Abnormal analysis report generation method and device, electronic equipment and storage medium

Abstract

The invention provides an exception analysis report generation method and device, electronic equipment and a storage medium, relates to the technical field of computers, supports flexible and real-time multi-dimensional analysis, and can simplify configuration operation of an exception report to adapt to high-frequency updating requirements. The method comprises the following steps: analyzing a query text of a user to obtain at least one query element; searching a target event from an event library based on an abnormal query element under the condition of determining that the abnormal query element exists in the at least one query element; determining an abnormal reason of an abnormal event indicated by the abnormal query element based on the target event; and generating an exception report based on the exception query element and the exception reason.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to methods, apparatus, electronic devices and storage media for generating anomaly analysis reports. Background Technology

[0002] In the civil aviation sector, various operating units (such as air traffic control, airports, and airlines) need to continuously monitor and analyze various indicators such as flight operation status, safety incidents, and service quality, and generate corresponding statistical reports and incident analysis reports.

[0003] While current visualization tools and reporting systems offer some degree of automation for anomaly analysis reports—for example, quickly generating basic charts using pre-built report templates or drag-and-drop components—the configuration process remains cumbersome. They also struggle to understand user intent and cannot automatically generate in-depth analysis content tailored to specific business scenarios. Furthermore, traditional report generation methods are often limited to a single analytical dimension, lacking flexibility in report structure and content, and failing to adapt to the demands of real-time or frequently updated dynamic data analysis. Summary of the Invention

[0004] This application provides a method, apparatus, electronic device, and storage medium for generating anomaly analysis reports, which supports flexible and real-time multi-dimensional analysis and simplifies the configuration of anomaly reports to meet the needs of high-frequency updates.

[0005] In a first aspect, this application provides a method for generating an anomaly analysis report, comprising: parsing a user's query text to obtain at least one query element; if it is determined that an anomaly query element exists among the at least one query element, retrieving a target event from an event database based on the anomaly query element; wherein the anomaly query element is used to indicate the existence of an anomaly event; the target event is a current event related to the anomaly query element, and the time of the current event is determined based on a time element in the query text; the event database is used to store airport operation and management events; determining the cause of the anomaly event indicated by the anomaly query element based on the target event; and generating an anomaly report based on the anomaly query element and the cause of the anomaly.

[0006] The technical solution provided in this application brings at least the following beneficial effects: The anomaly analysis report generation method provided in this application obtains query elements by parsing the user's query text, and can automatically extract key information such as time and anomaly elements from the query to understand the user's semantic intent; by retrieving target events from the event database based on anomaly query elements, the target events are not limited to a certain type of event, but rather events that occur in the current period, and can dynamically associate multi-dimensional and multi-source airport operation events, thereby supporting flexible and real-time multi-dimensional analysis, overcoming the shortcomings of traditional report analysis with single dimensions and fixed content; finally, it automatically determines the cause of the anomaly based on the target event and generates an anomaly report, simplifying the configuration operation of the anomaly report and adapting to high-frequency update requirements.

[0007] One possible implementation involves determining the correlation between the target event and the abnormal query element based on the time, location, and causal relationship of the target event; wherein the causal relationship is the causal relationship between the target event and the abnormal event indicated by the abnormal query element; and if the correlation is greater than or equal to a first preset threshold, the abnormal cause is determined to be the target event.

[0008] Another possible implementation involves inputting the target event information and abnormal query elements into an anomaly identification model, analyzing the probability that the target event causes the abnormal event indicated by the abnormal query elements through the anomaly identification model, and determining the cause of the anomaly as the target event if the probability is greater than or equal to a second preset threshold.

[0009] Another possible implementation is to obtain target data from the indicator library for each of at least one query element, based on the query element; the target data consists of historical and current data related to the query element; and determine whether the query element is an abnormal query element based on the target data.

[0010] Another possible approach is to determine a historical baseline based on historical data; then compare the current data with the historical baseline to determine whether the query element is an abnormal query element.

[0011] Another possible approach is to use a visualization library to generate images and tables based on the abnormal query elements and causes; and then generate an anomaly report by combining the abnormal query elements, causes, images, and tables according to a preset structure.

[0012] Secondly, this application provides an anomaly analysis report generation device, comprising: a processing module and a generation module; the processing module is used to parse the user's query text to obtain at least one query element; when it is determined that there is an abnormal query element in the at least one query element, it retrieves a target event from the event database based on the abnormal query element; and determines the abnormal cause of the abnormal event indicated by the abnormal query element based on the target event; the generation module is used to generate an anomaly report based on the abnormal query element and the abnormal cause.

[0013] One possible implementation is that the processing module is further used to determine the correlation between the target event and the abnormal query element based on the time, location, and causal relationship of the target event; wherein the causal relationship is the causal relationship between the target event and the abnormal event indicated by the abnormal query element; if the correlation is greater than or equal to a first preset threshold, the abnormal cause is determined to be the target event.

[0014] Another possible implementation is that the processing module is also used to input the information of the target event and the abnormal query elements into the abnormal identification model, and analyze the probability of the target event causing the abnormal event indicated by the abnormal query elements through the abnormal identification model; if the probability is greater than or equal to a second preset threshold, the abnormal cause is determined to be the target event.

[0015] Another possible implementation is that the processing module is also used to obtain target data from the indicator library for each query element in at least one query element; the target data consists of historical data and current data related to the query element; and to determine whether the query element is an abnormal query element based on the target data.

[0016] Another possible implementation is that the processing module is also used to determine the historical baseline based on historical data; compare the current data with the historical baseline to determine whether the query element is an abnormal query element.

[0017] Another possible implementation is the generation module, which is also used to generate images and tables using a visualization library based on the abnormal query elements and abnormal reasons; and to generate an abnormal report by combining the abnormal query elements, abnormal reasons, images and tables according to a preset structure.

[0018] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory storing processor-executable instructions; when the processor is configured to execute the instructions, causing the electronic device to implement the method of the first aspect described above.

[0019] Fourthly, this application provides a computer-readable storage medium comprising: computer software instructions; which, when executed in an electronic device, cause the electronic device to implement the method described in the first aspect.

[0020] Fifthly, this application provides a computer program product comprising a computer program; when the computer program is run in an electronic device, it causes the electronic device to implement the method described in the first aspect.

[0021] The beneficial effects of the second to fifth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0022] Figure 1 This application provides an architecture diagram of an anomaly analysis report generation system. Figure 2 A flowchart illustrating an anomaly analysis report generation method provided in this application embodiment; Figure 3 A flowchart illustrating a method for determining whether a query element is abnormal, provided in an embodiment of this application; Figure 4 A schematic diagram of the composition of an anomaly analysis report generation device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0023] The following section will describe in detail, with reference to the accompanying drawings, a method for generating an anomaly analysis report provided in this application.

[0024] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0025] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0026] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0027] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0028] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0029] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0030] In recent years, with the rapid development of large-scale modeling technology, its application in the generation of event and indicator analysis reports has significantly improved analytical efficiency and intelligence. In civil aviation operations, various operational entities such as air traffic control, airports, and airlines need to continuously monitor multi-dimensional indicators such as flight operation status, safety incident dynamics, and passenger service quality, and on this basis, regularly generate structured statistical analysis reports and event-specific reports to support operational decision-making and business optimization.

[0031] Traditional report generation methods heavily rely on manual operations, including extracting data from multiple data sources, manually organizing and calculating metrics, writing analytical text, and creating charts and tables. This process is not only time-consuming and labor-intensive, but also carries a high risk of human error and is difficult to adapt to the needs of real-time or frequently updated analysis.

[0032] While current visualization tools and reporting systems offer some degree of automation for anomaly analysis reports—for example, generating basic charts through pre-built report templates or drag-and-drop components—the configuration process remains complex and cannot automatically generate in-depth analysis content tailored to specific business scenarios. Users need a certain level of expertise in data processing and visualization. For instance, users must manually set data mapping relationships, select chart types, and adjust visual attributes and layout formats, failing to automatically generate analysis content that aligns with the business context based on semantic intent. Furthermore, traditional report generation methods lack the ability to uniformly understand and integrate multimodal information (such as structured data and unstructured text), resulting in limited analytical dimensions, insufficient report content flexibility, and difficulty adapting to the dynamic data analysis needs of real-time or high-frequency updates.

[0033] To address the aforementioned technical issues, this application provides a method for generating anomaly analysis reports. The method involves parsing the user's query text to obtain query elements, automatically extracting key information such as time and anomaly elements from the query, and understanding the user's semantic intent. It then retrieves target events from an event database based on the anomaly query elements. These target events are not limited to a specific type of event but rather encompass events occurring in the current period, dynamically linking multi-dimensional and multi-source airport operation events. This supports flexible and real-time multi-dimensional analysis, overcoming the shortcomings of traditional reports with their single-dimensional analysis and fixed content. Finally, it automatically determines the cause of the anomaly based on the target event and generates a report, simplifying configuration operations and adapting to high-frequency update requirements.

[0034] The embodiments provided in this application will now be described in detail with reference to the accompanying drawings.

[0035] The anomaly analysis report generation method provided in this application can be applied to, for example... Figure 1 The anomaly analysis report generation system shown. For example... Figure 1 As shown, the anomaly analysis report generation system 10 of this application includes: electronic device 11.

[0036] In some embodiments, the electronic device 11 can determine whether there are abnormal query elements in the query text entered by the user. If there are abnormal query elements, the electronic device 11 can search the event database to determine the abnormal cause of the abnormal event indicated by the abnormal query elements.

[0037] In some embodiments, the electronic device 11 can also generate an anomaly report based on anomaly query elements and anomaly causes.

[0038] In some embodiments, the electronic device 11 can be a server, such as a single server or a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster.

[0039] In some embodiments, the electronic device 11 can be a terminal device, such as a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, cellular phone, personal digital assistant (PDA), augmented reality (AR) / virtual reality (VR) device, etc. This application embodiment does not impose any special limitations on the specific form of the terminal device.

[0040] Optionally, the electronic device 11 can also store user-input queries and extracted query element-related data to facilitate data retrieval, processing, and analysis.

[0041] In some implementations, the anomaly analysis report generation system 10 may also include a notification device 12.

[0042] Specifically, a communication connection is established between the notification device 12 and the electronic device 11. For example, the connection method can be wireless, such as Bluetooth or Wi-Fi; alternatively, it can be wired, such as fiber optic, etc., without limitation. For example, the notification device 12 and the electronic device 11 can be connected to the Internet via a router, thereby establishing the communication connection between them.

[0043] In some implementations, the prompting device 12 is used to display an anomaly report. For example, the prompting device 12 may be a voice prompting device, in which case the prompting device 12 presents the anomaly report to the user by reading it aloud. Alternatively, the prompting device 12 may also be a display device, in which case the prompting device 12 presents the anomaly report to the user by displaying the anomaly report on a display screen.

[0044] It should be noted that the system architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0045] The following description, in conjunction with the accompanying drawings, introduces a method for generating an anomaly analysis report provided by an embodiment of this application.

[0046] For example, the anomaly analysis report generation method provided in this application can be achieved through... Figure 1 The anomaly analysis report generation system shown is implemented, or, through... Figure 1 The electronic device implementation in the anomaly analysis report generation system shown.

[0047] See Figure 2 This is a flowchart illustrating an anomaly analysis report generation method provided in an embodiment of this application. Figure 2 As shown, the anomaly analysis report generation method provided in this application includes the following steps S201~S204.

[0048] S201. Parse the user's query text to obtain at least one query element.

[0049] In some embodiments, query text refers to a natural language string entered by a user to obtain specific information or trigger an analysis task. It can take various forms, including complete questions, short keyword combinations, or statements containing specific instructions. In aviation operations analysis scenarios, query text typically expresses a user's intent to focus on a particular flight, airport, time period, or specific operational indicator, such as "analyze the reasons for the delays at Beijing Capital International Airport yesterday afternoon."

[0050] For example, query text may include: input boxes in a graphical user interface, text transcribed by a voice interaction system, or paragraphs to be analyzed imported from external report files. Its content is typically directly related to civil aviation operations and may mention specific airport names, airline codes, flight numbers, dates and time periods, operational indicator names, and key verbs and adjectives describing the status or problem.

[0051] In some embodiments, a query element refers to a structured or semi-structured information unit extracted by parsing the query text.

[0052] For example, query elements may include entity elements, time elements, indicator elements, and intent elements identified from the text. Entity elements: such as target airport, target airline, specific flight number; time elements: such as specific date, time period, or relative time expressions such as "today" or "last week"; indicator elements: such as "on-time rate", "passenger volume", "average delay"; intent elements: such as "analyze the reasons", "compare trends", "predict the future".

[0053] In some embodiments, the query text to be parsed can be obtained from various human-computer interaction interfaces or data interfaces connected to the device.

[0054] For example, the text can originate from strings typed by users in search boxes on web browsers or mobile application front-ends, or from conversational commands received by chatbots integrated within business systems. Alternatively, the raw query text can be obtained by listening to and transcribing audio streams from voice interaction channels, or by parsing task request documents containing natural language descriptions from emails, ticket systems, or other similar sources.

[0055] As a feasible implementation method, the user's query text can be parsed using a large language model.

[0056] For example, a large domain model integrated with a rules engine can be deployed. After inputting the prompt "Please parse the user request: [user query]. Identify the query elements: time range, target airport, and relevant metrics (such as delays)" into the model, the large model executes this instruction and outputs structured query elements.

[0057] For example, the query text is first preprocessed using standardization techniques, such as full-width / half-width character conversion and civil aviation terminology normalization. Then, multi-path parsing is performed in parallel: one path is handled by a high-performance rule engine based on precise matching, which uses a pre-built entity dictionary and regular expression templates to directly extract entities with clear formats, such as airport codes, flight numbers, and airline codes; another path uses a specially trained named entity recognition model to identify entities and metrics, such as "on-time performance," "turnaround time," and "delayed flights," as well as non-standard format entities like "Terminal 3" and "Runway 36L." The named entity recognition model is fine-tuned on top of a basic language model using a large amount of data annotated with civil aviation professional entities and metrics, thus accurately identifying various metrics mentioned in the text. Next, the identified entities and metrics are analyzed to determine their relationships, for example, linking the "delay" metric to the "departure" stage and airlines.

[0058] As another feasible implementation, a comprehensive domain knowledge base can be maintained, which includes a structured dictionary (such as a list of airport, airline, and aircraft code names), an indicator thesaurus (such as "delay", "cancellation", and "flow control"), and a time expression pattern library. The domain knowledge base is used to parse the user's query text.

[0059] For example, the input text is scanned using a Trie tree data structure to directly match all entities that conform to the dictionary definition (such as "PEK", "CA1234") and basic indicator words. Then, a series of manually written or automatically derived regular expressions and contextual rule templates are applied. These rules are used to identify more complex combined indicators (such as "departure delay exceeding 30 minutes") and modified entities (such as "flights to the capital"), and to determine the relationships between elements through rule logic. Next, a lightweight probabilistic model or simple context-based rules are used to disambiguate the multiple candidate parsing results generated in the previous stage, and the natural language expression is standardized into internal system code (such as standardizing "Beijing Capital Airport" to "PEK"). Finally, a defined, structured set of elements is output, clearly divided into categories such as entities, indicators, and time.

[0060] In some embodiments, before parsing the user's query text, non-textual input from the user can also be received and processed, such as voice commands captured by a microphone or screenshots or photos containing text information acquired by an image sensor. A speech recognition module can be invoked to convert the audio stream into text, or an optical character recognition module can be invoked to extract text from an image; this converted text content will serve as the query text.

[0061] S202. If it is determined that there is an abnormal query element in at least one query element, retrieve the target event from the event database based on the abnormal query element.

[0062] Among them, the abnormal query element is used to indicate the existence of abnormal events; the target event is the current event related to the abnormal query element, and the time of the current event is determined based on the time element in the query text; the event database is used to store airport operation and management events.

[0063] In some embodiments, abnormal query elements refer to a specific type of query elements parsed from user query text that indicate that the current focus or core issue involves an abnormal or deviated from the baseline operating state.

[0064] For example, abnormal query elements may include keywords that directly indicate the problem, such as "delay", "cancellation", "congestion", "failure", "interruption"; or phrases that describe the unexpected state, such as "low on-time rate", "long waiting time", "slow baggage system"; or abnormal indicator names obtained by comparing with historical baselines or preset thresholds, such as "abnormal inbound flights".

[0065] In some embodiments, the event repository is a persistent storage database or data warehouse specifically designed for the structured storage of various historical and real-time event records related to airport operations management.

[0066] For example, events stored in the event database may include flight schedule change notices, air traffic flow control instruction issuance records, airport facility and equipment failure and maintenance logs, special weather observation and warning information, security check event reports, ground support operation records, and operation coordination communication minutes from air traffic control, airports, airlines, and other parties, all stored in structured record form.

[0067] In some embodiments, a target event refers to a specific event record in the event database that is associated with the current anomaly query element and whose occurrence time falls within the "current" time range determined by the query text. The target event constitutes the factual basis for the final anomaly cause analysis.

[0068] For example, target events can include specific accident events, equipment failure events, flight schedule change events, air traffic control events, special weather events, and various support operation events that affect operational efficiency, occurring within the target airport or related airspace during the "current period" defined by the time element. The correlation between target events and anomaly query elements is reflected in multiple dimensions such as event type, impact indicators, and location of occurrence.

[0069] In some embodiments, abnormal query elements can be obtained by traversing the parsed set of query elements and identifying elements belonging to the "abnormal" category. For obtaining the target event, based on the implicit focus of the abnormal query element and combined with the explicit time elements parsed from the query text, a conditional query can be performed in the event database to retrieve all original event records whose event time falls within the "current period" range and whose event type or attributes are related to the abnormal query element.

[0070] In some embodiments, when retrieving target events from the event database based on abnormal query elements, the spatial scope of the retrieval can be determined first based on the entities involved in the abnormal query elements (such as a specific terminal or runway). Then, in addition to matching the "current" time, the retrieval time window can be extended forward by a predefined duration to capture leading events that occurred before the "current" time but are likely to cause anomalies in the "current" time, thereby constructing a more complete causal chain.

[0071] S203. Determine the cause of the abnormal event indicated by the abnormal query element based on the target event.

[0072] In some embodiments, an anomaly cause refers to one or more specific events, conditions, or factors that cause or contribute to the occurrence of the anomalous event indicated by the anomaly query element. The determination process involves identifying events from a plurality of target events that have a strong causal relationship with the anomalous event.

[0073] For example, the causes of an anomaly can include root causes or synergistic causes. A dominant root cause event, such as the sudden closure of a runway; one or more synergistic causes that catalyze or exacerbate the anomaly, such as simultaneous severe weather and air traffic control; and possible systemic background conditions, such as sustained high flight traffic over a specific period. These causes collectively explain why the anomaly occurred and its severity.

[0074] In some embodiments, step S203 can be implemented as a1~a2.

[0075] a1. In some embodiments, the cause of anomalies can be obtained by performing causal analysis and contribution assessment on the retrieved set of target events.

[0076] For example, a multi-factor decision model can be used to determine the cause of anomalies. This model calculates a "causation confidence" score for each retrieved target event. This score is derived from several computable dimensions: first, the time correlation score converted from the time difference and overlap between the event and the anomaly; second, the spatial correlation score between the event's location and the area affected by the anomaly; and third, the causal probability score between the event type and the anomaly type obtained by querying historical data. Subsequently, the system weights and fuses these scores, and sorts all target events according to the fused total score. Finally, the system outputs one or more events with the highest ranking exceeding a preset threshold, along with their fused scores, as the determined causes of the anomalies. Furthermore, the system can be configured with rules to classify multiple events with similar scores as a composite cause.

[0077] In some embodiments, the correlation between the target event and the abnormal query element is determined based on the time, location, and causal relationship of the target event; wherein, the causal relationship is the causal relationship between the target event and the abnormal event indicated by the abnormal query element.

[0078] In some embodiments, relevance is a quantified score that measures the strength of the likelihood, closeness, or causal contribution between a specific target event and the anomalous state indicated by an anomalous query element of interest in the user's query. It can be a continuous numerical value or a discrete level between 0 and 1; a higher value indicates a greater likelihood that the target event is considered to have caused or influenced the current anomalous state.

[0079] For example, the correlation score can include a comprehensive quantitative score generated by a weighted fusion of three sub-scores: temporal correlation, spatial correlation, and causal correlation. The temporal correlation score reflects the proximity and overlap between the target event and the anomalous event in terms of occurrence time; the spatial correlation score reflects the proximity of the two in terms of geographical location or scope of influence; and the causal correlation score reflects the probability strength that this event type leads to this type of anomalous event, derived from historical data statistics, domain knowledge, or logical reasoning. The final correlation score comprehensively reflects the degree of support from these three dimensions.

[0080] In some embodiments, for time-related scores, after obtaining the time period in which the target event occurred, the occurrence period of the target event can be compared with the duration of the abnormal query element. First, the percentage of absolute overlap is calculated, and then a negative exponential time decay function is applied to handle the case where the event occurs in the vicinity of the abnormal time period (such as the preceding or subsequent buffer period). After combining the two, a scalar score between 0 and 1 is generated.

[0081] In some embodiments, for spatial association scores, the physical distance or logical inclusion relationship between the location or scope of the target event and the core area of ​​interest of the abnormal query element can be calculated based on the geographic information system data of the target airport; the physical distance can be mapped to a proximity score through a preset distance attenuation coefficient, or the logical relationship can be converted into a matching score through a predefined regional hierarchical weight table (such as a weight of 1.0 for the same runway, 0.8 for the same terminal, and 0.5 for adjacent airports).

[0082] In some embodiments, for the causal association score, a conditional probability library of "event type - anomaly type" constructed based on historical data statistics is first queried to obtain the basic probability that the target event type causes such anomaly query elements; at the same time, the module will search the domain knowledge graph to obtain Boolean assertions and confidence levels regarding whether there is a recognized causal rule between the event and the anomaly event; finally, the module will fuse the statistical probability and the confidence level of the knowledge rule through a weighted average, and may fine-tune it according to the specific attributes (such as intensity and scale) of the current event and the anomaly event to output the causal association score.

[0083] For example, the conditional probability library can be constructed as follows.

[0084] For example, historical anomaly analysis reports containing structured operational event records and abnormal state records are collected, then standardized to establish a unified event classification system and anomaly classification system. Event classification can be divided into several levels according to the characteristics of civil aviation operations, such as primary classification including equipment events, weather events, operational events, support events, and safety events, with each primary classification further subdivided into secondary classifications. Anomaly classification also constructs a standardized classification system based on the principle of similarity. All historical records are mapped to these standard classifications to ensure data consistency. Based on the above paired samples, statistical methods are used to calculate conditional probabilities. For each pair of event types... and exception types The formula for calculating the basic conditional probability is as follows:

[0085] in, Represents event type E in history i After occurrence, abnormal type A j Number of times it happens Represents event type E in history i The total number of occurrences. All calculated event-anomaly conditional probabilities are organized into a matrix, where rows represent event types, columns represent anomaly types, and each cell stores the corresponding conditional probability value. This conditional probability matrix constitutes a probability library.

[0086] In some embodiments, based on preset weights (the sum of the weights of time correlation score, spatial correlation score, and causal correlation score is 1), the products of time correlation score and corresponding weight, spatial correlation score and corresponding weight, and causal correlation score and corresponding weight are calculated respectively, and then linearly weighted and fused to obtain the comprehensive correlation degree as the final target event correlation degree. All correlation degree calculation results will be stored together with the target event information or passed to the subsequent sorting and report generation module.

[0087] In some embodiments, a dynamic weight adjustment strategy can be introduced when calculating the correlation. The system dynamically adjusts the weight ratios of the time, space, and causality dimensions in the final correlation calculation based on the type and severity of the current anomaly and the quality of the available data. For example, for sudden, short-term anomalies, the weight of the time score will be temporarily increased; for large-scale, systemic anomalies, the weight of the causal correlation score will be increased accordingly.

[0088] In some embodiments, if the correlation degree is greater than or equal to a first preset threshold, the cause of the anomaly is determined to be the target event.

[0089] In some embodiments, the first preset threshold is a pre-set benchmark value used to determine whether a causal relationship exists. The first preset threshold is a critical standard. When the calculated correlation score reaches or exceeds this value, the system determines that there is a sufficiently strong correlation between the corresponding target event and the current anomaly, thus having reason to identify the event as the main cause or key cause of the anomaly.

[0090] For example, the first preset threshold can be a fixed value set based on business experience and historical analysis results, such as 0.7, which represents the need for strong evidence support; or, the first preset threshold can be a range value that is dynamically adjusted based on the severity of the abnormal event, the sensitivity of the indicators involved, or the current operating status. For example, for security-related anomalies, the threshold can be set between 0.6 and 0.8.

[0091] In some embodiments, when determining the cause of an anomaly based on a first preset threshold, a multi-level threshold strategy can also be adopted. For example, a higher root cause threshold and a lower related cause threshold can be set. When the correlation of a target event reaches the root cause threshold, it is identified as a single primary root cause; when the correlation of multiple events is between the two thresholds, the multiple events are jointly identified as a series of synergistic or secondary causes, thereby constructing a more refined and hierarchical causal analysis conclusion.

[0092] a2. In some embodiments, the cause of the anomaly can be obtained by evaluating the retrieved target events and abnormal query elements through an anomaly identification model.

[0093] For example, after inputting the target event information and abnormal query elements into the anomaly identification model, the prompt word "For the above-identified abnormal query elements, retrieve the target event from the event database, such as: weather records, air traffic control notifications, airport resource status, etc. Please analyze the correlation between the target event and the indicator anomaly" is entered. The anomaly identification model analyzes the probability that the target event causes the abnormal event indicated by the abnormal query elements; if the probability is greater than or equal to a second preset threshold, the cause of the anomaly is determined to be the target event.

[0094] In some embodiments, the anomaly detection model is a trained machine learning or deep learning model that assesses the probability that a given target event causes the situation described by a specific anomaly query element. It takes the multi-dimensional features of the target event and the semantic information of the anomaly query element as input, performs complex internal feature interactions and inference calculations, and outputs a quantified probability value to represent the confidence level of a causal relationship between the two.

[0095] For example, an anomaly detection model can be constructed based on the following: First, the historical anomaly analysis reports are used as training data to construct positive and negative samples. Positive samples are "event-anomaly" causal pairs confirmed by experts or explicitly recorded in reports, such as "runway closure caused departure delays." Negative samples are created by combining spatiotemporally close but causally unrelated events with anomalies, or by deliberately using events with reversed time sequences, to ensure the model can learn to distinguish between true and false associations. To improve the model's robustness and generalization ability, data augmentation operations such as synonym replacement can be performed on the text descriptions, and slight noise can be added to the numerical features.

[0096] Then, once the data is ready, a suitable architecture can be designed for the model to understand and fuse multi-source information. For example, a dual-encoder structure with a feature fusion layer can be used. The text encoder (such as the BERT model fine-tuned based on civil aviation text) is responsible for understanding the descriptive text of events and anomalies, transforming it into semantically rich vectors. Simultaneously, the structured feature encoder (such as a multilayer perceptron) processes discrete and continuous features such as event type, occurrence time, severity level, and impact range. Subsequently, through a cross-attention mechanism or simple concatenation followed by a fully connected layer, the two aspects of the event and anomaly features interact deeply. Finally, a classification layer outputs a probability value between 0 and 1, representing the likelihood that the event caused the anomaly. Binary cross-entropy can be used as the main loss function, and its internal parameters can be learned and adjusted through backpropagation.

[0097] In some embodiments, the second preset threshold is a critical value used to determine whether the probability is sufficient to support a causal relationship. When the probability value output by the model reaches or exceeds this threshold, the target event is identified as an abnormal cause, thereby transforming the probabilistic output of the model into a deterministic business conclusion. The second preset threshold may be the same as or different from the first preset threshold.

[0098] In some embodiments, when using anomaly detection models for analysis and judgment, a model ensemble strategy can also be implemented. Multiple anomaly detection models with differences in training data or architecture are run in parallel to predict the same pair of inputs. Subsequently, the system integrates the probability values ​​output by the multiple models (e.g., by averaging or weighted averaging) and compares the integrated probability with a second preset threshold, thereby improving the robustness and accuracy of the judgment and reducing the bias that may be generated by a single model.

[0099] In some embodiments, the abnormal causes obtained in step a1 and step a2 can be processed collaboratively.

[0100] For example, when the causes of anomalies obtained by the two methods are highly consistent, the target event is recorded; when a discrepancy occurs, a conflict resolution mechanism is activated, such as making a decision based on a preset confidence threshold, or outputting all high-confidence findings and clearly marking their sources, handing over the final judgment to business experts, and automatically including this discrepancy case as a sample for subsequent optimization formulas and model training.

[0101] S204. Generate an anomaly report based on the anomaly query elements and the anomaly cause.

[0102] In some embodiments, an anomaly report refers to a final, user-oriented, structured document that comprehensively describes a specific anomaly.

[0103] For example, an anomaly report may include an anomaly title, an anomaly description, a summary, and recommendations. The anomaly title highlights the core issue; the anomaly description reproduces the key information contained in the anomaly query elements, such as anomaly indicators, time, and location, and, corresponding to the identified anomaly cause, elaborates on the specific circumstances of the cause event (such as time, location, and nature) and its correlation logic and evidence with the anomaly; the summary and recommendations summarize the analysis findings and may propose preliminary response or observation suggestions based on the cause.

[0104] In some embodiments, anomaly reports can be automatically generated by calling a visualization library.

[0105] In some embodiments, step S204 can be implemented as the following steps b1~b2.

[0106] b1. Based on the abnormal query elements and abnormal reasons, use a visualization library to generate images and tables.

[0107] In some embodiments, a visualization library refers to a series of pre-packaged software code modules or services that provide the underlying capability to transform structured data into various visual forms such as graphics, charts, and tables. This can transform non-intuitive, textual, or numerical analytical conclusions into readily understandable visual elements, thereby significantly improving the communication efficiency and cognitive depth of anomaly reports.

[0108] For example, images generated by the visualization library can include line charts or area charts, timeline charts or Gantt charts, heatmaps, or airport layout diagrams. Line charts or area charts can show the trend of anomalous indicators over time, clearly marking the time window in which the anomaly occurred; timeline charts or Gantt charts can show the correspondence between related events and anomalies on a timeline; heatmaps or airport layout diagrams can show the geographical distribution or impact range of anomalies. The generated tables can include summary tables and statistical comparison tables. Summary tables can list all identified anomaly causes and their key attributes (such as event type, occurrence time, correlation score, number of affected flights); statistical comparison tables can compare current anomaly indicator values ​​with historical baseline values.

[0109] In some embodiments, images and tables can be obtained by invoking a dedicated visualization service or software development kit that is integrated internally or connected externally.

[0110] For example, the structured abnormal query element data and the list of abnormal reasons are encapsulated in the format required by the specific chart type, and then a rendering request is sent to the visualization service. After the service performs the drawing calculations, it returns an image file or an HTML fragment that can be directly embedded, thereby completing the acquisition of the visualization content.

[0111] b2. Generate an anomaly report by combining the anomaly query elements, anomaly reasons, images, and tables according to the preset structure.

[0112] In some embodiments, a preset structure refers to a predefined standard framework or template for organizing the content of anomaly reports. It specifies the chapters that the report should include, the order of the content, the format specifications, and the insertion position of each data module. This ensures that all generated reports maintain consistency and professionalism in form, while providing a clear roadmap for the automated assembly of content.

[0113] For example, first, a preset structure template matching the current anomaly type is loaded. This template may be a JSON or XML configuration file that defines in detail the various sections of the report and the content types and data field mappings that can be embedded within each section. Then, key values ​​from the anomaly query elements are populated into the corresponding variable positions in the "Anomaly Details" section. A structured text description (including event description, correlation, time, and location) is generated for each anomaly cause and sequentially inserted into the repeating module of the "Cause Analysis" section. Next, the generated image file paths and table HTML code are inserted into the specified positions in the "Data Visualization" section according to the template instructions. Finally, a document renderer is invoked to render the populated report data structure, containing all content objects and style definitions, into the format required by the end user, such as a richly illustrated PDF document, an interactive HTML webpage, or a standardized Word report, thus completing the automated generation from structured data to a complete deliverable.

[0114] In some embodiments, such as Figure 3 As shown, after executing step S201, abnormal query elements can also be determined by executing the following steps S301~S302.

[0115] S301. For each query element in at least one query element, obtain target data from the indicator library based on the query element; the target data consists of historical data and current data related to the query element.

[0116] In some embodiments, an metrics repository refers to a structured database or data warehouse specifically designed for storing, managing, and providing access to various operational performance metrics for airports and flights. These metrics are typically organized in time-series format and cover metrics reflecting operational status, such as on-time performance, passenger traffic, delay duration, and number of takeoffs and landings.

[0117] For example, an indicator library can be a series of interconnected data tables or collections that store standardized indicator data collected and cleaned from multiple source systems such as air traffic control, airport ground services, and airlines. Each data point is typically associated with a specific timestamp, airport or flight identifier, indicator type, and numerical value.

[0118] In some embodiments, target data refers to a specific dataset retrieved and extracted by the system from an indicator library in response to a specific query element. It mainly consists of two parts: "current data" refers to the indicator values ​​within the specific time range of interest in the query, used to describe the current situation; "historical data" typically refers to indicator values ​​from the same past period or other historical periods that are of reference significance and are used for comparative analysis with the current data, to establish a baseline or identify trends.

[0119] For example, the target data can be directly related to the indicator query elements, such as the specific values ​​of "departure punctuality rate" at different airports or at different times.

[0120] In some embodiments, target data can be obtained by initiating a structured data query request to the service interface of the indicator library, and the parameters of the request are derived from the query elements.

[0121] For example, the query intent "on-time performance rate of Beijing Capital International Airport on the afternoon of the 13th" can be transformed into query conditions for the indicator database: {Entity: 'PEK', Indicator: ['On-time performance rate'], Time range: ['13th 13:00', '13th 19:00']}. After executing this query, the current time-series data that meets the conditions will be returned. Then, the on-time performance rate of the same date last year or the afternoon of the 13th of each month can be queried to complete the acquisition of the target data.

[0122] In some embodiments, when retrieving target data from the indicator library, it is also possible to check whether there are results in the local or distributed cache that meet the current query conditions; if they exist and the data has not expired, the cached data is used directly, thereby significantly reducing the pressure of repeated queries to the indicator library and improving the response speed; if they do not exist, a query is initiated to the indicator library, and the returned results are returned to the caller while being stored in the cache according to a predefined caching strategy.

[0123] S302. Determine whether the query element is an abnormal query element based on the target data.

[0124] In some embodiments, a historical baseline is determined based on historical data.

[0125] In some embodiments, a historical baseline refers to a quantitative reference standard used to measure and evaluate the current operational status. It is derived through statistical analysis and modeling of "historical data" and represents the normal level, typical range, or expected trend that relevant operational indicators should exhibit under comparable historical conditions.

[0126] For example, a historical baseline determined based on historical data may include a central trend value, a range of fluctuations, and a trend or periodic pattern. A central trend value, such as the average or median of historical data, is used to characterize the typical level of the indicator; a range of fluctuations is, for example, a normal fluctuation range calculated based on the standard deviation or percentiles of historical data; a trend or periodic pattern is, for example, a long-term trend line identified through time series analysis or an inherent daily, weekly, or seasonal periodicity.

[0127] In some embodiments, historical data is used as input to invoke a baseline calculation service, which performs operations such as moving average, exponential smoothing, periodic decomposition, or more complex predictive model training as configured, and finally outputs structured baseline values, confidence intervals, and possible related pattern parameters.

[0128] For example, a preset baseline type (e.g., "7-day rolling average baseline" or "same-day comparison baseline") is selected based on the indicator query elements. If configured as "same-day comparison baseline," all data points from historical data that correspond to the same day of the week or the same calendar date as the "current period" are extracted, their average is calculated as the baseline center value, and its standard deviation is calculated to determine the normal fluctuation range. If the configuration considers trends, a trend line is first fitted, then the residuals of each historical point with respect to the trend line are calculated, and the normal fluctuation band around the trend line is determined based on the distribution of the residuals.

[0129] In some embodiments, when determining a historical baseline based on historical data, the length of the historical time window and the specific algorithm used to calculate the baseline can be dynamically selected according to business rules or data quality. For example, for indicators with high stability, a rolling average may be calculated using long-term data from the past 90 days; while for indicators that are susceptible to seasonality, data from the same period last year may be strictly selected for comparison.

[0130] In some embodiments, the current data is compared with the historical baseline to determine whether the query element is an abnormal query element.

[0131] For example, the process of determining whether a query element is abnormal by comparing current data with a historical baseline may include calculating the degree of deviation of the current data from the historical baseline. This can be measured by various statistical indicators, such as calculating the absolute difference between the current value and the baseline mean, calculating the Z-score (i.e., the difference between the current value and the baseline mean divided by the baseline standard deviation), or calculating the extent to which the current value exceeds the normal fluctuation range of the baseline (such as twice the standard deviation above and below the baseline mean). These quantified deviation indicators are compared with preset anomaly judgment thresholds to determine whether an anomaly has occurred.

[0132] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0133] This application embodiment can divide the anomaly analysis report generation device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0134] In some embodiments, this application also provides an anomaly analysis report generation apparatus. This anomaly analysis report generation apparatus may include one or more functional modules for implementing the anomaly analysis report generation method of the above method embodiments.

[0135] For example, Figure 4 This is a schematic diagram illustrating the composition of an anomaly analysis report generation device 400 provided in an embodiment of this application. Figure 4 As shown, the anomaly analysis report generation device includes a processing module 401 and a generation module 402.

[0136] Processing module 401 is used to parse the user's query text to obtain at least one query element; if it is determined that there is an abnormal query element among the at least one query element, it retrieves the target event from the event database based on the abnormal query element; and determines the abnormal cause of the abnormal event indicated by the abnormal query element based on the target event. Generating module 402 is used to generate an abnormal report based on the abnormal query element and the abnormal cause.

[0137] In some embodiments, the processing module 401 is further configured to determine the correlation between the target event and the abnormal query element based on the time, location, and causal relationship of the target event; wherein the causal relationship is the causal relationship between the target event and the abnormal event indicated by the abnormal query element; and if the correlation is greater than or equal to a first preset threshold, the abnormal cause is determined to be the target event.

[0138] In other embodiments, the processing module 401 is further configured to input the information of the target event and the abnormal query elements into the abnormal identification model, analyze the probability of the target event causing the abnormal event indicated by the abnormal query elements through the abnormal identification model, and determine the abnormal cause as the target event if the probability is greater than or equal to a second preset threshold.

[0139] In some other embodiments, the processing module 401 is further configured to, for each of the at least one query element, obtain target data from the indicator library based on the query element; the target data is the historical data and current data involved in the query element; and determine whether the query element is an abnormal query element based on the target data.

[0140] In some other embodiments, the processing module 401 is further configured to determine a historical baseline based on historical data; compare the current data with the historical baseline to determine whether the query element is an abnormal query element.

[0141] In some other embodiments, the generation module 402 is also used to generate images and tables using a visualization library based on the abnormal query elements and abnormal reasons; and to generate an abnormal report by combining the abnormal query elements, abnormal reasons, images and tables according to a preset structure.

[0142] In the case of implementing the functions of the integrated modules described above in hardware, this embodiment of the invention provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 5 As shown, the electronic device 900 includes: a processor 902, a communication interface 903, and a bus 904. Optionally, the electronic device 900 may also include a memory 901.

[0143] Processor 902 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0144] The communication interface 903 is used to connect to other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0145] The memory 901 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0146] As one possible implementation, the memory 901 can exist independently of the processor 902. The memory 901 can be connected to the processor 902 via a bus 904 and is used to store instructions or program code. When the processor 902 calls and executes the instructions or program code stored in the memory 901, it can implement the anomaly analysis report generation method provided in this embodiment of the invention.

[0147] In another possible implementation, the memory 901 can also be integrated with the processor 902.

[0148] The 904 bus can be an extended industry standard architecture (EISA) bus, etc. The 904 bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0149] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0150] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The program can be stored in the aforementioned computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be any of the foregoing embodiments or memory. The aforementioned computer-readable storage medium can also be an external storage device of the aforementioned service invocation device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the aforementioned service invocation device. Further, the aforementioned computer-readable storage medium can include both internal storage units of the aforementioned service invocation device and external storage devices. The aforementioned computer-readable storage medium is used to store the aforementioned computer program and other programs and data required by the aforementioned service invocation device. The aforementioned computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0151] This application also provides a computer program product comprising a computer program that, when run on a computer, causes the computer to execute any of the anomaly analysis report generation methods provided in the above embodiments.

[0152] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for generating anomaly analysis reports, characterized in that, The method includes: Parse the user's query text to obtain at least one query element; If it is determined that there is an abnormal query element among the at least one query element, a target event is retrieved from the event database based on the abnormal query element; wherein, the abnormal query element is used to indicate the existence of an abnormal event; the target event is a current event related to the abnormal query element, and the time of the current event is determined based on the time element in the query text; the event database is used to store airport operation and management events; Based on the target event, determine the cause of the anomaly indicated by the anomaly query element; An anomaly report is generated based on the anomaly query elements and the anomaly cause.

2. The method according to claim 1, characterized in that, The step of determining the cause of the abnormal event indicated by the abnormal query element based on the target event includes: Based on the time, location, and causal relationship of the target event, the correlation between the target event and the abnormal query element is determined; wherein, the causal relationship is the causal relationship between the target event and the abnormal event indicated by the abnormal query element; If the correlation is greater than or equal to a first preset threshold, the cause of the anomaly is determined to be the target event.

3. The method according to claim 1, characterized in that, The step of determining the cause of the abnormal event indicated by the abnormal query element based on the target event includes: The information of the target event and the anomaly query elements are input into the anomaly identification model. The anomaly identification model analyzes the probability that the target event causes the anomaly event indicated by the anomaly query elements. If the probability is greater than or equal to a second preset threshold, the cause of the anomaly is determined to be the target event.

4. The method according to claim 1, characterized in that, After parsing the user's query text to obtain at least one query element, the method further includes: For each of the at least one query element, target data is obtained from the indicator library based on the query element; the target data consists of historical data and current data related to the query element. Based on the target data, determine whether the query element is an abnormal query element.

5. The method according to claim 4, characterized in that, The step of determining whether the query element is an abnormal query element based on the target data includes: A historical baseline is determined based on the aforementioned historical data; The current data is compared with the historical baseline to determine whether the query element is an abnormal query element.

6. The method according to claim 1, characterized in that, The anomaly report includes text, images, and tables; the generation of the anomaly report based on the anomaly query elements and the anomaly cause includes: Based on the aforementioned abnormal query elements and the aforementioned abnormal causes, images and tables are generated using a visualization library; An anomaly report is generated by combining the anomaly query elements, the anomaly cause, the image, and the table according to a preset structure.

7. An anomaly analysis report generation device, characterized in that, include: Processing module, generation module; The processing module is used to parse the user's query text to obtain at least one query element; If it is determined that there is an abnormal query element among the at least one query element, the target event is retrieved from the event database based on the abnormal query element; Based on the target event, determine the cause of the anomaly indicated by the anomaly query element; The generation module is used to generate an anomaly report based on the anomaly query elements and the anomaly cause.

8. An electronic device, characterized in that, The device includes a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computer device to implement the anomaly analysis report generation method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer-executable instructions that, when executed on a computer, cause the computer to perform the anomaly analysis report generation method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when run on an electronic device, causes the electronic device to perform the anomaly analysis report generation method as described in any one of claims 1 to 6.

Images