Method and system for intelligently interpreting power grid audit report by using large model

Abstract

The invention provides a power grid audit report intelligent interpretation method and system using a large model, and relates to the technical field of intelligence, and the method comprises the steps: obtaining audit problem description information, positioning a target entity node from a power grid business knowledge graph to construct a local sub-graph, recognizing an abnormal node based on an abnormal feature mode, and carrying out the recognition of the abnormal node. And performing reverse dependency analysis and time sequence correlation calculation to determine a problem root node, and constructing a complete traceability path. According to the invention, intelligent and accurate tracing of the power grid auditing problem is realized, the fault positioning efficiency is improved, and the operation and maintenance cost of the power grid is reduced.

Description

Technical Field

[0001] This invention relates to the field of intelligent technology, and in particular to a method and system for intelligent interpretation of power grid audit reports using large models. Background Technology

[0002] With the continuous expansion and increasing complexity of power systems, the importance of power grid auditing has become increasingly prominent. Power grid auditing aims to identify problems and propose corrective measures through the supervision and inspection of power companies' operation and management activities, thereby ensuring the safe, stable, and efficient operation of the power grid. Traditionally, the interpretation of power grid audit reports relies primarily on the professional knowledge and experience of auditors, involving manual analysis and tracing of audit issues. However, the development of big data technology and artificial intelligence, particularly the emergence of large-scale language models, has provided new technical means and methods for the intelligent interpretation of power grid audit reports.

[0003] The power grid business is characterized by system complexity, strong interrelationships, and high levels of specialization. Audit issues often involve multiple business processes and systems, requiring a deep understanding of business processes and data flows. Knowledge graphs, as a semantic network structure, can clearly express the complex relationships between entities, providing an important knowledge foundation for the intelligent interpretation of power grid audit issues.

[0004] Existing power grid audit report interpretation technologies have the following defects and shortcomings: Traditional audit problem tracing methods lack a comprehensive understanding of the business landscape. Most methods are limited to the analysis of problems within a single business system and cannot effectively handle complex anomalies across systems and business processes, resulting in inaccurate and incomplete identification of the root causes of audit problems.

[0005] Existing audit analysis methods do not make sufficient use of time-series information, making it difficult to effectively identify and quantify causal relationships between business events. Anomalies in power grid operations are usually triggered by a series of time-related events, but existing methods struggle to capture this dynamic evolution process and cannot accurately trace the propagation path and root cause of anomalies. Summary of the Invention

[0006] This invention provides a method and system for intelligent interpretation of power grid audit reports using large models, which can solve the problems in the prior art.

[0007] A first aspect of the present invention provides a method for intelligent interpretation of power grid audit reports using large models, comprising: The system acquires audit problem description information detected in the power grid audit system, locates the target entity node corresponding to the business object involved in the audit problem description information from the pre-constructed power grid business knowledge graph, and expands the neighbor nodes with the target entity node as the center to form a local subgraph structure. Based on the abnormal feature patterns corresponding to the problem type attributes in the audit problem description information, an abnormal node set in the local subgraph structure is identified where the business state attributes of the nodes have undergone abnormal changes. For each abnormal node in the abnormal node set, reverse dependency analysis is performed along the semantic edges in the power grid business knowledge graph to trace the predecessor node that caused the abnormal change in the business state attributes of the abnormal node. The historical state sequence of the predecessor node in the time dimension is extracted. By analyzing the temporal correlation between the state transition time in the historical state sequence and the time when the business state attribute of the abnormal node changes abnormally, the causal contribution of the predecessor node to the abnormal node is iteratively calculated until the source node with a causal contribution lower than a preset termination threshold is traced back. The source node is then identified as the root cause node of the problem. Construct a complete tracing path from the root cause node of the problem to the target entity node, and output the tracing results based on the root cause node of the problem and the complete tracing path.

[0008] From the pre-constructed power grid business knowledge graph, locate the target entity node corresponding to the business object involved in the audit problem description information, and expand the neighbor nodes around the target entity node to form a local subgraph structure, including: The business objects involved in the audit problem description information are converted into structured query expressions, which include entity type constraints, attribute value constraints, and relationship constraints of the business objects. In the power grid business knowledge graph, graph pattern matching based on the structured query expression is performed. By simultaneously satisfying the entity type constraint, the attribute value constraint, and the relationship constraint through multi-condition joint filtering, business entity nodes that meet the matching conditions are identified as the target entity nodes. Starting from the target entity node, a neighbor node expansion strategy is constructed based on the edge type and edge direction of the semantic edges in the power grid business knowledge graph. The neighbor node expansion strategy defines the traversal priority of different edge types and the inclusion conditions of different node types. Controlled expansion is performed according to the neighbor node expansion strategy, and the expanded neighbor nodes and their semantic edges and node attribute information with the target entity node together constitute the local subgraph structure.

[0009] Controlled expansion according to the neighbor node expansion strategy includes: During the expansion process, semantic relevance is evaluated for candidate neighbor nodes. This semantic relevance evaluation is achieved by calculating the vector distance between the semantic vector of the candidate neighbor node and the semantic vector of the problem type attribute in the audit problem description information. Only candidate neighbor nodes whose semantic relevance evaluation results exceed a preset relevance threshold are included in the local subgraph structure; For neighboring nodes included in the local subgraph structure, extract the multi-source attribute information of the neighboring node in the power grid business knowledge graph. The multi-source attribute information includes the business process attributes and operation permission attributes associated with the neighboring node, and label the multi-source attribute information as the extended attributes of the neighboring node in the local subgraph structure.

[0010] Based on the abnormal feature patterns corresponding to the problem type attributes in the audit problem description information, the set of abnormal nodes in the local subgraph structure whose business status attributes have undergone abnormal changes includes: Based on the problem type attribute in the audit problem description information, the abnormal feature pattern corresponding to the problem type attribute is determined. The abnormal feature pattern defines the normal value range and abnormal change threshold of the business status attribute. Traverse each node in the local subgraph structure and obtain the current value of the business status attribute of each node; The current value of the business status attribute of each node is compared with the normal value range defined in the abnormal feature pattern to determine whether the current value of the business status attribute exceeds the normal value range; For nodes whose current business status attribute value exceeds the normal value range, obtain the value of the node's business status attribute at the previous moment, and calculate the change between the current value and the value at the previous moment; Determine whether the amount of change exceeds the abnormal change threshold defined in the abnormal feature pattern; Nodes whose current business status attribute value exceeds the normal value range and whose change exceeds the abnormal change threshold are identified as abnormal nodes, and all abnormal nodes are combined into the abnormal node set.

[0011] For each anomalous node in the set of anomalous nodes, reverse dependency analysis is performed along the semantic edges in the power grid business knowledge graph to trace the predecessor nodes that caused the anomalous changes in the business state attributes of the anomalous nodes, including: A reverse dependency propagation graph is constructed, which takes the abnormal node as the propagation starting point and expands hierarchically in the reverse direction of the semantic edges in the power grid business knowledge graph, recording the dependency paths between each level node and the abnormal node; For each candidate predecessor node in the reverse dependency propagation graph, all dependency paths from the candidate predecessor node to the abnormal node are extracted, and the path credibility of each dependency path is calculated. The path credibility is comprehensively evaluated based on the completeness of the business rules of the semantic edges in the path and the state stability of the intermediate nodes in the path. For dependent paths whose path credibility exceeds a preset credibility threshold, the logical consistency between the business rule constraints carried by the semantic edges in the dependent path and the abnormal change patterns of the business state attributes of the abnormal nodes is analyzed. The starting node corresponding to the dependency path with logical consistency is determined as the predecessor node, and the predecessor node is marked with the propagation path identifier that affects the abnormal node.

[0012] By analyzing the temporal correlation between the state transition times in the historical state sequence and the times when the business state attributes of the anomalous node undergo abnormal changes, the causal contribution of the predecessor node to the anomalous node is iteratively calculated, including: The historical state sequence of the predecessor node is segmented into multiple stable state intervals and multiple state transition intervals. The state transition intervals correspond to the time periods in which the service state attributes of the predecessor node change. Extract the start time of the state transition interval as a candidate causal trigger time, and calculate the time difference between each candidate causal trigger time and the time when the business state attribute of the abnormal node undergoes an abnormal change; Based on the time difference and the business process transmission delay between the predecessor node and the abnormal node, determine whether each candidate causal trigger moment is within a reasonable causal time window; For candidate causal trigger moments located within a reasonable causal time window, extract all state transition moments where the business state attribute of the predecessor node undergoes a state transition from the historical state sequence of the predecessor node; calculate the time interval between each state transition moment and the moment when the business state attribute of the abnormal node undergoes an abnormal change; Based on the time interval and the edge weight of the semantic edge between the predecessor node and the anomalous node, the causal contribution of the predecessor node to the anomalous node is calculated; all causal contribution components of the predecessor node are summed to obtain the total causal contribution of the predecessor node to the anomalous node.

[0013] A second aspect of the present invention provides an intelligent interpretation system for power grid audit reports utilizing large models, comprising: The first unit is used to obtain audit problem description information detected in the power grid audit system, locate the target entity node corresponding to the business object involved in the audit problem description information from the pre-constructed power grid business knowledge graph, and expand the neighbor nodes with the target entity node as the center to form a local subgraph structure; The second unit is used to identify the set of abnormal nodes in the local subgraph structure whose business state attributes have changed abnormally, based on the abnormal feature patterns corresponding to the problem type attributes in the audit problem description information; for each abnormal node in the set of abnormal nodes, reverse dependency analysis is performed along the semantic edges in the power grid business knowledge graph to trace the predecessor node that caused the abnormal change in the business state attributes of the abnormal node. The third unit is used to extract the historical state sequence of the predecessor node in the time dimension. By analyzing the temporal correlation between the state transition time in the historical state sequence and the time when the business state attribute of the abnormal node changes abnormally, the causal contribution of the predecessor node to the abnormal node is iteratively calculated until the source node with a causal contribution lower than a preset termination threshold is traced back, and the source node is identified as the root cause node of the problem. The fourth unit is used to construct a complete tracing path from the root cause node of the problem to the target entity node, and output the tracing results based on the root cause node of the problem and the complete tracing path.

[0014] A third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0015] Fourth aspect of the present invention, A computer-readable storage medium is provided, having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0016] The beneficial effects of this application are as follows: By recognizing the local subgraph structure and abnormal feature patterns of knowledge graphs, combined with a causal contribution calculation method based on temporal correlation, the source node of the problem can be accurately traced from massive audit data, avoiding the subjectivity and uncertainty of traditional manual analysis.

[0017] By analyzing the temporal correlation between state transition moments and anomaly occurrence moments in historical state sequences, and iteratively calculating causal contribution, the accuracy and interpretability of root cause analysis are improved.

[0018] By organically combining power grid business knowledge graphs with audit issue description information, intelligent interpretation of complex business logic and audit issues is achieved, thereby improving the efficiency and quality of power grid audit work. Attached Figure Description

[0019] Figure 1This is a flowchart illustrating the intelligent interpretation method for power grid audit reports using a large model, as described in an embodiment of the present invention. Figure 2 A flowchart illustrating the process of determining the set of abnormal nodes. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0022] refer to Figure 1 and Figure 2 The present invention provides an intelligent interpretation method for power grid audit reports using a large-scale model, comprising: The system acquires audit problem description information detected in the power grid audit system, locates the target entity node corresponding to the business object involved in the audit problem description information from the pre-constructed power grid business knowledge graph, and expands the neighbor nodes with the target entity node as the center to form a local subgraph structure. Based on the abnormal feature patterns corresponding to the problem type attributes in the audit problem description information, an abnormal node set in the local subgraph structure is identified where the business state attributes of the nodes have undergone abnormal changes. For each abnormal node in the abnormal node set, reverse dependency analysis is performed along the semantic edges in the power grid business knowledge graph to trace the predecessor node that caused the abnormal change in the business state attributes of the abnormal node. The historical state sequence of the predecessor node in the time dimension is extracted. By analyzing the temporal correlation between the state transition time in the historical state sequence and the time when the business state attribute of the abnormal node changes abnormally, the causal contribution of the predecessor node to the abnormal node is iteratively calculated until the source node with a causal contribution lower than a preset termination threshold is traced back. The source node is then identified as the root cause node of the problem. Construct a complete tracing path from the root cause node of the problem to the target entity node, and output the tracing results based on the root cause node of the problem and the complete tracing path.

[0023] In one optional implementation, the target entity node corresponding to the business object involved in the audit problem description information is located from a pre-constructed power grid business knowledge graph, and a local subgraph structure is formed by expanding neighboring nodes around the target entity node, including: The business objects involved in the audit problem description information are converted into structured query expressions, which include entity type constraints, attribute value constraints, and relationship constraints of the business objects. In the power grid business knowledge graph, graph pattern matching based on the structured query expression is performed. By simultaneously satisfying the entity type constraint, the attribute value constraint, and the relationship constraint through multi-condition joint filtering, business entity nodes that meet the matching conditions are identified as the target entity nodes. Starting from the target entity node, a neighbor node expansion strategy is constructed based on the edge type and edge direction of the semantic edges in the power grid business knowledge graph. The neighbor node expansion strategy defines the traversal priority of different edge types and the inclusion conditions of different node types. Controlled expansion is performed according to the neighbor node expansion strategy, and the expanded neighbor nodes and their semantic edges and node attribute information with the target entity node together constitute the local subgraph structure.

[0024] In the process of power grid business auditing, to accurately analyze audit issues, it is necessary to extract local graph structures related to the audit issues from massive knowledge graphs. The business objects involved in the audit issue description are converted into structured query expressions. Specifically, natural language processing is performed on the audit issue description to extract key information, including the entity types, attribute values, and relationships between business objects. For example, for the audit issue "Find equipment in substation A whose main transformer capacity exceeds 50 MVA and has experienced a fault within the past three months," semantic analysis extracts the entity type constraint as "main transformer," the attribute value constraints as "substation A" and "capacity > 50 MVA," and the relationship constraint as "fault records exist and occurred within the past three months." Then, these constraints are organized into structured query expressions, such as those using a Cypher-like language. MATCH (t:Transformer)-[:BELONGS_TO]->(s:Substation {name:"A"}), (t)-[:HAS_FAULT]->(f:Fault) WHERE t.capacity>50 AND f.date>= currentDate()-90RETURN t.

[0025] Graph pattern matching based on structured query expressions is performed within the power grid business knowledge graph. Specifically, the process first filters the candidate node set based on entity type constraints, identifying all nodes of type "main transformer." Then, attribute value constraints are applied to these nodes to filter out those with a capacity greater than 50 MVA and belonging to substation A. Finally, relational constraints are checked to verify whether these nodes are connected to fault record nodes within the past three months. This multi-condition joint filtering method effectively reduces the search space and improves matching efficiency. The nodes in the matching results are the target entity nodes, representing the specific business objects involved in the audit issue.

[0026] Based on the identified target entity nodes, a neighbor node expansion strategy is constructed. This strategy considers the business importance of different types of semantic edges in the power grid business knowledge graph and assigns traversal priorities to edge types. For example, physical connections between devices may be more critical than management affiliations, thus receiving higher priority. Simultaneously, inclusion conditions for different node types are defined; for instance, all device nodes can be included, while maintenance record nodes may only include recent data. In practice, a priority queue can be used to store edges to be expanded, with the edges in the queue ordered based on predefined edge type priorities. Furthermore, an expansion depth limit, such as a maximum of 3 hops, needs to be set to control the subgraph size.

[0027] Controlled expansion follows a neighbor node expansion strategy. Starting with the target entity node, it is added to the resulting subgraph, and its connected edges are added to the expansion queue according to priority. Each time, the highest-priority edge is retrieved from the queue, and the node at the other end of the edge is checked to see if it meets the inclusion criteria. If so, the node and its connecting edge are added to the resulting subgraph, and its other connected edges are added to the expansion queue for the next round of expansion. This process is repeated until the preset expansion depth is reached or the queue is empty. During the expansion process, node attribute information and semantic relationships between nodes are collected, ultimately forming a local subgraph structure containing the target entity node and its associated context information.

[0028] In practical applications, if the audit issue involves "abnormal oil temperature of the main transformer in substation A", the above method can quickly locate the main transformer node in substation A and expand to obtain related nodes such as its temperature sensor data, historical maintenance records, and connected line information, forming a local knowledge subgraph around the main transformer, providing comprehensive and accurate data support for subsequent audit analysis.

[0029] The aforementioned technical means can efficiently extract local knowledge structures closely related to specific audit issues from the vast power grid business knowledge graph, providing accurate and comprehensive business context information for audit analysis and improving the efficiency and accuracy of power grid audit work.

[0030] In one optional implementation, controlled expansion is performed according to the neighbor node expansion strategy, including: During the expansion process, semantic relevance is evaluated for candidate neighbor nodes. This semantic relevance evaluation is achieved by calculating the vector distance between the semantic vector of the candidate neighbor node and the semantic vector of the problem type attribute in the audit problem description information. Only candidate neighbor nodes whose semantic relevance evaluation results exceed a preset relevance threshold are included in the local subgraph structure; For neighboring nodes included in the local subgraph structure, extract the multi-source attribute information of the neighboring node in the power grid business knowledge graph. The multi-source attribute information includes the business process attributes and operation permission attributes associated with the neighboring node, and label the multi-source attribute information as the extended attributes of the neighboring node in the local subgraph structure.

[0031] In power grid auditing systems, when extracting local subgraphs from complex power grid business knowledge graphs, a controlled neighbor node expansion strategy can effectively avoid noise problems caused by the introduction of irrelevant nodes.

[0032] After obtaining the initial node set, the neighbor node expansion phase begins. This phase starts by retrieving candidate neighbor nodes directly connected to the initial nodes from the power grid business knowledge graph. For each candidate neighbor node, instead of simply including them all in the local subgraph, a semantic relevance evaluation and filtering process is performed.

[0033] Semantic relevance assessment first extracts the problem type attribute from the audit problem description information, such as "electricity bill settlement audit" or "power equipment asset verification". Using a pre-trained text encoding model, the problem type attribute is converted into a semantic vector representation, denoted as the problem semantic vector. Similarly, the names and attribute information of candidate neighbor nodes are also text-encoded to generate node semantic vectors.

[0034] In practice, models such as BERT or Word2Vec can be used for text encoding. For example, when using the BERT model, the question type attribute text is input into the model, and the hidden state vector corresponding to the [CLS] label in the last layer is extracted as the question semantic vector. For candidate neighbor nodes, the node name and its core attributes can be concatenated to form text, which is then encoded using the BERT model to obtain the node semantic vector.

[0035] After completing the vector representation, the distance between the semantic vector of the candidate neighbor node and the semantic vector of the question is calculated. Cosine similarity can be used as the distance metric. For the node semantic vector V_node and the question semantic vector V_question, the cosine similarity is calculated as the dot product of the two vectors divided by the product of their respective norms. A higher similarity value indicates a stronger semantic relevance.

[0036] In system implementation, based on the characteristics of power grid operations, a relevance threshold is typically set to 0.6 or 0.7. For each candidate neighbor node, it is only included in the local subgraph structure if its semantic relevance assessment result exceeds this preset threshold. This process ensures that the local subgraph contains only nodes highly relevant to the audit issue.

[0037] Once a neighboring node is determined to meet the inclusion criteria, not only is the node itself added to the local subgraph, but its multi-source attribute information in the power grid business knowledge graph is also extracted as the node's extended attributes. This multi-source attribute information mainly includes two categories: business process attributes and operation permission attributes.

[0038] Business process attributes describe the position and role of nodes in the power grid business process, such as "the application stage of the electricity connection process" and "the meter data entry stage of the electricity billing process". These attributes are obtained by querying the association relationships between nodes and business process entities in the knowledge graph.

[0039] Operation permission attributes describe the operation permission information related to the node, such as "data modification permission" and "approval permission". This permission information is usually related to user roles and system access control, and is particularly important for auditing unauthorized operations. By querying the relationship between nodes and permission entities in the knowledge graph, complete permission attribute information can be extracted.

[0040] In practical applications, such as electricity bill anomaly auditing, the system expands from the "Electricity Bill Settlement" node. When encountering the "Electricity Customer" node, semantic relevance assessment reveals a high correlation (0.82 similarity) with the "Electricity Bill Settlement Audit" issue type, exceeding a preset threshold, thus including it in the subgraph. Subsequently, the system extracts the node's business process attribute "Electricity consumption confirmation step in the electricity bill calculation process" and operation permission attribute "Electricity data viewing permission," labeling these multi-source attribute information as node extended attributes.

[0041] For candidate nodes whose semantic relevance does not reach the threshold, such as the "substation equipment" node having a similarity of only 0.35 with the "electricity bill settlement audit" problem type, which is lower than the preset threshold, they will not be included in the local subgraph, thus avoiding the introduction of irrelevant nodes.

[0042] Through the controlled expansion strategy described above, the final constructed local subgraph not only has a simplified structure and avoids redundant information, but also has nodes with rich multi-source attribute information, providing comprehensive background data support for subsequent audit analysis.

[0043] In one optional implementation, based on the abnormal feature patterns corresponding to the problem type attributes in the audit problem description information, the set of abnormal nodes in the local subgraph structure whose business status attributes have changed abnormally includes: Based on the problem type attribute in the audit problem description information, the abnormal feature pattern corresponding to the problem type attribute is determined. The abnormal feature pattern defines the normal value range and abnormal change threshold of the business status attribute. Traverse each node in the local subgraph structure and obtain the current value of the business status attribute of each node; The current value of the business status attribute of each node is compared with the normal value range defined in the abnormal feature pattern to determine whether the current value of the business status attribute exceeds the normal value range; For nodes whose current business status attribute value exceeds the normal value range, obtain the value of the node's business status attribute at the previous moment, and calculate the change between the current value and the value at the previous moment; Determine whether the amount of change exceeds the abnormal change threshold defined in the abnormal feature pattern; Nodes whose current business status attribute value exceeds the normal value range and whose change exceeds the abnormal change threshold are identified as abnormal nodes, and all abnormal nodes are combined into the abnormal node set.

[0044] In the specific implementation process, the first step is to obtain the description information of the audit problem and the corresponding local subgraph structure data. Then, based on the abnormal feature patterns corresponding to the audit problem type attributes, the set of abnormal nodes in the local subgraph structure where the business status attributes of the nodes have changed abnormally is identified.

[0045] Obtain audit issue description information, including issue type attributes, involved parties, and occurrence time. The local subgraph structure is a relationship network constructed based on the business domains involved in the audit issue, where nodes represent business entities and edges represent business relationships between entities. Each node contains multiple attributes, among which the business status attribute is a key indicator reflecting the node's current business operation status.

[0046] Based on the problem type attribute in the audit problem description information, the corresponding abnormal feature pattern is determined. An abnormal feature pattern is a predefined set of rules for different problem types, defining the value range of business status attributes under normal circumstances and the threshold for abnormal changes. For example, for an audit problem of the "abnormal fund flow" type, its abnormal feature pattern might define the normal range of fund flow amount as 0 to 1 million yuan, and the abnormal change threshold as a change rate exceeding 80% between two consecutive records.

[0047] Traverse each node in the local subgraph structure and obtain the current value of its business status attribute for each node. For example, for a node representing a company, you might obtain its current cash balance, transaction frequency, tax payment, and other business status attribute values; for a node representing an individual, you might obtain its income level, consumption amount, and other attribute values.

[0048] The current value of each node's business status attribute is compared with the normal value range defined in the abnormal feature pattern to determine whether it exceeds the normal range. The determination method can be a simple threshold comparison, such as checking whether the node's cash flow amount exceeds a preset upper limit; or it can be a complex statistical analysis, such as calculating the quantile of the node's attribute value among all similar nodes to determine whether it is in an abnormal range.

[0049] For nodes whose current business status attribute values ​​exceed the normal range, further obtain the values ​​of their business status attributes at the previous moment. The previous moment can be a fixed time window, such as the previous day, week, or month; or it can be a time point determined according to business characteristics, such as the time of the last audit record. Calculate the change between the current value and the value at the previous moment. The change can be an absolute difference or a relative rate of change.

[0050] Determine whether the calculated change exceeds the abnormal change threshold defined in the abnormal feature pattern. The abnormal change threshold is set considering factors such as seasonal fluctuations in business and the industry average fluctuation range. For example, for audit issues of the "abnormal purchase price" type, a price change rate exceeding twice the industry average change rate might be set as abnormal.

[0051] Nodes meeting two conditions are identified as anomalous nodes: first, the current value of the business status attribute exceeds the normal range; second, the change exceeds the abnormal change threshold. All identified anomalous nodes are compiled into an anomalous node set, which will serve as the focus of subsequent audit analysis.

[0052] For enterprise nodes, the business status attribute includes "subsidy fund utilization rate". Anomaly pattern analysis determines that a normal subsidy fund utilization rate should be between 30% and 90%, and the threshold for abnormal changes is set at a change rate exceeding 50% between two consecutive records.

[0053] Traversing the enterprise nodes in the subgraph, we find that enterprise A's current subsidy fund utilization rate is 22%, which is lower than the normal range of 30%; enterprise B's current utilization rate is 65%, which is within the normal range; and enterprise C's current utilization rate is 93%, which is higher than the normal range of 90%.

[0054] Therefore, Company A and Company C were identified as anomalous nodes, forming an anomalous node set {Company A, Company C}, which will be the focus of the audit. Further analysis can be conducted on the flow and use of subsidy funds in these companies to determine the reasons for the abnormal use of subsidy funds.

[0055] By following the steps above, nodes in the local subgraph structure whose business status attributes have changed abnormally can be effectively identified, providing data support for resolving audit issues.

[0056] In one optional implementation, for each anomalous node in the set of anomalous nodes, reverse dependency analysis is performed along the semantic edges in the power grid business knowledge graph to trace the predecessor node that caused the anomalous change in the business state attribute of the anomalous node, including: A reverse dependency propagation graph is constructed, which takes the abnormal node as the propagation starting point and expands hierarchically in the reverse direction of the semantic edges in the power grid business knowledge graph, recording the dependency paths between each level node and the abnormal node; For each candidate predecessor node in the reverse dependency propagation graph, all dependency paths from the candidate predecessor node to the abnormal node are extracted, and the path credibility of each dependency path is calculated. The path credibility is comprehensively evaluated based on the completeness of the business rules of the semantic edges in the path and the state stability of the intermediate nodes in the path. For dependent paths whose path credibility exceeds a preset credibility threshold, the logical consistency between the business rule constraints carried by the semantic edges in the dependent path and the abnormal change patterns of the business state attributes of the abnormal nodes is analyzed. The starting node corresponding to the dependency path with logical consistency is determined as the predecessor node, and the predecessor node is marked with the propagation path identifier that affects the abnormal node.

[0057] In the process of power grid fault handling, for each anomalous node in the set of anomalous nodes, it is necessary to perform reverse dependency analysis along the semantic edges in the power grid business knowledge graph to trace the predecessor node that caused the anomalous node's business state attribute to change abnormally. The specific implementation of this method is as follows: Starting with an abnormal node, the propagation proceeds hierarchically in the reverse direction of the semantic edges in the power grid business knowledge graph. For example, when an abnormal temperature is detected in the main transformer of substation A, this main transformer node is set as the propagation starting point. Then, the propagation proceeds in the reverse direction of semantic edges such as "controlled by," "connected to," and "powered by," forming the first-level nodes, including control system nodes, connected line nodes, and upstream power supply equipment nodes. This process continues upstream to form the second-level nodes, and so on. During the propagation process, the dependency paths between each level node and the abnormal node are recorded; for example, "main transformer - controlled by - control system - controlled by - master station system" constitutes a dependency path.

[0058] For each candidate predecessor node in the reverse dependency propagation graph, extract all dependency paths from the candidate predecessor node to the abnormal node, and calculate the path credibility of each dependency path. The path credibility is comprehensively evaluated based on two key factors: the completeness of the business rules of the semantic edges in the path, and the state stability of the intermediate nodes in the path.

[0059] In assessing the completeness of business rules for semantic edges, each semantic edge is checked to ensure it has a clear and complete business rule definition. For example, the semantic edge "transformer-controlled by-control system" should have a complete control rule definition, such as control command type and response mechanism. If the business rule definition of a semantic edge is incomplete, its credibility score is reduced. Specifically, each semantic edge e_i is assigned a rule completeness score RC_i, with a value range of [0,1]. The closer RC_i is to 1, the more complete the rule definition.

[0060] In assessing the state stability of intermediate nodes, the state changes of each intermediate node in the path are analyzed within a recent time window. If the state of an intermediate node fluctuates frequently, it is considered an unstable node, reducing the reliability of the dependent path. For example, if a system node experiences multiple restarts or configuration changes within the past 24 hours, its state stability is low. Specifically, a state stability score NS_j is assigned to each intermediate node n_j, with a value ranging from [0,1]. The closer NS_j is to 1, the more stable the node.

[0061] The path credibility calculation (PC) comprehensively considers the rule completeness of all semantic edges on the path and the state stability of all intermediate nodes, taking the weighted average of the two. The higher the path credibility, the more likely the dependency path is to be the real propagation path causing the anomaly.

[0062] For dependency paths whose reliability exceeds a preset reliability threshold, the logical consistency between the business rule constraints carried by the semantic edges in the dependency path and the abnormal change patterns of the business state attributes of the abnormal nodes is analyzed. In practice, the business rule constraints corresponding to each semantic edge are extracted, and their impact on the state of downstream nodes is analyzed and compared with the abnormal change patterns actually observed by the abnormal nodes.

[0063] For example, if the transformer temperature rises abnormally, when analyzing the dependency path "cooling system-cooling-transformer", the business rule constraint corresponding to the semantic edge "cooling" is first extracted: abnormal operation of the cooling system will cause the transformer temperature to rise. Then, it is checked whether the pattern of abnormal transformer temperature rise is consistent with the temperature change characteristics that can be caused by a cooling system malfunction. If the temperature rise rate and time characteristics are consistent with the typical characteristics caused by a cooling system failure, then logical consistency is determined to exist.

[0064] Finally, the starting node corresponding to the dependency path with logical consistency is determined as the predecessor node, and the predecessor node is labeled with the propagation path identifier that influences the abnormal node. In specific implementation, for each node determined as a predecessor node, its influence path on the abnormal node is recorded to form an "influence path identifier", which includes all intermediate nodes and semantic edge information on the path. This propagation path identifier helps troubleshooters quickly locate the root cause of the problem and understand the fault propagation mechanism.

[0065] In practical applications, there may be multiple logically consistent dependency paths. In such cases, it is necessary to further analyze the importance or impact of each path. Priorities can be set for multiple predecessor nodes based on factors such as the business importance, scope of impact, and historical fault records of the predecessor nodes, to assist operations and maintenance personnel in determining the order of priority handling.

[0066] The aforementioned reverse dependency analysis method, by combining semantic information from the power grid business knowledge graph with equipment status data, can effectively trace the propagation path and root cause nodes of power grid faults, providing precise guidance for power grid fault diagnosis and handling. This method is particularly suitable for cascading fault analysis in complex power grid systems, accurately identifying key precursor nodes among a large number of abnormal nodes and improving fault handling efficiency.

[0067] In one optional implementation, by analyzing the temporal correlation between the state transition times in the historical state sequence and the times when the business state attributes of the anomalous node undergo abnormal changes, the causal contribution of the predecessor node to the anomalous node is iteratively calculated, including: The historical state sequence of the predecessor node is segmented into multiple stable state intervals and multiple state transition intervals. The state transition intervals correspond to the time periods in which the service state attributes of the predecessor node change. Extract the start time of the state transition interval as a candidate causal trigger time, and calculate the time difference between each candidate causal trigger time and the time when the business state attribute of the abnormal node undergoes an abnormal change; Based on the time difference and the business process transmission delay between the predecessor node and the abnormal node, determine whether each candidate causal trigger moment is within a reasonable causal time window; For candidate causal trigger moments located within a reasonable causal time window, extract all state transition moments where the business state attribute of the predecessor node undergoes a state transition from the historical state sequence of the predecessor node; calculate the time interval between each state transition moment and the moment when the business state attribute of the abnormal node undergoes an abnormal change; Based on the time interval and the edge weight of the semantic edge between the predecessor node and the anomalous node, the causal contribution of the predecessor node to the anomalous node is calculated; all causal contribution components of the predecessor node are summed to obtain the total causal contribution of the predecessor node to the anomalous node.

[0068] In the root cause analysis of service anomalies, it is necessary to analyze the temporal correlation between the state transition times in the historical state sequence and the times when the business state attributes of the anomaly node change abnormally, in order to iteratively calculate the causal contribution of the predecessor node to the anomaly node.

[0069] The historical state sequences of predecessor nodes are segmented temporally. By analyzing the characteristics of changes in business state attributes within the state sequences, the historical state sequences are divided into multiple stable state intervals and multiple state transition intervals. Stable state intervals represent time periods where business state attributes remain unchanged, while state transition intervals correspond to time periods where the business state attributes of predecessor nodes change. For example, when the response time of the payment service is monitored to suddenly increase from the normal value to an abnormal value exceeding the threshold, the time period in which this change occurs constitutes a state transition interval.

[0070] The starting time is extracted from the predefined state transition intervals as candidate causal trigger times. If the predecessor node begins a state transition at a certain time point T1, this T1 is extracted as a candidate causal trigger time. Then, the time difference between each candidate causal trigger time and the time when the abnormal node's business state attribute undergoes an abnormal change is calculated. Assuming the abnormal node undergoes an abnormal change at time T2, the time difference is |T2-T1|.

[0071] Based on the calculated time difference and the business process propagation delay between the predecessor node and the abnormal node, it is determined whether each candidate causal trigger moment falls within a reasonable causal time window. The business process propagation delay can be obtained from historical data statistics, such as the average delay time from the change in order service status to the change in payment service status in a microservice architecture. If the time difference is within a reasonable range of the business process propagation delay (usually a confidence interval of the propagation delay), then the candidate causal trigger moment is considered to be within a reasonable causal time window.

[0072] For candidate causal trigger moments within a reasonable causal time window, all state transition moments where the business state attribute of the predecessor node undergoes a state transition are further extracted from the historical state sequence of the predecessor node. For example, if the predecessor node is a database service, the response may slow down starting at time T1, and the number of connections may suddenly increase at T1+10s; both of these are state transition moments. Then, the time interval between each state transition moment and the moment when the business state attribute of the abnormal node undergoes an abnormal change is calculated.

[0073] Based on the calculated time interval and the edge weights of the semantic edges between the predecessor and the anomalous node, the causal contribution of the predecessor node to the anomalous node is calculated. A shorter time interval indicates a stronger temporal correlation between the state transition and the anomalous change, resulting in a higher causal contribution. The edge weights of the semantic edges represent the strength of the business association between the two nodes, which can be determined from aspects such as system call relationships and data flow. For each state transition moment, the causal contribution component can be calculated as follows: normalize the time interval to obtain a correlation value between 0 and 1, then multiply it by the edge weight of the semantic edge to obtain the causal contribution component for a single state transition moment.

[0074] The total causal contribution of the predecessor node to the anomalous node is obtained by summing all causal contribution components of the predecessor node. The summation process can take into account the importance weights of different state transitions. For example, severe state transitions such as service response timeouts can be assigned higher weights.

[0075] In practical applications, a threshold can be set; when the total causal contribution exceeds this threshold, the predecessor node is identified as a potential root cause of the anomaly. For complex service dependencies, the above analysis process can be recursively applied to the predecessor nodes of the predecessor nodes to construct a complete causal chain.

[0076] This method of calculating causal contribution based on time-series correlation can effectively identify the root causes of service anomalies, providing precise guidance for rapid fault recovery and system optimization. In large-scale microservice architectures, this method can significantly shorten fault diagnosis time, reduce false alarm rates, and improve operational efficiency.

[0077] This invention provides an intelligent interpretation system for power grid audit reports based on a large-scale model, comprising: The first unit is used to obtain audit problem description information detected in the power grid audit system, locate the target entity node corresponding to the business object involved in the audit problem description information from the pre-constructed power grid business knowledge graph, and expand the neighbor nodes with the target entity node as the center to form a local subgraph structure; The second unit is used to identify the set of abnormal nodes in the local subgraph structure whose business state attributes have changed abnormally, based on the abnormal feature patterns corresponding to the problem type attributes in the audit problem description information; for each abnormal node in the set of abnormal nodes, reverse dependency analysis is performed along the semantic edges in the power grid business knowledge graph to trace the predecessor node that caused the abnormal change in the business state attributes of the abnormal node. The third unit is used to extract the historical state sequence of the predecessor node in the time dimension. By analyzing the temporal correlation between the state transition time in the historical state sequence and the time when the business state attribute of the abnormal node changes abnormally, the causal contribution of the predecessor node to the abnormal node is iteratively calculated until the source node with a causal contribution lower than a preset termination threshold is traced back, and the source node is identified as the root cause node of the problem. The fourth unit is used to construct a complete tracing path from the root cause node of the problem to the target entity node, and output the tracing results based on the root cause node of the problem and the complete tracing path.

[0078] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0079] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0080] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for intelligent interpretation of power grid audit reports using a large-scale model, characterized in that: include: The system acquires audit problem description information detected in the power grid audit system, locates the target entity node corresponding to the business object involved in the audit problem description information from the pre-constructed power grid business knowledge graph, and expands the neighbor nodes with the target entity node as the center to form a local subgraph structure. Based on the abnormal feature patterns corresponding to the problem type attributes in the audit problem description information, an abnormal node set in the local subgraph structure is identified where the business state attributes of the nodes have undergone abnormal changes. For each abnormal node in the abnormal node set, reverse dependency analysis is performed along the semantic edges in the power grid business knowledge graph to trace the predecessor node that caused the abnormal change in the business state attributes of the abnormal node. The historical state sequence of the predecessor node in the time dimension is extracted. By analyzing the temporal correlation between the state transition time in the historical state sequence and the time when the business state attribute of the abnormal node changes abnormally, the causal contribution of the predecessor node to the abnormal node is iteratively calculated until the source node with a causal contribution lower than a preset termination threshold is traced back. The source node is then identified as the root cause node of the problem. Construct a complete tracing path from the root cause node of the problem to the target entity node, and output the tracing results based on the root cause node of the problem and the complete tracing path.

2. The method according to claim 1, characterized in that, From the pre-constructed power grid business knowledge graph, locate the target entity node corresponding to the business object involved in the audit problem description information, and expand the neighbor nodes around the target entity node to form a local subgraph structure, including: The business objects involved in the audit problem description information are converted into structured query expressions, which include entity type constraints, attribute value constraints, and relationship constraints of the business objects. In the power grid business knowledge graph, graph pattern matching based on the structured query expression is performed. By simultaneously satisfying the entity type constraint, the attribute value constraint, and the relationship constraint through multi-condition joint filtering, business entity nodes that meet the matching conditions are identified as the target entity nodes. Starting from the target entity node, a neighbor node expansion strategy is constructed based on the edge type and edge direction of the semantic edges in the power grid business knowledge graph. The neighbor node expansion strategy defines the traversal priority of different edge types and the inclusion conditions of different node types. Controlled expansion is performed according to the neighbor node expansion strategy, and the expanded neighbor nodes and their semantic edges and node attribute information with the target entity node together constitute the local subgraph structure.

3. The method according to claim 2, characterized in that, Controlled expansion according to the neighbor node expansion strategy includes: During the expansion process, semantic relevance is evaluated for candidate neighbor nodes. This semantic relevance evaluation is achieved by calculating the vector distance between the semantic vector of the candidate neighbor node and the semantic vector of the problem type attribute in the audit problem description information. Only candidate neighbor nodes whose semantic relevance evaluation results exceed a preset relevance threshold are included in the local subgraph structure; For neighboring nodes included in the local subgraph structure, extract the multi-source attribute information of the neighboring node in the power grid business knowledge graph. The multi-source attribute information includes the business process attributes and operation permission attributes associated with the neighboring node, and label the multi-source attribute information as the extended attributes of the neighboring node in the local subgraph structure.

4. The method according to claim 1, characterized in that, Based on the abnormal feature patterns corresponding to the problem type attributes in the audit problem description information, the set of abnormal nodes in the local subgraph structure whose business status attributes have undergone abnormal changes includes: Based on the problem type attribute in the audit problem description information, the abnormal feature pattern corresponding to the problem type attribute is determined. The abnormal feature pattern defines the normal value range and abnormal change threshold of the business status attribute. Traverse each node in the local subgraph structure and obtain the current value of the business status attribute of each node; The current value of the business status attribute of each node is compared with the normal value range defined in the abnormal feature pattern to determine whether the current value of the business status attribute exceeds the normal value range; For nodes whose current business status attribute value exceeds the normal value range, obtain the value of the node's business status attribute at the previous moment, and calculate the change between the current value and the value at the previous moment; Determine whether the amount of change exceeds the abnormal change threshold defined in the abnormal feature pattern; Nodes whose current business status attribute value exceeds the normal value range and whose change exceeds the abnormal change threshold are identified as abnormal nodes, and all abnormal nodes are combined into the abnormal node set.

5. The method according to claim 1, characterized in that, For each anomalous node in the set of anomalous nodes, reverse dependency analysis is performed along the semantic edges in the power grid business knowledge graph to trace the predecessor nodes that caused the anomalous changes in the business state attributes of the anomalous nodes, including: A reverse dependency propagation graph is constructed, which takes the abnormal node as the propagation starting point and expands hierarchically in the reverse direction of the semantic edges in the power grid business knowledge graph, recording the dependency paths between each level node and the abnormal node; For each candidate predecessor node in the reverse dependency propagation graph, all dependency paths from the candidate predecessor node to the abnormal node are extracted, and the path credibility of each dependency path is calculated. The path credibility is comprehensively evaluated based on the completeness of the business rules of the semantic edges in the path and the state stability of the intermediate nodes in the path. For dependent paths whose path credibility exceeds a preset credibility threshold, the logical consistency between the business rule constraints carried by the semantic edges in the dependent path and the abnormal change patterns of the business state attributes of the abnormal nodes is analyzed. The starting node corresponding to the dependency path with logical consistency is determined as the predecessor node, and the predecessor node is marked with the propagation path identifier that affects the abnormal node.

6. The method according to claim 1, characterized in that, By analyzing the temporal correlation between the state transition times in the historical state sequence and the times when the business state attributes of the anomalous node undergo abnormal changes, the causal contribution of the predecessor node to the anomalous node is iteratively calculated, including: The historical state sequence of the predecessor node is segmented into multiple stable state intervals and multiple state transition intervals. The state transition intervals correspond to the time periods in which the service state attributes of the predecessor node change. Extract the start time of the state transition interval as a candidate causal trigger time, and calculate the time difference between each candidate causal trigger time and the time when the business state attribute of the abnormal node undergoes an abnormal change; Based on the time difference and the business process transmission delay between the predecessor node and the abnormal node, determine whether each candidate causal trigger moment is within a reasonable causal time window; For candidate causal trigger moments located within a reasonable causal time window, extract all state transition moments where the business state attribute of the predecessor node undergoes a state transition from the historical state sequence of the predecessor node; calculate the time interval between each state transition moment and the moment when the business state attribute of the abnormal node undergoes an abnormal change; Based on the time interval and the edge weight of the semantic edge between the predecessor node and the anomalous node, the causal contribution of the predecessor node to the anomalous node is calculated; all causal contribution components of the predecessor node are summed to obtain the total causal contribution of the predecessor node to the anomalous node.

7. A power grid audit report intelligent interpretation system utilizing a large-scale model, used to implement the method as described in any one of claims 1-6, characterized in that, include: The first unit is used to obtain audit problem description information detected in the power grid audit system, locate the target entity node corresponding to the business object involved in the audit problem description information from the pre-constructed power grid business knowledge graph, and expand the neighbor nodes with the target entity node as the center to form a local subgraph structure; The second unit is used to identify the set of abnormal nodes in the local subgraph structure whose business state attributes have changed abnormally, based on the abnormal feature patterns corresponding to the problem type attributes in the audit problem description information; for each abnormal node in the set of abnormal nodes, reverse dependency analysis is performed along the semantic edges in the power grid business knowledge graph to trace the predecessor node that caused the abnormal change in the business state attributes of the abnormal node. The third unit is used to extract the historical state sequence of the predecessor node in the time dimension. By analyzing the temporal correlation between the state transition time in the historical state sequence and the time when the business state attribute of the abnormal node changes abnormally, the causal contribution of the predecessor node to the abnormal node is iteratively calculated until the source node with a causal contribution lower than a preset termination threshold is traced back, and the source node is identified as the root cause node of the problem. The fourth unit is used to construct a complete tracing path from the root cause node of the problem to the target entity node, and output the tracing results based on the root cause node of the problem and the complete tracing path.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images