calculates the semantic similarity between other events in the buffer pool and real-time events: topic similarity is calculated using TF-IDF vectorization and cosine similarity (e.g., converting event description text into word frequency vectors), type similarity is based on a predefined event type classification tree (e.g., the similarity between the "login" class and the "authentication" class is set to 0.8), and semantic similarity is a weighted sum of the two (range 0-2, threshold set to 1.2). K1 and K2 can be set through the system backend. Events with high semantic similarity and similar timestamps (difference less than 1 minute) are added to the candidate set and sorted again to form aggregated scene events. This mechanism solves the problem of insufficient information under sparse events by dynamically expanding the scene, while using semantic analysis to improve the relevance of the scene.

[0032] After the scene events are generated, the anomaly detection phase (S150-S170) begins. The system matches the scene event sequence with a pre-built causal graph (stored in the Neo4j graph database): for each consecutive event pair (e.g., "login_failure" followed by "password_reset"), the corresponding causal strength (edge ​​weight, based on historical statistics) is retrieved from the graph, and the compliance score is calculated as the average of the causal strengths of the event pair (e.g., the strength value is between 0 and 1, and a score below 0.6 is considered an anomaly).

[0033] In S160, if the compliance score is less than the compliance threshold (dynamically adjusted, initially set to 0.5), the scenario event is marked as abnormal. Simultaneously, S170 traverses the causal graph, checking for event types that should have occurred but did not (e.g., "login_success" should typically be followed by "login_failure"), and records them as missing events. The entire real-time processing chain adopts a microservice architecture, with each step operating as an independent service (e.g., implemented using Spring Boot), communicating asynchronously via message queues to ensure performance under high concurrency.

[0034] Reference Figure 2 The steps for constructing the causal map in S150 include S210-S250: S210 collects historical multi-source log data from the business system, and parses and structures each historical log to generate historical events; S220 analyzes the chronological order of historical events, identifies leading-lagging relationships, and generates an ordered sequence of historical events. S230, based on historical event sequences, calculates the co-occurrence frequency, conditional probability, and time interval distribution of event pairs, and mines potential causal relationships by combining the chronological order; S240, apply causal inference method to quantify the dynamic causal strength between events and verify the reliability of causal relationship; S250, after verification, construct a multi-layered causal graph with event type as node, causal relationship as directed edge, and entity type as attribute association node.

[0035] Specifically, in S210, the system collects historical multi-source logs (such as data from the past 6 months), performs batch parsing and structuring using Elasticsearch, and generates a historical event database. S220 analyzes the lead-lag relationship of the event sequence: using the Granger causality test algorithm (implemented in Python's statsmodels library), it identifies the temporal order of event pairs (e.g., "server_overload" precedes "response_timeout"), generating an ordered sequence. Next, S230 calculates the co-occurrence frequency (using sliding window counting), conditional probability (P(B|A) = number of co-occurrences / number of occurrences of A), and time interval distribution (using kernel density estimation) of event pairs, combining the temporal order to mine potential causal associations (e.g., high co-occurrence frequency and short intervals indicate strong causality). S240 applies causal inference methods (such as the PC algorithm to quantify dynamic causal strength through conditional independence tests) and verifies reliability (using bootstrap sampling to test confidence levels, with strength values ​​retained at a confidence level of 95% or higher). Finally, S250 constructs a multi-layered causal graph: In Neo4j, event types are used as nodes (attributes include entity types), causal relationships are directed edges (weight = causal strength), and entity types are associated with nodes to form subgraphs (e.g., the "user" entity type is associated with all user-related events), which facilitates efficient querying.

[0036] Reference Figure 3 The steps following the marking of abnormal scenarios include S310-S350: S310: Using the endpoint event or missing event of the abnormal scenario as the root, backtrack along the causal graph to trace all possible parent nodes and generate a causal subgraph. S320, calculate the contribution score of each node in the causal subgraph; S330: Select the node with the highest contribution score as the root cause event and generate a scene annotation record. The scene annotation record includes: scene event ID, event sequence, timestamp sequence, status label, and root cause event ID. S340 receives feedback information indicating whether maintenance personnel have confirmed the root cause or a false alarm. S350, based on feedback information, increases the weight of confirmed causal edges in the causal graph, decreases the weight of confirmed non-existent edges in the causal graph, and optimizes the generation of expiration time.

[0037] Specifically, S310 uses the abnormal endpoint event or missing event as the root (e.g., "service_down") and backtracks the parent node in the graph (Neo4j's Cypher query traverses the INCOMING relationship) to generate a causal subgraph. S320 calculates the contribution score for each node: based on path length (shorter paths have higher weight) and causal strength (weighted sum), contribution score = (1 / path length). Intensity. S330 selects the highest-scoring node as the root cause event (e.g., "network_failure") and generates a scene annotation record (JSON format, including a scene event ID sequence, timestamp sequence, status label "abnormal", and root cause event ID), storing it in a MongoDB document database. For example, the scene annotation record is {Scene ID: "SC_20231001_001", Event Sequence: [A,B,D], Timestamp Sequence: [t1,t2,t4], Status Label: "Abnormal - Missing Event C", Root Cause Event ID: "A"}). S340 receives feedback from operations personnel via a REST API (e.g., confirming root causes or marking false alarms), and stores the feedback information in the log. S350 updates the graph based on the feedback: the weight of confirmed causal edges increases by 10%, the weight of false alarm edges decreases by 20%, and the generation of expiration times is optimized (e.g., adjusting time window parameters).

[0038] Reference Figure 4 The virtual scene data annotation generation methods also include S410-S430: S410, Based on the generated scene annotation records, construct an abnormal scene case library; S420: Periodically perform cluster analysis on the labeled records in the abnormal scenario case library to extract typical abnormal patterns and corresponding root cause features; S430 utilizes typical anomaly patterns and root cause features to iteratively optimize the structure and causal strength of the causal graph, and updates the preset compliance threshold and semantic similarity threshold.

[0039] Specifically, S410 constructs an anomaly scenario case library based on labeled records: it uses a MySQL relational database to store structured records and indexes key fields (such as root cause event type). S420 performs cluster analysis on the case library periodically (e.g., weekly): it applies the K-means algorithm (implemented in Python scikit-learn) to extract typical anomaly patterns (such as the "resource leakage" pattern) and root cause features (such as high-frequency nodes). S430 uses these patterns to optimize the causal graph: through graph editing (adding / deleting edges) and intensity recalculation (based on new data), it updates compliance thresholds and semantic similarity thresholds (e.g., thresholds adaptively adjust with cluster center distance). The entire optimization process forms a closed loop, continuously improving system robustness through learning.

[0040] Based on the above method embodiments, the second embodiment of this application discloses a virtual scene data annotation generation system. The virtual scene data annotation generation system of this application can implement any of the above-described virtual scene data annotation generation methods, and the specific working process of each module in the virtual scene data annotation generation system can be referred to the corresponding process in the above method embodiments.

[0041] For ease of understanding, an example is as follows: A virtual scene data annotation and generation system includes: The log acquisition module is used to acquire multi-source log streams from the business system in real time. The log parsing module is used to parse and structure each new log entry to generate real-time events; The log processing module is used to generate expiration times based on the event type of real-time events and store them in a preset event buffer pool; The event search module is used to search for all events with the same entity and whose time is within a set time window in the event buffer pool, using the entity of the real-time event as the key, and to generate a candidate scene set. The set time window is generated based on the expiration time. The judgment and processing module is used to sort the events by timestamp to form scene events when the number of events in the candidate scene set is not less than a threshold. The annotation module is used to match scene events with a pre-built causal graph. For each consecutive event pair in the scene event, it searches for the corresponding causal strength in the causal graph and calculates the corresponding compliance score based on the causal strength. If the compliance score is less than the compliance threshold, the scene event is judged as abnormal and marked. The module also traverses the causal graph and records the event types that should have occurred but did not appear in the scene event as missing events.

[0042] The third embodiment of this application provides a computer device, which may include a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement a virtual scene data annotation generation method.

[0043] The memory can communicate with the processor via a communication bus, which can be an address bus, a data bus, a control bus, etc.

[0044] Additionally, the memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device.

[0045] Furthermore, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0046] The fourth embodiment of this application provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed as a virtual scene data annotation generation method.

[0047] The computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device; the program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0048] It should be noted that the computer device and storage medium in the embodiments of this application are respectively electronic devices and storage media that apply the above-described virtual scene data annotation generation method. Therefore, all embodiments of the above-described virtual scene data annotation generation method are applicable to the computer device and storage medium, and can achieve the same or similar beneficial effects. For the computer device / storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple; relevant details can be found in the descriptions of the method embodiments.

[0049] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce a good effect.

[0050] The above are all preferred embodiments of this application and are not intended to limit the scope of protection of this application. Any feature disclosed in this specification (including the abstract and drawings) may be replaced by other equivalent or similar features unless specifically stated otherwise. That is, unless specifically stated otherwise, each feature is only one example of a series of equivalent or similar features.

Claims

1. A method for generating virtual scene data annotations, characterized in that, include: It acquires multi-source log streams from business systems in real time, parses and structures each new log entry, and generates real-time events. Based on the event type of the real-time event, an expiration time is generated and stored in a preset event buffer pool; Using the entity of the real-time event as the key, search the event buffer pool for all events with the same entity and whose time is within a set time window, and generate a candidate scene set. The set time window is generated based on the expiration time. When the number of events in the candidate scene set is not less than a threshold, the events are sorted by timestamp to form scene events; The scenario events are matched with a pre-built causal graph. For each consecutive event pair in the scenario events, the corresponding causal strength is found from the causal graph, and the corresponding compliance score is calculated based on the causal strength. If the compliance score is less than the compliance threshold, the scene event is determined to be abnormal and marked. Traverse the causal graph and record the types of events that should have occurred but did not appear in the scenario events as missing events.

2. The virtual scene data annotation generation method according to claim 1, characterized in that, The steps following the generation of the candidate scene set also include: When the number of events in the candidate scene set is less than a threshold, in the buffer pool, the topic similarity and type similarity between other events and the real-time event are calculated, and the semantic similarity is obtained, wherein the semantic similarity = topic similarity * K1 + type similarity * K2; Events with semantic similarity greater than the semantic similarity threshold and whose timestamps are close to those of the real-time events are added to the candidate scene set, and the events in the new candidate scene set are sorted by timestamp to form aggregated scene events.

3. The virtual scene data annotation generation method according to claim 2, characterized in that, The steps following marking abnormal scenarios include: Using the endpoint event or missing event of the abnormal scenario as the root, backtrack along the causal graph to trace all possible parent nodes and generate a causal subgraph. Calculate the contribution score of each node in the causal subgraph; The node with the highest contribution score is selected as the root cause event, and a scene annotation record is generated. The scene annotation record includes: scene event ID, event sequence, timestamp sequence, status label, and root cause event ID.

4. The virtual scene data annotation generation method according to claim 3, characterized in that, The steps following the generation of scene annotation records include: Receive feedback information from maintenance personnel to confirm root causes or false alarms; Based on the feedback information, the weight of confirmed causal edges in the causal graph is increased, the weight of confirmed non-existent edges in the causal graph is decreased, and the generation of expiration time is optimized.

5. The virtual scene data annotation generation method according to claim 1, characterized in that, The steps for generating an expiration time based on the event type of the real-time event include: According to the event type, a preset time is retrieved, and the time is extended according to the historical time sequence deviation corresponding to the event type to obtain an adjustment window, wherein the adjustment window = preset time + extended time; An expiration time is generated based on the timestamp of the real-time event and the adjustment window.

6. The virtual scene data annotation generation method according to claim 2, characterized in that, The steps for constructing the causal graph include: Collect historical multi-source log data from business systems, and parse and structure each historical log to generate historical events; Analyze the chronological order of historical events, identify leading-lagging relationships, and generate an ordered sequence of historical events; Based on the historical event sequence, the co-occurrence frequency, conditional probability, and time interval distribution of event pairs are calculated, and potential causal relationships are mined by combining the chronological order. The causal inference method is applied to quantify the dynamic causal strength between events and to verify the reliability of causal relationships; After verification, a multi-layered causal graph is constructed, with event type as nodes, causal relationship as directed edges, and entity type as attribute association nodes.

7. The virtual scene data annotation generation method according to claim 3, characterized in that, The virtual scene data annotation generation method also includes: Based on the generated scene annotation records, an abnormal scene case library is constructed; Periodically perform cluster analysis on the labeled records in the abnormal scenario case library to extract typical abnormal patterns and corresponding root cause features; Using the typical anomaly patterns and root cause features, the structure and causal strength of the causal graph are iteratively optimized, and the preset compliance threshold and semantic similarity threshold are updated.

8. A virtual scene data annotation and generation system, characterized in that, The virtual scene data annotation generation method as described in any one of claims 1 to 7 includes: The log acquisition module is used to acquire multi-source log streams from the business system in real time. The log parsing module is used to parse and structure each new log entry to generate real-time events; The log processing module is used to generate an expiration time based on the event type of the real-time event and store it in a preset event buffer pool; The event lookup module is used to search for all events with the same entity and whose time is within a set time window in the event buffer pool, using the entity of the real-time event as the key, and to generate a candidate scene set. The set time window is generated according to the expiration time. The judgment and processing module is used to sort the events by timestamp to form scene events when the number of events in the candidate scene set is not less than a threshold. The annotation module is used to match the scene events with a pre-built causal graph. For each consecutive event pair in the scene event, the corresponding causal strength is found from the causal graph, and the corresponding compliance score is calculated based on the causal strength. If the compliance score is less than the compliance threshold, the scene event is determined to be abnormal and marked. The causal graph is traversed, and event types that should occur but do not appear in the scene event are recorded as missing events.

9. A computer device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the virtual scene data annotation generation method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer program is stored that can be loaded by a processor and executed as described in any one of claims 1 to 7 for generating virtual scene data annotations.

Images