Information anomaly analysis method and device based on data and knowledge fusion bidirectional driving

Abstract

The invention discloses an information anomaly analysis method and device based on data and knowledge fusion bidirectional driving. The method comprises the steps of obtaining to-be-analyzed data information and standard data; extracting a core entity from the standard data and constructing a primary anomaly analysis model; the data information to be analyzed is analyzed and judged through the primary anomaly analysis model, and a primary analysis result is given; performing semantic analysis on the to-be-analyzed data information to obtain a unified analysis vector; and fusing the primary analysis result and the unified analysis vector, and performing bidirectional driving anomaly analysis on the to-be-analyzed data information through a multi-layer graph neural network model to obtain an information anomaly probability. Through a three-layer heterogeneous architecture of a multilayer graph neural network model, a primary analysis result directly reaches a deep layer through interlayer bidirectional modulation and progressive fusion of data driving and knowledge driving, knowledge signal attenuation interlayer function decoupling is prevented, an abnormal source can be traced, and accurate analysis of information abnormity is realized.

Description

Technical Field

[0001] This invention belongs to the technical field of power systems, specifically relating to a method and apparatus for information anomaly analysis based on bidirectional driving of data and knowledge fusion. Background Technology

[0002] In related technologies, data fusion and knowledge management are often handled independently. Data fusion relies heavily on statistical methods or machine learning models, which can process numerical data but lack effective utilization of domain knowledge, leading to problems such as semantic inconsistency and missing business logic verification. Knowledge management is mostly based on symbolic logic and rule engines, which are difficult to deeply integrate with real-time data streams, limiting its adaptability and reasoning ability in dynamic environments.

[0003] Especially in complex systems such as power grid infrastructure and large-scale project management, data sources are diverse, such as professional databases for development, infrastructure, finance, and materials. Business rules are complex, such as the contract amount not exceeding the budget limit. Traditional methods are difficult to achieve the synergistic driving of data and knowledge, resulting in insufficient quality and credibility of underlying data, which affects the accuracy of risk analysis.

[0004] Patent application CN118690841A discloses a method and apparatus for constructing an electricity safety knowledge graph, comprising: collecting electricity safety knowledge data; integrating and extracting knowledge from the electricity safety knowledge data based on its data type to obtain a preliminary knowledge representation of the electricity safety knowledge data; performing knowledge fusion on the preliminary knowledge representation to obtain a standard knowledge representation of the electricity safety knowledge data; and storing the standard knowledge representation to obtain an electricity safety knowledge graph. This method can help power grid companies tap the value of massive amounts of data, integrate electricity knowledge, facilitate staff's query and acquisition of electricity information, and improve the work efficiency of the power industry. It also possesses capabilities such as fault hazard investigation and decision support, which is of great significance for the intelligentization of the power grid.

[0005] The aforementioned existing technologies provide a data foundation for troubleshooting by constructing knowledge graphs, but they cannot verify the compliance of the data or directly provide risk warnings. Therefore, how to leverage knowledge to guide the data fusion process and optimize the knowledge model through data feedback, forming a fusion model through iterative optimization, and achieving layered risk warnings and closed-loop feedback to improve the overall system's intelligence and reliability is a problem that needs to be solved. Summary of the Invention

[0006] To address the shortcomings of the existing technologies, this invention provides a method and apparatus for bidirectional information anomaly analysis based on data and knowledge fusion. The method includes: acquiring data information to be analyzed and corresponding standardized data; extracting core entities from the standardized data and constructing a primary anomaly analysis model; analyzing and judging the data information to be analyzed using the primary anomaly analysis model to provide a primary analysis result; performing semantic analysis on the data information to be analyzed to obtain a unified analysis vector; and fusing the primary analysis result and the unified analysis vector, using a multi-layer graph neural network model to perform bidirectional anomaly analysis on the data information to be analyzed to obtain the information anomaly probability.

[0007] By analyzing the data information to be analyzed from the initial analysis results and unified analysis vectors, and combining the bidirectional anomaly analysis with a multi-layer graph neural network model, the probability of information anomalies is obtained. The three-layer heterogeneous architecture of the multi-layer graph neural network model, through bidirectional modulation and progressive fusion between layers driven by data and knowledge, directly reaches the deep layer from the initial analysis results, prevents knowledge signal attenuation, decouples the functions between layers, and traces the source of anomalies, thus realizing accurate analysis of information anomalies.

[0008] Firstly, the present invention provides an information anomaly analysis method based on a two-way driven fusion of data and knowledge, specifically including the following steps: Obtain the data to be analyzed and the corresponding standardized data; Extract core entities from standardized data and construct a basic anomaly analysis model; The preliminary anomaly analysis model is used to analyze and judge the data information to be analyzed, and preliminary analysis results are given. Semantic analysis is performed on the data to be analyzed to obtain a unified analysis vector; By integrating the results of the initial analysis and the unified analysis vector, a multi-layer graph neural network model is used to perform bidirectional anomaly analysis on the data to be analyzed, and the probability of information anomalies is obtained.

[0009] Furthermore, core entities are extracted from the standardized data and a basic anomaly analysis model is constructed, specifically including: Based on paragraph markers, the standardized data is segmented and cleaned to obtain the first standardized data. By combining the preset regular expressions, rules are extracted from the first set of standardized data to obtain the second set of standardized data; Entities are extracted from the second-standard data and threshold normalization is performed to obtain the core entities; Analyze the relationships between the core entities and the attribute thresholds corresponding to each core entity to construct a basic anomaly analysis model.

[0010] Furthermore, the preliminary anomaly analysis model is used to analyze and judge the data to be analyzed, and preliminary analysis results are given, including: Extract the attributes to be analyzed and their corresponding attribute values ​​from the data to be analyzed; Based on the attribute to be analyzed, a matching is performed in the primary anomaly analysis model to obtain the corresponding attribute anomaly range; Based on the range of attribute anomalies, the attribute values ​​are judged, and preliminary analysis results are given.

[0011] Furthermore, semantic analysis is performed on the data to be analyzed to obtain a unified analysis vector, which specifically includes: The discrete information in the data to be analyzed is encoded and the encoded results are concatenated to obtain a discrete vector. The continuous information in the data to be analyzed is normalized, and the normalization results are concatenated to obtain a continuous vector; By unifying and fusing the dimensions of discrete and continuous vectors, a unified analysis vector is obtained.

[0012] Furthermore, by integrating the preliminary analysis results and the unified analysis vector, a multi-layer graph neural network model is used to perform bidirectional anomaly analysis on the data to be analyzed, obtaining the probability of information anomalies, specifically including: The initial analysis results and the unified analysis vector are fused to obtain the initial features of the nodes; Based on the initial analysis results, adjust the attention weights corresponding to the initial features of the nodes; Based on the adjusted attention weights, the initial node features are aggregated to obtain the abnormal fusion features; The probability of information anomalies is obtained by analyzing and judging the anomaly fusion features through hard constraint branches or soft constraint branches.

[0013] Furthermore, the initial features of the nodes are specifically represented as follows: Initial node feature = α·(anomaly flag) (abnormal confidence) + (1-α)·unified analysis vector; where α is the learnable knowledge weight coefficient.

[0014] Furthermore, the initial analysis results include anomaly flags and corresponding anomaly confidence levels. The multi-layer graph neural network model includes a feature fusion layer, an attention weight control module, multiple graph convolutional layers, and a rule constraint layer. The rule constraint layer includes hard constraint branches and soft constraint branches. The feature fusion layer fuses the initial analysis results and the unified analysis vector to obtain the initial features of the nodes; The attention weight control module adjusts the attention weights corresponding to the initial node features in each graph convolutional layer based on the anomaly flag and anomaly confidence level. The graph convolutional layer combines the adjusted attention weights to aggregate the initial node features, resulting in anomaly fusion features; Based on the anomaly flag, determine whether the branch is a hard constraint or a soft constraint, output the warning result, and obtain the probability of information anomaly.

[0015] Furthermore, multiple graph convolutional layers, including spatial correlation convolutional layers, dependency convolutional layers, and node credibility convolutional layers, aggregate the initial node features based on adjusted attention weights to obtain anomaly fusion features, specifically including: The spatial correlation convolutional layer modulates the kernel weights using the Hadamard product based on anomaly flags, aggregates node features that satisfy spatial adjacency conditions, and gives a spatially propagated anomaly feature vector. The dependency convolutional layer dynamically filters low-confidence dependency edges based on spatially propagated anomaly feature vectors and unified analysis vectors, and provides cascaded dependency anomaly feature vectors. The node confidence convolutional layer uses the cascaded dependent anomaly feature vector as the initial value of the node. Combining the anomaly confidence of the primary analysis results, it adjusts the gain coefficient of each node's convolutional channel to give anomaly fusion features.

[0016] Furthermore, the abnormal fusion features are analyzed and judged through hard constraint branches or soft constraint branches to obtain the probability of information abnormality, specifically including: Each graph convolutional layer has a residual connection that is directly connected to the rule constraint layer. The decision threshold of the hard constraint branch is directly injected into the batch normalized scaling parameter of the spatial correlation convolutional layer and the node credibility convolutional layer. The probability distribution constraint of the soft constraint branch is applied to the activation function output of the dependency convolutional layer through element-wise multiplication, realizing the bidirectional modulation and progressive integration of data-driven and knowledge-driven approaches between layers.

[0017] Furthermore, the method also includes: Tasks are assigned based on the abnormal problems corresponding to the information anomaly probability, and the task assignment results are obtained. Assign corresponding task permissions based on the task allocation results; Based on task permissions, query historical anomaly sets and the technical basis for the anomalies; Combine a pre-set anomaly report template with historical anomaly data and technical evidence to output the target anomaly report; Based on the target anomaly report, the primary anomaly analysis model and the multi-layer graph neural network model are updated to complete the closed-loop optimization.

[0018] Secondly, the present invention also provides an information anomaly analysis device based on bidirectional driving of data and knowledge fusion, employing any of the above-mentioned information anomaly analysis methods based on bidirectional driving of data and knowledge fusion, including: The data acquisition module is used to acquire the data to be analyzed and the corresponding standardized data. The basic model building module is used to extract core entities from standard data and build a basic anomaly analysis model. The primary analysis module is used to analyze and judge the data to be analyzed using a primary anomaly analysis model, and to provide primary analysis results. The semantic analysis module is used to perform semantic analysis on the data to be analyzed and obtain a unified analysis vector. The anomaly output module is used to fuse the primary analysis results and the unified analysis vector. Through a multi-layer graph neural network model, it performs bidirectional anomaly analysis on the data to be analyzed and obtains the probability of information anomalies.

[0019] The information anomaly analysis method and apparatus based on bidirectional driving of data and knowledge fusion provided by this invention have at least the following beneficial effects: (1) By analyzing the data information to be analyzed from the primary analysis results and the unified analysis vector, and combining the multi-layer graph neural network model to perform bidirectional anomaly analysis, the probability of information anomaly is obtained. The three-layer heterogeneous architecture of the multi-layer graph neural network model achieves bidirectional modulation and progressive fusion between layers through data-driven and knowledge-driven approaches, allowing the primary analysis results to reach deeper layers, preventing knowledge signal attenuation, decoupling of inter-layer functions, tracing the source of anomalies, and realizing accurate analysis of information anomalies.

[0020] (2) By merging the soft constraint branches and hard constraint branches in the rule constraint layer, it is more in line with business cognition. Combined with the graph convolution layer, it propagates abnormal information between core entities, enabling each core entity to not only perceive its own state, but also capture the abnormal transmission effect of related devices, dynamically modulate the propagation intensity, and achieve accurate analysis of abnormal information. Attached Figure Description

[0021] Figure 1 A flowchart of an information anomaly analysis method based on bidirectional driving of data and knowledge fusion provided in an embodiment of the present invention; Figure 2 A flowchart for determining the probability of information anomalies provided in an embodiment of the present invention; Figure 3 A model architecture diagram of a multilayer graph neural network model provided in an embodiment of the present invention; Figure 4 The structural block diagram of the information anomaly analysis device based on bidirectional driving of data and knowledge fusion provided in the embodiments of the present invention.

[0022] The modules are as follows: 201. Data Acquisition Module; 202. Primary Model Construction Module; 203. Primary Analysis Module; 204. Semantic Analysis Module; 205. Anomaly Output Module. Detailed Implementation

[0023] To better understand the above technical solutions, a detailed description of the solutions will be provided below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0024] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0025] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0026] like Figure 1 As shown in the figure, this embodiment of the invention provides an information anomaly analysis method based on a two-way driven approach of data and knowledge fusion. The specific steps are as follows: S101: Obtain the data to be analyzed and the corresponding standard data.

[0027] It is important to understand that the data to be analyzed refers to the relevant parameters of the power engineering or power materials that need to be analyzed, while the standard data refers to the relevant data standards and technical specifications within the power engineering or power materials industry.

[0028] S102: Extract core entities from standard data and construct a basic anomaly analysis model.

[0029] Furthermore, core entities are extracted from the standardized data and a basic anomaly analysis model is constructed, specifically including: Based on paragraph markers, the standardized data is segmented and cleaned to obtain the first standardized data. By combining the preset regular expressions, rules are extracted from the first set of standardized data to obtain the second set of standardized data; Entities are extracted from the second-standard data and threshold normalization is performed to obtain the core entities; Analyze the relationships between the core entities and the attribute thresholds corresponding to each core entity to construct a basic anomaly analysis model.

[0030] In one specific implementation, the data is segmented and word-segmented based on paragraph markers in the specification data. The resulting words are then cleaned to obtain the first specification data. For example, "should not be greater than" and "must not exceed" are standardized to "≤", resulting in "embedded part horizontal deviation ≤ 2mm." After obtaining the first specification data, rules are extracted from it using a preset regular expression to obtain the second specification data. Entities are extracted from the second specification data and threshold normalization is performed to obtain core entities. In a specific example, the core entity is a "entity-attribute-value" triple. Threshold normalization ensures that the same indicator across different specifications is comparable; for example, standardizing grounding resistance to Ω, length to mm, and temperature to ℃. Another example is converting "not less than" to "≥" and "not greater than" to "≤". The core entities are then aligned, unifying multiple names for the same equipment / process. For example, strings with a similarity ≥ 0.8 are automatically merged, and core entities with a BERT vector cosine ≥ 0.85 are merged. In a specific example, ① segmented cleaning: send = "levelness of main transformer foundation embedded parts ≤ 2 mm", ② rule extraction: entity = main transformer foundation embedded parts, attr = levelness, value = 2, unit = mm, op = ≤, ③ threshold normalization: uniform length unit is mm, and finally entity alignment is performed.

[0031] By extracting core concepts, attributes, and relationships from normative data including industry standards, specification documents, and business systems, core entities are obtained, the hierarchical constraints of the core entities are clarified, and a machine-readable primary anomaly analysis model is constructed.

[0032] S103: Analyze and judge the data information to be analyzed using the primary anomaly analysis model, and give the primary analysis results.

[0033] Furthermore, the preliminary anomaly analysis model is used to analyze and judge the data to be analyzed, and preliminary analysis results are given, including: Extract the attributes to be analyzed and their corresponding attribute values ​​from the data to be analyzed; Based on the attribute to be analyzed, a matching is performed in the primary anomaly analysis model to obtain the corresponding attribute anomaly range; Based on the range of attribute anomalies, the attribute values ​​are judged, and preliminary analysis results are given.

[0034] In one specific implementation, multiple rule verification nodes are deployed in the primary anomaly analysis model to perform real-time logical reasoning and consistency checks on the attributes to be analyzed and their corresponding attribute values ​​in the data to be analyzed. Based on the corresponding attribute anomaly range, abnormal data is automatically identified and marked, and primary analysis results containing anomaly type, related entities, and details of rule violations are generated.

[0035] S104: Perform semantic analysis on the data to be analyzed to obtain a unified analysis vector.

[0036] Furthermore, semantic analysis is performed on the data to be analyzed to obtain a unified analysis vector, which specifically includes: The discrete information in the data to be analyzed is encoded and the encoded results are concatenated to obtain a discrete vector. The continuous information in the data to be analyzed is normalized, and the normalization results are concatenated to obtain a continuous vector; By unifying and fusing the dimensions of discrete and continuous vectors, a unified analysis vector is obtained.

[0037] In one specific implementation, the structured data features in the data to be analyzed are processed by a neural network encoder: discrete categorical features (i.e., discrete information) are transformed through an embedding layer, and continuous numerical features (i.e., continuous information) are normalized and projected through a fully connected layer. All features are then fused and projected into a vector space with the same dimension as the knowledge graph embedding vector to obtain a unified analysis vector.

[0038] In a specific example, core entities ("main transformer", "merging unit", "intelligent terminal") and relationships ("communication connection", "functional dependency", "protection coordination") are mapped to a unified 128-dimensional vector space. Another example is project management data (progress percentage: main transformer installation completed 60%), equipment monitoring data (category: "communication interruption"), and technical specification data (discrete value: "61850-9-2 protocol"). The neural network encoder embeds "communication interruption" as a vector, normalizes it by 60%, and projects it. The protocol text is encoded using lightweight BERT. The three are then fused and mapped to the same space as the knowledge vector, resulting in a unified analysis vector.

[0039] S105: Integrating the results of the initial analysis and the unified analysis vector, a multi-layer graph neural network model is used to perform bidirectional anomaly analysis on the data to be analyzed, and the probability of information anomalies is obtained.

[0040] Furthermore, referring to Figure 2The initial analysis results include anomaly flags and corresponding anomaly confidence levels. The multi-layer graph neural network model includes a feature fusion layer, an attention weight control module, multiple graph convolutional layers, and a rule constraint layer. The rule constraint layer includes hard constraint branches and soft constraint branches. The feature fusion layer fuses the initial analysis results and the unified analysis vector to obtain the initial features of the nodes; The attention weight control module adjusts the attention weights corresponding to the initial node features in each graph convolutional layer based on the anomaly flag and anomaly confidence level. The graph convolutional layer combines the adjusted attention weights to aggregate the initial node features, resulting in anomaly fusion features; Based on the anomaly flag, determine whether the branch is a hard constraint or a soft constraint, output the warning result, and obtain the probability of information anomaly.

[0041] Specifically, the initial features of a node are represented as follows: Initial node feature = α·(anomaly flag) (abnormal confidence) + (1-α)·unified analysis vector; where α is the learnable knowledge weight coefficient.

[0042] Furthermore, multiple graph convolutional layers, including spatial correlation convolutional layers, dependency convolutional layers, and node credibility convolutional layers, aggregate the initial node features based on adjusted attention weights to obtain anomaly fusion features, specifically including: The spatial correlation convolutional layer modulates the kernel weights using the Hadamard product based on anomaly flags, aggregates node features that satisfy spatial adjacency conditions, and gives a spatially propagated anomaly feature vector. The dependency convolutional layer dynamically filters low-confidence dependency edges based on spatially propagated anomaly feature vectors and unified analysis vectors, and provides cascaded dependency anomaly feature vectors. The node confidence convolutional layer uses the cascaded dependent anomaly feature vector as the initial value of the node. Combining the anomaly confidence of the primary analysis results, it adjusts the gain coefficient of each node's convolutional channel to give anomaly fusion features.

[0043] Furthermore, the abnormal fusion features are analyzed and judged through hard constraint branches or soft constraint branches to obtain the probability of information abnormality, specifically including: Each graph convolutional layer has a residual connection that is directly connected to the rule constraint layer. The decision threshold of the hard constraint branch is directly injected into the batch normalized scaling parameter of the spatial correlation convolutional layer and the node credibility convolutional layer. The probability distribution constraint of the soft constraint branch is applied to the activation function output of the dependency convolutional layer through element-wise multiplication, realizing the bidirectional modulation and progressive integration of data-driven and knowledge-driven approaches between layers.

[0044] Reference Figure 3The feature fusion layer receives the initial analysis results, including anomaly flags and anomaly confidence levels, along with a unified analysis vector, and performs feature fusion to obtain the initial node features. The rule constraint layer includes hard constraint branches (decision thresholds) and soft constraint branches (probability distribution constraints). Multiple graph convolutional layers form a heterogeneous three-layer graph convolutional architecture. These layers include spatial association convolutional layers, dependency convolutional layers, and node confidence convolutional layers. The spatial association convolutional layer is the first graph convolutional layer. It modulates the convolution kernel weights using a Hadamard product to aggregate only the node features that satisfy the spatial adjacency condition, outputting a spatially propagated anomaly feature vector. The dependency convolutional layer is the second graph convolutional layer. It receives the spatially propagated anomaly feature vector and the unified analysis vector output by the spatial association convolutional layer. Through a learnable gating attention mechanism, it dynamically masks low-anomaly confidence dependency edges, outputting a cascaded dependency anomaly feature vector. The node confidence convolutional layer is a third-level graph convolutional layer. It uses the cascaded dependency anomaly feature vector output from the dependency convolutional layer as the initial node value. It adjusts the gain coefficient of each node's convolutional channel based on the anomaly confidence from the initial analysis results, extracting anomaly fusion features caused by differences in node reliability. Each graph convolutional layer has a residual connection directly connected to the rule constraint layer. The decision threshold for hard constraint branches is directly injected into the batch normalization scaling parameters of the dependency and node confidence convolutional layers. The probability distribution constraints for soft constraint branches are applied to the activation function output of the dependency convolutional layer through element-wise multiplication. Finally, the output layer outputs the anomaly probability.

[0045] This architecture achieves precise analysis of information anomalies through bidirectional modulation and progressive fusion of data-driven and knowledge-driven approaches between layers.

[0046] Existing graph neural network models often use multi-layer GCN / GAT structures that share the same aggregation function, only stacking in depth. Residual connections only connect adjacent layers to prevent gradient vanishing, and black-box attention weights make it difficult to pinpoint the source of anomalies. This invention's multi-layer graph neural network model employs a three-layer heterogeneous architecture, with each layer using different operators (Hadamard product, gated masking, channel weighting), and bidirectional parameter injection: hard-constrained branch modulation (BN) layers and soft-constrained branch modulation activation functions. Simultaneously, it delivers primary analysis results directly to deeper layers, preventing knowledge signal attenuation and decoupling between layer functions, enabling the tracing of anomaly sources. Progressive constraints exist between multi-layer graph convolutional layers, and each layer is modulated in real-time by a rule-constrained layer.

[0047] In one specific implementation, the graph convolutional layer fuses the initial analysis result R and the unified analysis vector V to obtain the initial node features X_node=Concat(V,R).

[0048] In each layer of the graph convolutional layer, the initial analysis result R affects the information aggregation weight of neighboring nodes. In a specific example, the violation information (excessive vacuum) of GIS device A, due to its high abnormal confidence, is amplified by 1.98 times when propagated to the "relay protection device" node that depends on it, causing the protection device node to also perceive the upstream quality anomaly.

[0049] By adding a rule gating unit before the rule constraint layer, the selection of hard constraint branch or soft constraint branch is determined. For example, input: GIS equipment A vacuum degree 0.12Pa (exceeding standard), the initial analysis result R=[0,1,...,0.02,0.98] (violation, high severity), unified analysis vector V=[0.41,-0.19,...,-0.08], and the initial node feature is determined: X_GIS-A=Concat(V,R). In the first graph convolutional layer, information is aggregated from neighboring nodes (vacuum pump, monitoring system). Since R[1]=1, the attention weight is enhanced, and the abnormal information is strengthened. Second graph convolutional layer: propagates to the "relay protection device" node, and transmits the "upstream equipment quality abnormality" signal. In the rule constraint layer: the abnormal flag bit violation_flag=1 is detected, and a strong constraint branch is adopted to force the abnormal score ≥0.6. Output: risk_score = 0.82 (high risk).

[0050] By fusing soft-constraint and hard-constraint branches, the model better aligns with business understanding. The role of the graph convolutional layer is to propagate anomaly information through relationships between core entities, enabling each core entity to not only perceive its own state but also capture the anomaly propagation effects of related devices. The initial analysis result R dynamically modulates the propagation strength to ensure that business logic (such as "critical equipment anomalies require enhanced propagation") is integrated into the topology.

[0051] The graph convolutional layer is based on attention weight modulation, taking initial node features [V;R] as input, where R includes anomaly flags and anomaly confidence. When a core entity violates a rule, its attention weights propagating to neighbors are multiplied by a coefficient (1+λ·anomaly confidence), ensuring that the anomalous information is amplified and propagated along the dependency chain. The output is a deeply aggregated anomaly fusion feature X_L, which has fused neighborhood anomaly information. Through hard and soft constraint branches in the rule constraint layer, the hard constraint branch forces anomaly thresholds (e.g., ≥0.6) for violating core entities, preventing the neural network from underestimating the anomalous level due to data smoothing. The soft constraint branch dynamically adjusts the final output based on the anomaly confidence, achieving fine-grained control. Through a gating mechanism, combined with anomaly flags, the constraint path is automatically selected, determining whether to use a hard or soft constraint branch, and outputting warning results, achieving end-to-end fusion of "data + knowledge".

[0052] In a specific example, taking the case of a partial discharge of 8.5 pC exceeding the standard in the gas chamber of phase A of a 220kV substation GIS equipment as an example, the graph convolutional layer first receives the initial node features—the unified analysis vector V encodes the monitoring data of "partial discharge of 8.5 pC" and its semantic association with insulation performance. The initial analysis result R includes the analysis result with an anomaly flag bit = 1 and an anomaly confidence level of 0.96. During message transmission, due to the activation of the anomaly flag bit in the initial analysis result R, the attention weight propagated by GIS-A to dependent nodes (main transformer, relay protection device) is amplified from the baseline value of 0.3 to 0.58, enabling downstream nodes to deeply integrate the anomaly signal of "upstream equipment insulation anomaly" and complete the cross-equipment anomaly propagation topology reasoning. At this time, the deep representation of the relay protection device is updated to [0.61, 0.28], implicitly sensing the protection failure anomaly.

[0053] Subsequently, the rule constraint layer intervened, detecting the anomaly flag of GIS-A and triggering a hard constraint branch. This forced the original anomaly score of 0.52 in the anomaly fusion features output by the graph convolutional layer to be raised to a business baseline of no less than 0.6, and further fine-tuned based on a high confidence level of 0.96. The final output information had an anomaly probability of 0.81, which was determined to be a high-risk level. This result not only reflects the data-driven reasoning of the graph convolutional layer on the transmission chain of "insulation defect → system reliability degradation," but also ensures the absolute authority of the business rules, driving the system to immediately trigger the equipment shutdown and maintenance process and notify the high-voltage testing team for re-inspection.

[0054] When the probability of information anomalies reaches the anomaly threshold, the workflow engine is triggered. The workflow engine includes: technical problem diagnosis → expert consultation → solution review → implementation verification → knowledge entry into the database.

[0055] First, tasks are assigned based on the abnormal problems corresponding to the information anomaly probability, and the task assignment results are obtained. Assign corresponding task permissions based on the task allocation results; Based on task permissions, query historical anomaly sets and the technical basis for the anomalies; Combine a pre-set anomaly report template with historical anomaly data and technical evidence to output the target anomaly report; Based on the target anomaly report, the primary anomaly analysis model and the multi-layer graph neural network model are updated to complete the closed-loop optimization.

[0056] In a specific example, based on the anomaly problem corresponding to the information anomaly probability, a "GIS insulation diagnosis task" is assigned to the high-voltage expert, with the corresponding task permission being to view historical partial discharge curves. A "61850 protocol verification task" is assigned to the communication technology manager, with the corresponding task permission being to access the configuration library. The task content is to complete the initial cause analysis of the anomaly problem within 24 hours. The high-voltage expert, based on the anomaly problem "GIS partial discharge 6.8pC," retrieves a historical anomaly set and the technical basis for the anomaly. For example, in a case study: in 2021, a GIS device at a 220kV substation experienced partial discharge anomalies due to "excessive humidity in the installation environment," and the solution was "nitrogen drying treatment + vacuum impregnation." The technical basis for the anomaly is: "Q / GDW 11059.1-2013 GIS Equipment On-site Handover Test Procedure" stipulates that partial discharge exceeding the standard requires "aging test re-inspection." Combining a preset anomaly report template, embedding the retrieved historical anomaly set and technical basis for the anomaly, a "GIS Equipment A Insulation Performance Anomaly Technical Analysis Report" is generated, recommending "immediate shutdown and re-inspection." The conclusion in the target anomaly report, "Ambient humidity of 92% causes insulation dampness," was extracted as structured knowledge. This knowledge was fed back to the primary anomaly analysis model and the multilayer graph neural network model. The primary anomaly analysis model added the core entity "ambient humidity" and its causal relationship with "insulation performance." Simultaneously, the multilayer graph neural network model was updated, marking "humidity > 85%" as a high-risk prerequisite. Subsequent automatic triggering of enhanced monitoring for equipment installations in high-humidity environments improved the accuracy of technical anomaly identification by 22%.

[0057] Through the closed-loop execution of the above process, the project detected insulation defects in GIS equipment 48 hours in advance, avoiding the risk of live operation. The average processing time for technical issues was reduced by 50%, and the efficiency of cross-disciplinary technical collaboration was improved by 45%. Moreover, the entire process was based entirely on technical parameters and safety standards, without using any financial data, achieving purely technology-driven intelligent risk management.

[0058] Reference Figure 4 This invention provides an information anomaly analysis device based on a two-way driven approach of data and knowledge fusion, comprising: The data acquisition module 201 is used to acquire the data information to be analyzed and the corresponding standard data; The primary model building module 202 is used to extract core entities from the normative data and build a primary anomaly analysis model. The primary analysis module 203 is used to analyze and judge the data information to be analyzed through the primary anomaly analysis model and give the primary analysis results. Semantic analysis module 204 is used to perform semantic analysis on the data to be analyzed and obtain a unified analysis vector; The anomaly output module 205 is used to fuse the primary analysis results and the unified analysis vector. Through a multi-layer graph neural network model, it performs bidirectional anomaly analysis on the data to be analyzed and obtains the anomaly probability.

[0059] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the described module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0060] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and variations of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and variations.

Claims

1. An information anomaly analysis method based on a two-way driven approach of data and knowledge fusion, characterized in that, include: Obtain the data to be analyzed and the corresponding standardized data; Extract core entities from standardized data and construct a basic anomaly analysis model; The preliminary anomaly analysis model is used to analyze and judge the data information to be analyzed, and preliminary analysis results are given. Semantic analysis is performed on the data to be analyzed to obtain a unified analysis vector; By integrating the results of the initial analysis and the unified analysis vector, a multi-layer graph neural network model is used to perform bidirectional anomaly analysis on the data to be analyzed, and the probability of information anomalies is obtained.

2. The information anomaly analysis method based on bidirectional driving of data and knowledge fusion as described in claim 1, characterized in that, Extracting core entities from standardized data and constructing a basic anomaly analysis model specifically includes: Based on paragraph markers, the standardized data is segmented and cleaned to obtain the first standardized data. By combining the preset regular expressions, rules are extracted from the first set of standardized data to obtain the second set of standardized data; Entities are extracted from the second-standard data and threshold normalization is performed to obtain the core entities; Analyze the relationships between the core entities and the attribute thresholds corresponding to each core entity to construct a basic anomaly analysis model.

3. The information anomaly analysis method based on bidirectional driving of data and knowledge fusion as described in claim 1, characterized in that, The preliminary anomaly analysis model is used to analyze and judge the data to be analyzed, and preliminary analysis results are given, including: Extract the attributes to be analyzed and their corresponding attribute values ​​from the data to be analyzed; Based on the attribute to be analyzed, a matching is performed in the primary anomaly analysis model to obtain the corresponding attribute anomaly range; Based on the range of attribute anomalies, the attribute values ​​are judged, and preliminary analysis results are given.

4. The information anomaly analysis method based on bidirectional driving of data and knowledge fusion as described in claim 1, characterized in that, Semantic analysis is performed on the data to be analyzed to obtain a unified analysis vector, which specifically includes: The discrete information in the data to be analyzed is encoded and the encoded results are concatenated to obtain a discrete vector. The continuous information in the data to be analyzed is normalized, and the normalization results are concatenated to obtain a continuous vector; By unifying and fusing the dimensions of discrete and continuous vectors, a unified analysis vector is obtained.

5. The information anomaly analysis method based on bidirectional driving of data and knowledge fusion as described in claim 1, characterized in that, By integrating the results of the initial analysis and the unified analysis vector, a multi-layer graph neural network model is used to perform bidirectional anomaly analysis on the data to be analyzed, obtaining the probability of information anomalies, specifically including: The initial analysis results and the unified analysis vector are fused to obtain the initial features of the nodes; Based on the initial analysis results, adjust the attention weights corresponding to the initial features of the nodes; Based on the adjusted attention weights, the initial node features are aggregated to obtain the abnormal fusion features; The probability of information anomalies is obtained by analyzing and judging the anomaly fusion features through hard constraint branches or soft constraint branches.

6. The information anomaly analysis method based on bidirectional driving of data and knowledge fusion as described in claim 5, characterized in that, The initial analysis results include anomaly flags and corresponding anomaly confidence levels. The multi-layer graph neural network model includes a feature fusion layer, an attention weight control module, multiple graph convolutional layers, and a rule constraint layer. The rule constraint layer includes hard constraint branches and soft constraint branches. The feature fusion layer fuses the initial analysis results and the unified analysis vector to obtain the initial features of the nodes; The attention weight control module adjusts the attention weights corresponding to the initial node features in each graph convolutional layer based on the anomaly flag and anomaly confidence level. The graph convolutional layer combines the adjusted attention weights to aggregate the initial node features, resulting in anomaly fusion features; Based on the anomaly flag, determine whether the branch is a hard constraint or a soft constraint, output the warning result, and obtain the probability of information anomaly.

7. The information anomaly analysis method based on bidirectional driving of data and knowledge fusion as described in claim 6, characterized in that, Multiple graph convolutional layers, including spatial correlation convolutional layers, dependency convolutional layers, and node credibility convolutional layers, aggregate initial node features based on adjusted attention weights to obtain anomaly fusion features, specifically including: The spatial correlation convolutional layer modulates the kernel weights using the Hadamard product based on anomaly flags, aggregates node features that satisfy spatial adjacency conditions, and gives a spatially propagated anomaly feature vector. The dependency convolutional layer dynamically filters low-confidence dependency edges based on spatially propagated anomaly feature vectors and unified analysis vectors, and provides cascaded dependency anomaly feature vectors. The node confidence convolutional layer uses the cascaded dependent anomaly feature vector as the initial value of the node. Combining the anomaly confidence of the primary analysis results, it adjusts the gain coefficient of each node's convolutional channel to give anomaly fusion features.

8. The information anomaly analysis method based on bidirectional driving of data and knowledge fusion as described in claim 7, characterized in that, The abnormal fusion features are analyzed and judged through hard constraint branches or soft constraint branches to obtain the probability of information abnormality, specifically including: Each graph convolutional layer has a residual connection that is directly connected to the rule constraint layer. The decision threshold of the hard constraint branch is directly injected into the batch normalized scaling parameter of the spatial correlation convolutional layer and the node credibility convolutional layer. The probability distribution constraint of the soft constraint branch is applied to the activation function output of the dependency convolutional layer through element-wise multiplication, realizing the bidirectional modulation and progressive integration of data-driven and knowledge-driven approaches between layers.

9. The information anomaly analysis method based on bidirectional driving of data and knowledge fusion as described in claim 1, characterized in that, The method also includes: Tasks are assigned based on the abnormal problems corresponding to the information anomaly probability, and the task assignment results are obtained. Assign corresponding task permissions based on the task allocation results; Based on task permissions, query historical anomaly sets and the technical basis for the anomalies; Combine a pre-set anomaly report template with historical anomaly data and technical evidence to output the target anomaly report; Based on the target anomaly report, the primary anomaly analysis model and the multi-layer graph neural network model are updated to complete the closed-loop optimization.

10. An information anomaly analysis device based on bidirectional driving of data and knowledge fusion, characterized in that, The information anomaly analysis method based on bidirectional driving of data and knowledge fusion as described in any one of claims 1-9 includes: The data acquisition module is used to acquire the data to be analyzed and the corresponding standardized data. The basic model building module is used to extract core entities from standard data and build a basic anomaly analysis model. The primary analysis module is used to analyze and judge the data to be analyzed using a primary anomaly analysis model, and to provide primary analysis results. The semantic analysis module is used to perform semantic analysis on the data to be analyzed and obtain a unified analysis vector. The anomaly output module is used to fuse the primary analysis results and the unified analysis vector. Through a multi-layer graph neural network model, it performs bidirectional anomaly analysis on the data to be analyzed and obtains the probability of information anomalies.

Images