Emergency event intelligent association analysis system and method based on knowledge graph

Abstract

The invention provides an emergency event intelligent association analysis method and system based on a knowledge graph. The emergency event intelligent association analysis method comprises the steps that S1, multi-source heterogeneous data are collected and preprocessed to obtain standardized data; s2, converting the standardized data into structured semantic information; s3, constructing a knowledge graph; s4, storing the knowledge graph; s5, calculating semantic cosine similarity between events according to the knowledge graph, and performing intelligent association reasoning; s6, performing data analysis and risk prediction according to the final reasoning result of the event to obtain a risk prediction result; and S7, finally performing interface display on a risk prediction result. According to the method, the graph neural network is responsible for encoding the graph structure and the local semantic context, the large language model is responsible for complementing the text semantics, and high-credibility event semantic embedding is obtained after the graph structure and the local semantic context are fused, so that the accuracy and the integrity of a reasoning result are improved.

Description

Technical Field

[0001] This invention relates to the field of intelligent correlation analysis of emergency events, and in particular to an intelligent correlation analysis system and method for emergency events based on knowledge graphs. Background Technology

[0002] As urban operations, enterprise maintenance, and social governance systems become increasingly complex, emergency events are exhibiting characteristics of multi-source, interconnectedness, and suddenness. Traditional emergency management systems have significant limitations in event identification, correlation analysis, and decision support, relying primarily on manual judgment or shallow rule-based algorithms, making it difficult to integrate multi-dimensional information and achieve semantic understanding.

[0003] Regarding the difficulty of traditional methods in handling multi-source heterogeneous data during data collection and preprocessing, existing technologies primarily focus on three types of data for format standardization: structured data (such as tabular data), semi-structured data (such as XML and JSON), and unstructured data (such as text, audio, and images). They lack incremental data update capabilities and cannot support dynamic evolutionary reasoning of events, thus limiting the scope of the reasoning results. Furthermore, current emergency event analysis systems also suffer from weak capabilities in identifying event correlations and insufficient intelligent reasoning abilities. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings and deficiencies of the prior art and provide an intelligent correlation analysis method for emergency events based on knowledge graphs.

[0005] Another objective of this invention is to provide an intelligent correlation analysis system for emergency events based on knowledge graphs.

[0006] The objective of this invention is achieved through the following technical solution: an intelligent correlation analysis method for emergency events based on knowledge graphs, comprising the following steps:

[0007] S1. Collect multi-source heterogeneous data and perform format standardization and field consistency conversion on the multi-source heterogeneous data through ETL to obtain standardized data;

[0008] S2. Transform standardized data into structured semantic information to generate an event semantic tree;

[0009] S3. Generate nodes and relationships based on the structured semantic information in the event semantic tree, thereby constructing a knowledge graph G=(V,E), where V is the set of event nodes and entity nodes, and E is the set of edges;

[0010] S4. Use a graph database to store the knowledge graph;

[0011] S5. Based on the event information in the knowledge graph, and combined with graph neural networks and large language models, calculate the semantic cosine similarity between events and perform intelligent association reasoning to obtain the final reasoning result for the events.

[0012] S6. Based on the final reasoning results of the event, conduct data analysis and risk prediction to obtain the risk prediction results;

[0013] S7. Finally, the knowledge graph and risk prediction results are displayed on the interface for decision-makers to use.

[0014] Furthermore, S5 includes the following steps:

[0015] S51. Use a pre-trained language model to obtain the text vector h_text_v for the original text description t_v of each event node in the knowledge graph. For long texts in the original text description t_v, a sliding window or summarization strategy can be used to first extract and complete the semantics through a large language model, and then feed them into the pre-trained language model.

[0016] S52. For each event node in the knowledge graph, the structured attribute a_v is mapped to a structured attribute vector h_attr_v through MLP;

[0017] S53. Concatenate or weightedly fuse the text vector h_text_v and the structured attribute vector h_attr_v to obtain the initial node. ;

[0018] S54. Graph structure based on graph neural network for initial nodes conduct Layer aggregation calculation: Aggregating distances to target nodes using graph neural networks. No more than By analyzing the information of the neighboring nodes, we obtain the final node embedding vector. :

[0019]

[0020] in, Represents the initial node feature vector. Represents the target node of The set of skip neighbor nodes;

[0021] S55, Calculate query event nodes and target node Semantic cosine similarity between :

[0022]

[0023] in, Indicates querying event nodes The embedding vector; Represents the target node The final node embedding vector; Indicates querying event nodes Transpose of Embedded Vector and Target Node The dot product of the final node embedding vectors; Indicates querying event nodes The magnitude of the vector; Represents the target node The magnitude of the final node embedding vector;

[0024] S56. By using graph path search and large language model, causal reasoning is performed on candidate event nodes whose semantic cosine similarity exceeds a preset threshold, and the causal relationship is completed to obtain the reasoning result. At the same time, the association confidence is output. Events with higher association confidence are considered to be more likely to occur.

[0025] S57. Perform consistency checks and model fusion on the inference results to obtain the final inference result.

[0026] Furthermore, in S57, the specific steps for generating the final inference result include:

[0027] S571, Rule-driven consistency detection: Detecting the inference results of graph neural networks and large language models based on predefined rules;

[0028] S572, Model Fusion, including:

[0029] S5721. Result Comparison: Compare the inference results obtained by the graph neural network and the large language model to check whether they are consistent in the type and direction of event relationships;

[0030] S5722. Fusion Strategy: If the inference results of the graph neural network and the large language model are consistent, they can be directly used as the final inference result; if the results are inconsistent, one of the following strategies can be adopted:

[0031] Priority: The inference results of models with higher priority levels are given priority; the priority is determined by the impact of the event on the business and the urgency of resolving the event; where impact describes the degree of failure and urgency describes the importance of the event object;

[0032] Weighted fusion: The inference results of graph neural networks and large language models are weighted and fused to combine the advantages of both.

[0033] S5723, Multi-model validation: Further verify the consistency of inference results using other auxiliary models;

[0034] S573. Output Association Confidence: After consistency testing and model fusion, output the final inference result and calculate the confidence score for the relationship between each event.

[0035] Furthermore, in S5, for historical events, after obtaining the initial node... Next, offline batch pre-training of graph neural networks is performed, including:

[0036] Contrastive learning is used to bring semantically similar events closer together and dissimilar events further apart in historical events; this involves a contrastive learning loss function. Calculation:

[0037] ;

[0038] in, Event semantic vector and its positive samples Similarity between them, event semantic vectors Indicates the first The event semantic vector representation obtained after processing by feature encoding, graph neural network, or encoder model for each event node is used to characterize the comprehensive semantic features of the event; positive samples Representation and event Semantic vectors of positive sample events that are semantically or causally related. For temperature parameters, The normalization term for negative samples is used to calculate the semantic vector of all samples and events. similarity, Representation and event Semantic vectors of negative sample events that have no direct correlation or significant semantic differences;

[0039] Downstream fine-tuning: After pre-training a graph neural network using self-supervised comparative learning of historical events, it is then fine-tuned using labeled data from downstream tasks.

[0040] Furthermore, the collection of negative samples adopts a hybrid sampling strategy of random negative sampling and hard negative sampling. Hard negative sampling can sample from events that are semantically close but not causally related, thereby improving the model's discriminative ability.

[0041] Furthermore, during the construction of the knowledge graph, new event streams are monitored. If the semantic cosine similarity with existing nodes is greater than a set threshold, node fusion is performed. If a new relationship chain not existing in the knowledge graph is found, a new edge is automatically inserted and the topology is updated.

[0042] Furthermore, the ETL described in S1 includes the following steps:

[0043] S11. Extract heterogeneous data from multiple sources in a unified manner. The data includes real-time data, historical data, and external data. During the data extraction process, data is accessed through different data protocols with external platforms to ensure that no data source is missed.

[0044] S12. Standardized Data: Convert the extracted multi-source heterogeneous data format into a unified standard format to eliminate format differences between different data sources and achieve format standardization; and perform field mapping for differences in content and units of data from different sources, standardize field names and unify time formats and numerical units.

[0045] S13. Filter out duplicate, abnormal, or invalid data in the standardized data to ensure data quality;

[0046] S14. Load the filtered, standardized data into the target database or data warehouse to form a data pool.

[0047] Furthermore, S2 includes the following steps:

[0048] S21. Use a natural language processing model to perform named entity recognition on standardized data and extract key event elements;

[0049] S22. By performing dependency parsing on standardized data using a large language model, the contextual relationships are analyzed, causal relationships and implicit event logic are automatically completed, and the semantic relationships of words in the sentence are obtained.

[0050] S23. The analysis results of each large language model are scored. When the confidence level is lower than the threshold, it is automatically entered into the manual review queue to ensure semantic consistency and reliability.

[0051] S24. Generate an event semantic tree by using key event elements as nodes and semantic relationships between words in sentences as edges.

[0052] Further step S6 includes the following steps:

[0053] S61. Perform event topology analysis on the final reasoning results, construct an event relationship network, and conduct in-depth analysis based on this to extract potential connections and causal relationships between events, and obtain the final event topology analysis conclusions.

[0054] S62. Perform time window analysis: Set a specific time range for the time window, and within the time window, identify the trigger sequence of events by analyzing the order of occurrence and time intervals between events.

[0055] S63. Based on the trigger sequence within a time window, evaluate the probability of the event triggering order occurring with other events within a specific time window;

[0056] S64. Combining the event topology with the trigger sequence within the time window, the following predictions are made:

[0057] (1) Identification of risk event nodes: Based on the historical event sequence and the topological analysis conclusion of the final event, predict potential risk event nodes and realize the identification of risk event nodes;

[0058] (2) Risk level assessment: Based on the time series information and the final event topology analysis conclusion, the risk level of each event is assessed, and the risk level is divided into low, medium and high.

[0059] (3) Propagation path and scope of impact: Based on the topological analysis conclusions of the final event and the time series model, calculate the propagation path and scope of impact of future events.

[0060] Another objective of this invention is achieved through the following technical solution: an intelligent correlation analysis system for emergency events based on knowledge graphs, comprising:

[0061] Data acquisition module: used to collect multi-source heterogeneous data and perform format standardization and field consistency conversion on the multi-source heterogeneous data through ETL to obtain standardized data;

[0062] Semantic parsing module: used to transform standardized data into structured semantic information and generate an event semantic tree;

[0063] Knowledge Graph Module: Used to generate nodes and relationships based on structured semantic information in the event semantic tree, thereby constructing a knowledge graph G=(V,E);

[0064] Reasoning and computation module: used to calculate the semantic cosine similarity between events based on event information in the knowledge graph and perform intelligent association reasoning to obtain the final reasoning result for the event;

[0065] Data Analysis Module: Used to perform data analysis and risk prediction based on the final reasoning results of the event, and obtain risk prediction results;

[0066] Visualization and Decision Module: Used to display event information, knowledge graphs, risk prediction results, and provide decision-making suggestions.

[0067] In summary, the present invention has the following beneficial effects:

[0068] (1) This invention combines standardized processing with real-time emergency data and intelligent reasoning through ETL technology, which solves problems such as data quality, real-time performance and intelligent analysis in the fusion of multi-source heterogeneous data, enabling the system to not only break down emergency data silos, but also to have stronger reasoning and emergency decision support capabilities.

[0069] (2) This invention combines graph neural networks with a large language model, where the graph neural network is responsible for encoding graph structure and local semantic context, and the large language model is responsible for completing the semantics of the text and injecting background knowledge; after the two are combined, a highly reliable event semantic embedding is obtained, which is used for semantic cosine similarity calculation and reasoning, thereby improving the accuracy and completeness of the reasoning results.

[0070] (3) The present invention performs further calculation and analysis on the final reasoning results through the data analysis module, which can predict potential secondary events and enable decision-makers to make more comprehensive decisions in response to emergency events.

[0071] (4) In the process of constructing the knowledge graph of the present invention, the newly added event stream is monitored. If the semantic cosine similarity with the existing node is detected to be greater than the set threshold, node fusion is performed. If a new relationship chain that does not exist in the knowledge graph is found, a new edge is automatically inserted and the topology is updated to realize incremental data update.

[0072] (5) The emergency event intelligent correlation analysis system of the present invention is also equipped with a visualization and decision-making module. Information such as event list, filtering conditions, emergency knowledge graph, event details, risk prediction results and disposal suggestions will be displayed in the visualization and decision-making module, so that decision-makers can understand the situation of emergency events more intuitively. Attached Figure Description

[0073] Figure 1 This is a logical block diagram of an emergency event intelligent correlation analysis method based on knowledge graphs according to the present invention.

[0074] Figure 2 This is a flowchart illustrating step S5 in the knowledge graph-based intelligent correlation analysis method for emergency events of the present invention.

[0075] Figure 3 This is a schematic block diagram of the structure of an emergency event intelligent correlation analysis system based on knowledge graphs according to the present invention;

[0076] Figure 4 This is a schematic diagram of the display interface layout of the visualization and decision-making module of the present invention. Detailed Implementation

[0077] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0078] like Figures 1 to 4 As shown, an intelligent correlation analysis method for emergency events based on knowledge graphs includes the following steps:

[0079] S1. Collect multi-source heterogeneous data, and perform format standardization and field consistency conversion on the multi-source heterogeneous data through ETL to obtain standardized data;

[0080] S2. Transform standardized data into structured semantic information to generate an event semantic tree;

[0081] S3. Generate nodes and relationships based on the structured semantic information in the event semantic tree to construct a knowledge graph G=(V,E), where V is the set of event nodes and entity nodes, and E is the set of edges. Based on the frequency, semantic cosine similarity, and timeliness of events in the structured semantic information, periodically calculate node weights and update nodes according to these weights to ensure the knowledge graph reflects the latest impact and relevance of events. This process helps improve the accuracy and efficiency of event reasoning and knowledge mining. The nodes include event nodes (Event), entity nodes (Entity), cause nodes (Cause), and action nodes (Action); the relationship types include CAUSES, AFFECTS, SIMILAR_TO, DEPENDS_ON, and BELONGS_TO. An example of the relationship structure is shown below:

[0082] (Network interruption) - [CAUSES] → (Transaction failed) - [AFFECTS] → (Customer complaint).

[0083] In addition, new event streams are monitored. If a semantic cosine similarity with an existing node is detected to be greater than a threshold (the threshold is set to 0.85), node fusion is performed. If a new relationship chain not existing in the knowledge graph is found, a new edge is automatically inserted and the topology is updated.

[0084] S4. Use the Neo4j graph database to store the knowledge graph;

[0085] S5. Based on the event information in the knowledge graph and combined with graph neural networks and large language models, calculate the semantic cosine similarity between events and perform intelligent association reasoning to obtain the final reasoning result for the events.

[0086] S6. Based on the final reasoning results of the event, conduct data analysis and risk prediction to obtain the risk prediction results;

[0087] S7. Finally, the knowledge graph and risk prediction results are displayed on the interface for decision-makers to use.

[0088] In emergency event analysis systems, data sources are numerous and their formats are inconsistent. Common data sources include monitoring systems, log systems, sensor data, public opinion data, and alarm systems. These data not only vary in format, but also differ significantly in data structure, unit standards, and timestamp formats, making rapid and accurate integration and analysis during event response difficult. The phenomenon of data silos is particularly severe; different systems, platforms, and devices often cannot effectively share data, leading to delayed emergency responses or decision-making errors. ETL, as a commonly used data integration technology, can effectively overcome the challenges of multi-source heterogeneous data, extracting, transforming, and uniformly loading data from various systems into a target database or data warehouse, providing a standardized data foundation for subsequent analysis. The ETL described in S1 of this invention specifically includes the following steps:

[0089] S11. Unified extraction of multi-source heterogeneous data, including real-time data, historical data, and external data, where external information includes public opinion data, social media event information, etc. During the data extraction process, data access is performed with external platforms through different data protocols (such as API, Syslog, file upload, message queue) to ensure that no data source is missed. For high-priority events (such as system interruption, UPS alarm), a priority queue weighted scheduling mechanism is adopted.

[0090] Emergency event data is often highly concurrent. Using Kafka as an event stream middleware can efficiently collect real-time event data from various systems, ensuring data timeliness and enabling high-concurrency processing.

[0091] S12. Standardized Data: The data transformation process in ETL eliminates format differences between different data sources and achieves format standardization by converting extracted multi-source heterogeneous data formats (JSON, XML, CSV, database tables, etc.) into a unified standard format (such as JSON Schema); and performs field mapping for differences in content and units of data from different sources, standardizing field names, such as uniformly converting the "time" field to "timestamp", and standardizing time formats and numerical units, such as uniformly converting all temperature data to degrees Celsius.

[0092] S13. Filter out duplicate, abnormal, or invalid data in the standardized data to ensure data quality;

[0093] S14. The filtered, standardized data is loaded into the target database or data warehouse to form a data pool. To facilitate subsequent knowledge graph construction and intelligent reasoning analysis, the data will be loaded into a hybrid architecture that supports graph databases (such as Neo4j) and relational databases (such as PostgreSQL).

[0094] In addition, ETL also supports data index optimization, ensuring that subsequent queries and analyses can be completed in a short time. For example, indexes can be created using fields such as timestamps and event types to improve query efficiency.

[0095] Standardized data processed by ETL all follow a unified standard format (JSON Schema), as shown in the following example:

[0096] {

[0097] "eventId":"EVT20251104-0001",

[0098] "timestamp":"2025-11-04 09:30:00",

[0099] "type": "network_error",

[0100] "source": "server01",

[0101] "severity": "high",

[0102] "location": "Beijing IDC",

[0103] "description": "Database connection failed, transaction interface interrupted"

[0104] }

[0105] The event semantic tree generation process described in S2 includes the following steps:

[0106] S21. Perform Named Entity Recognition (NER) on standardized data using natural language processing models BERT or ERNIE to extract key event elements, including time, location, organization, equipment, behavior, and outcome.

[0107] S22. Dependency parsing is performed on standardized data using a large language model to analyze contextual relationships, automatically complete causal relationships and implicit event logic, and obtain semantic relationships between words in the sentence, thereby further obtaining analysis results; the large language model can be ChatGLM or LLaMA. An example is as follows:

[0108] Enter text: "Transaction delays led to customer complaints."

[0109] Output structured semantics:

[0110] Event type: Service exception

[0111] Reason: Transaction delay

[0112] Result: Customer complaints

[0113] S23. The analysis results of each large language model are scored. When the score is lower than the threshold, it is automatically entered into the manual review queue to ensure semantic consistency and reliability.

[0114] S24. Generate an event semantic tree by using key event elements as nodes and semantic relationships as edges.

[0115] By using graph neural networks and large language models, the semantic cosine similarity between events is calculated, and intelligent association reasoning is performed. Specifically, the following steps are included:

[0116] S51. For each event node in the knowledge graph, the original text description t_v is processed using a pre-trained language model to obtain the text vector h_text_v. For long texts in the original text description t_v, a sliding window or summarization strategy can be used to first extract and complete semantics through a large language model, and then feed them into the pre-trained language model to obtain the text vector h_text_v. The original text description t_v is provided from the collected multi-source heterogeneous data. The pre-trained language model can be BERT, ERNIE, or a lightweight Transformer model.

[0117] S52. For each event node in the knowledge graph, the structured attribute a_v is mapped to a structured attribute vector h_attr_v through MLP; the structured attribute a_v is obtained from the event semantic tree;

[0118] S53. Concatenate or weightedly fuse the text vector h_text_v and the structured attribute vector h_attr_v to obtain the initial node. The expression is:

[0119] Simple assembly: ;

[0120] Weighted fusion: ;in, and The learned weighted matrix is ​​denoted as . Used to adjust the weights of the text vector h_text_v in the final fusion result. Used to adjust the weights of the structured attribute vector h_attr_v in the final fusion result.

[0121] S54. Graph structure based on graph neural network for initial nodes conduct Layer aggregation computation: Aggregating the distances to target nodes in the graph structure using graph neural networks. No more than By analyzing the information of the neighboring nodes, we obtain the final node embedding vector. :

[0122] ;

[0123] in, Represents the initial node feature vector. Represents the target node of Jump neighbor set, target node This represents the target event node, i.e., the event node that currently requires feature aggregation and inference.

[0124] If GraphSAGE is used, a single-layer update is represented as:

[0125] ;

[0126] in, Represents the target node In the The embedding vector of the layer is obtained after passing through the graph neural network. The updated representation of the layer; The activation function is usually represented by ReLU or Sigmoid. The purpose is to introduce a non-linear transformation so that the model can fit more complex mapping relationships. Indicates the first The layer's weight matrix is ​​used to weight the target node. The features undergo a linear transformation. The weight matrix can be learned through training. This indicates a concatenation operation, which concatenates two vectors sequentially into a longer vector, which is then used as input for the next step. This represents an aggregation operation used on the target node. neighboring nodes Information aggregation is performed. Aggregation methods can include averaging, maximizing, or weighted summation, with the aim of integrating neighboring nodes. The feature information is gathered and transmitted to the current target node. . Representing neighboring nodes In the Layer feature vectors, neighboring nodes The representation at the higher level. Represents the target node The neighbor set, containing all nodes related to the target node. Directly connected nodes; the nodes in this set will participate in the aggregation calculation of the current node.

[0127] S55, Query Event Nodes and target node Semantic cosine similarity between :

[0128]

[0129] The semantic cosine similarity can be used to determine the degree of semantic similarity between two nodes;

[0130] Indicates querying event nodes The embedding vector; Represents the target node The final node embedding vectors; these vectors are calculated using methods such as graph neural networks (GNNs) and represent the features of the nodes;

[0131] Indicates querying event nodes Transpose of Embedded Vector and Target Node The final node embedding vector is the dot product. The dot product is a common way to measure the similarity between two vectors; the larger the value, the more similar they are.

[0132] Indicates querying event nodes The magnitude of the vector; Represents the target node The final node embedding vector's modulus (L2 norm). The modulus is the length or size of the vector used to normalize the similarity, keeping it within the range of [-1, 1].

[0133] S56. By using graph path search and large language model, causal reasoning is performed on candidate event nodes whose semantic cosine similarity exceeds a preset threshold, and the causal relationship is completed to obtain the reasoning result. At the same time, the association confidence is output. Events with higher association confidence are considered to be more likely to occur. When the semantic cosine similarity is greater than the similarity threshold T_sim, it is judged as high similarity. T_sim can be determined based on the validation set ROC curve (for example, set to 0.7-0.85).

[0134] Graph path search refers to finding a connected or related path between two nodes (such as event nodes) in a graph. In event reasoning, it is necessary to infer the potential relationship between two events based on known relationships in the graph (such as causal relationships, influence relationships, etc.). The specific operation process includes:

[0135] Search path: Based on the node relationships in the graph, find the path between the query event and candidate events. For example, query event nodes. Possibly with multiple target nodes They are linked through different paths (such as direct causal chains or indirect influence chains). Paths can include: causal relationship paths, similarity paths, etc.

[0136] Path weight calculation: Each path has a weight that represents its strength or credibility. For example, causal paths may have higher weights, while similarity paths may have lower weights.

[0137] Path connectivity: Graph path search can determine the strength of the connection between a candidate event and the query event. A strong path connectivity indicates a close causal or semantic relationship between them.

[0138] The application of large language models in causal reasoning leverages their powerful semantic understanding and textual reasoning capabilities to discover causal relationships between events. The causal reasoning process specifically includes:

[0139] Input data: Event description: Textual descriptions of the query event and candidate events (e.g., log data, public opinion data, system alarms, etc.). Structured semantic information: Structured information such as the event type, time, location, and affected parties, which is converted into vector representations through model encoding.

[0140] The reasoning process includes:

[0141] Event description understanding: The large language model first parses the descriptions of the query event and candidate events to understand their semantic content and contextual relationships.

[0142] Causal inference: Based on the text content of the query event and candidate events, the model infers causal patterns learned during training. The inference process includes: determining whether the query event caused the candidate event. If a causal relationship exists, the model outputs the inference path (e.g., database connection pool exhaustion → transaction delay → user complaint). By comparing the temporal sequence and relational terms (e.g., "caused" or "led to") between the query event and candidate events, the model further confirms the plausibility of the causal chain.

[0143] Completing missing causal chains: If certain causal chains are missing in the graph (e.g., the causal relationship of an event is incomplete), the large language model can complete these chains based on context. For example, the model might infer "Event B occurred because of event A" from a large-scale knowledge base and feed this completion information back to the graph, enhancing its completeness.

[0144] Output: After causal inference, the model returns the causal relationships between events and provides a confidence level. The strength and confidence of the causal relationship are represented by the model's output score. Causal chains with higher confidence levels are considered more likely to occur and further influence the association results.

[0145] S57. Perform a consistency check on the graph neural network inference and the large language model inference results. The final inference result is generated by fusing rules and the model, and the confidence score is calculated by integrating semantic cosine similarity, path connectivity (path_score), time window compatibility (time_score), and large language model consistency (LLM_score).

[0146] ;

[0147] Where α is the weighting coefficient for semantic cosine similarity, β is the weighting coefficient for path connectivity (path_score), γ is the weighting coefficient for time window compatibility (time_score), and δ is the weighting coefficient for large language model consistency (LLM_score). These coefficients control the weight of each scoring factor in the final association score. They can be used to optimize the model through experimental adjustments on the validation set, ensuring that the influence of each factor on the final score meets practical requirements.

[0148] For any query event, the system will return a Top-K list of similar events and their semantic cosine similarity; Top-K represents the top K similar events in the search results that have the highest semantic cosine similarity to the query event, where K is configurable.

[0149] In S57, the specific steps for generating the final reasoning result include:

[0150] S571, Rule-Driven Consistency Detection:

[0151] The inference results of graph neural networks and large language models are detected based on certain predefined rules (e.g., causal inference rules based on time sequence). For example, the rule might require that "if event A is earlier in time than event B, then A should cause B".

[0152] These rules can be defined using expert knowledge or domain experience and are typically used to check whether the results of reasoning conform to common sense or expected causal logic.

[0153] S572, Model Fusion:

[0154] S5721. Result Comparison: The inference results obtained from the graph neural network and the large language model are compared to check whether they are consistent in the type and direction of the event relationship. For example, the graph neural network may infer "event A leads to event B", while the large language model may give a different causal chain. At this time, the consistency detection module will compare the two results to determine which inference is more reasonable.

[0155] S5722. Fusion Strategy: If the inference results of the graph neural network and the large language model are consistent, they can be directly used as the final inference result. If the results are inconsistent, one of the following strategies can be adopted:

[0156] Priority: Priority is determined based on the impact of the event on the business and the urgency of resolving the event; priority is divided into 4 levels, with level 1 being the highest.

[0157] Priority explanation:

[0158] 1. Priorities are used to determine the processing requirements and order of events, and help to understand the proportion of events at each level during statistical analysis.

[0159] 2. Impact level describes the degree of failure, and is divided into 3 levels, with level 1 being the highest.

[0160] 3. The urgency level describes the importance of the event, and is divided into 4 levels, with level 1 being the highest.

[0161] 4. If a fault affects multiple services, the highest-level service system affected shall be used as the basis for judgment.

[0162] Weighted fusion: The inference results of graph neural networks and large language models are weighted and fused to combine the advantages of both. For example, the graph structure inference results of graph neural networks may be more reliable, while the language understanding inference of large language models can provide more detailed causal explanations.

[0163] S5723, Multi-model verification: The consistency of the inference results can be further verified by using other auxiliary models (such as other large language models or graph inference algorithms).

[0164] S573, Output correlation confidence:

[0165] After consistency checks and model fusion, the system outputs the final inference result and calculates a confidence score for the relationship between each event. This confidence score reflects the reliability of the inference result. The higher the confidence score, the more likely the inference result is to be accurate.

[0166] Example of intelligent associative reasoning process (scenario-based explanation):

[0167] Scenario: Identification of correlations in financial transaction delays:

[0168] ① New alarm: Delay occurred in transaction channel T (text: "Transaction interface response timed out, user transaction failure rate increased").

[0169] ② Semantic parsing yields: Event type = service exception, affected object = transaction service, timestamp = T0.

[0170] ③ Text encoding generates a text vector h_text_v, attribute encoding generates a structured attribute vector h_attr_v, and the text vector h_text_v and the structured attribute vector h_attr_v are concatenated to obtain the initial node. The graph neural network aggregates local neighbors (within the last 6 layers) on the graph to obtain the query event node. Embedded vector .

[0171] ④ Vector index returns historical events (Database connection pool exhausted) (Network fragmentation packet loss) is the Top-2 candidate.

[0172] ⑤ =0.82, =0.60; The large language model infers "database connection saturation caused service blocking" from historical event E1, which is highly consistent with the semantics of the current event description. Finally, it returns historical event E1 as a high-confidence similar event and recommends checking the DB connection pool and monitoring indicators.

[0173] The pseudocode (high-level) for intelligent associative reasoning is represented as follows:

[0174] def online_infer(new_event):

[0175] s = semantic_parse(new_event.text)

[0176] h_text = TextEncoder(s.enhanced_text)

[0177] h_attr = AttrEncoder(s.attributes)

[0178] h0 = concat(h_text, h_attr)

[0179] z_q = GNN_infer(h0, local_neighbors) # Neighbor sampling

[0180] candidates = vector_index.search(z_q, topN)

[0181] For candidate c:

[0182] sim = cosine(z_q, z_c)

[0183] llm_score = LLM_verify(new_event, c) # Optional

[0184] path_score = path_connectivity_score(new_event_node, c_node)

[0185]

[0186] return sorted_candidates.

[0187] In S5, a two-level update mechanism is used for frequently arriving new events, including:

[0188] Short-term cache updates embed new nodes and first write them to the real-time vector index;

[0189] Batch merging involves performing a complete fine-tuning of the entire graph neural network's graph structure during nighttime or off-peak hours, updating the graph neural network's parameters and node embeddings, and merging and caching.

[0190] Furthermore, in S5, for historical events (events collected before the sampling data time node), after obtaining the initial node... Next, offline batch pre-training of graph neural networks is performed, including:

[0191] (1) Contrastive learning is used to bring semantically similar events closer together and dissimilar events further apart in historical events; this involves the contrastive learning loss function. Calculation:

[0192] ;

[0193] Among them, the contrastive learning loss function This is used to optimize the model's representational power by minimizing the distance between similar samples while maximizing the distance between dissimilar samples; Event semantic vector and its positive samples Similarity between them, event semantic vectors Indicates the first The event semantic vector representation obtained after processing by feature encoding, graph neural network, or encoder model for each event node is used to characterize the comprehensive semantic features of the event; positive samples Representation and event Semantic vectors of positive sample events that are semantically or causally related. For temperature parameters, The normalization term for negative samples is used to calculate the semantic vector of all samples and events. similarity, Representation and event Semantic vectors of negative sample events that have no direct correlation or significant semantic differences; Represents the negative sample index, where , This represents the number of negative samples.

[0194] In a batch of sample events, all samples other than positive samples are considered negative samples;

[0195] (2) Causal consistency loss: If there are known causal chain samples, a causal chain reconstruction loss can be defined to encourage the model to reconstruct subsequent chains at a given starting point;

[0196] (3) Downstream fine-tuning: After pre-training the graph neural network by self-supervised comparative learning of historical events, it is then fine-tuned using labeled data from downstream tasks.

[0197] The collection of negative samples adopts a hybrid sampling strategy of random negative sampling and hard negative sampling. Hard negative sampling can sample from events that are semantically close but not causally related, thereby improving the model's discrimination ability.

[0198] The pseudocode (high-level) representation of the offline training process is as follows:

[0199] for epoch in epochs:

[0200] for batch in data_loader:

[0201] h_text = TextEncoder(batch.text)

[0202] h_attr = AttrEncoder(batch.attr)

[0203] h0 = concat(h_text, h_attr)

[0204] z = GNN(h0, graph_batch)

[0205] loss_cl = ContrastiveLoss(z, positive_pairs, negative_pairs)

[0206] loss_task = TaskLoss(z, labels) # Optional

[0207]

[0208] optimizer.step(loss).

[0209] Implementation details and engineering suggestions in S5:

[0210] Vector retrieval: Use Faiss or Milvus for large-scale nearest neighbor retrieval to achieve low-latency Top-K retrieval.

[0211] Neighbor sampling: Use neighbor sampling (such as the sampling strategy of GraphSAGE) online to limit computation and control latency.

[0212] Model compression: For online latency-sensitive scenarios, graph neural networks / text encoders can be deployed using either knowledge distillation or quantization (INT8).

[0213] Privacy and Compliance: Desensitize sensitive fields and adopt differential privacy strategies during model training or retain training within a private cloud.

[0214] Anomaly / Misjudgment Protection: Low-confidence inference results are automatically sent to the manual review process; high-risk recommendations are triggered for secondary verification (e.g., pulling multiple sources of evidence).

[0215] Interpretability: Records the aggregated weights of the graph neural network and the reasoning fragments of the large language model to generate auditable reasoning paths, facilitating post-event review and legal / compliance audits.

[0216] The data analysis and risk prediction described in S6 include the following steps:

[0217] S61. Perform event topology analysis on the final inference results, construct an event relationship network, and conduct in-depth analysis based on this network to extract potential connections and causal relationships between events, thereby obtaining the final event topology analysis conclusions. The event relationship network reflects the connection relationships between event nodes, including causal relationships (CAUSES): one event may trigger another event, for example, "equipment failure" may lead to "system crash"; dependency relationships (DEPENDS_ON): the occurrence of one event depends on the completion of another event, for example, "equipment maintenance" depends on the completion of "equipment repair"; similarity relationships (SIMILAR_TO): two events are similar in some characteristics and may have similar consequences, for example, the probability of a fire may increase under similar environmental conditions. By analyzing these relationships, event topology can be used to identify potential propagation paths between events and to perform inference based on graph neural network technology to identify potential propagation paths and secondary events between events. Event topology not only helps to identify potential risks that are triggered but also provides a basis for predicting secondary events.

[0218] S62. Perform time window analysis. Time window analysis refers to analyzing the timing patterns of event triggering within a specific time range based on the order of event occurrence and time intervals. This includes the following steps:

[0219] S621. Analyze historical time series data to establish a time series model, and use the time series model to learn the time pattern of event occurrence, so as to predict the occurrence time of events and identify anomalies.

[0220] S622. Define a specific time window, such as the past 24 hours, the past week, or a specific time range. Within this time window, identify the triggering sequence of events by analyzing the order and time intervals between events. For example, event A triggers event B, and event B further triggers event C. This sequence pattern can reflect the potential risk of secondary events.

[0221] S63. Construct a time-series propagation model using a time-series graph neural network and based on the trigger sequence within a time window. Use this model to evaluate the probability of events occurring in a specific time window, considering the order of event triggering and the likelihood of other events occurring. For example, after an event occurs, assess the time window and probability of it triggering subsequent events. Time-series propagation models typically focus on how events or information propagate over time in a time series, and this propagation may be influenced by certain patterns (e.g., connections between nodes, propagation speed, etc.).

[0222] S64. By combining the event topology with the trigger sequence within the time window, the following predictions can be made:

[0223] (1) Identification of risk event nodes: Based on the time-series propagation model and the final event topology analysis conclusion, potential risk event nodes can be predicted and risk event nodes can be identified; for example, an event may cause system-level failure, which in turn affects multiple downstream nodes (such as database failure may cause system unavailability).

[0224] (2) Risk level assessment: Based on time series information and the final event topology analysis conclusions, the risk level of each event can be assessed. The risk level is divided into low, medium and high. For example, if there are multiple high-risk nodes (such as serious equipment failure) on the propagation path of an event node, the risk level of this event will be assessed as high. The original data of multi-source heterogeneous data contains time series information.

[0225] (3) Propagation path and scope of impact: Based on the final event topology analysis conclusions and time series model, calculate the propagation path and scope of impact of future events. For example, a network attack may not only affect local servers, but may also affect other critical business systems through network topology.

[0226] Risk prediction results are displayed graphically in the interface and can generate text reports for decision-makers.

[0227] An intelligent correlation analysis system for emergency events based on knowledge graphs, comprising:

[0228] The data acquisition module is used to collect event data from various information sources and preprocess it, providing a unified input for the subsequent semantic analysis module. This module supports multiple acquisition methods, including Agent, Syslog, API, and file stream. The acquisition targets include surveillance video systems, IoT sensors, server logs, network security devices, alarm centers, and public opinion platforms. Each data source defines an independent acquisition plugin, which is dynamically loaded through the configuration center.

[0229] Semantic parsing module: Used to receive event data preprocessed by the data acquisition module and convert it into structured semantic information to generate an event semantic tree;

[0230] Knowledge Graph Module: Used to generate nodes and relationships based on structured semantic information in the event semantic tree, thereby constructing a knowledge graph G=(V,E);

[0231] The inference computation module includes:

[0232] Text encoding layer: used to encode the original text of the event to obtain a text vector;

[0233] Attribute encoding layer: used to encode structured attributes to obtain structured attribute vectors;

[0234] Vector fusion and splicing layer: used to fuse and splice text vectors and result attribute vectors to obtain initial nodes;

[0235] Graph Neural Network Encoding Layer: Used to compute the final node embedding vector of a graph neural network (GNN);

[0236] Temporal augmentation layer: used to introduce temporal information as an edge or node attribute into the graph neural network;

[0237] Similarity Calculation and Inference Layer: Used to calculate cosine similarity;

[0238] Joint Validation Layer: Used to perform consistency checks on the graph neural network inference and the Large Language Model (LLM) inference results, and outputs the final inference result.

[0239] Data Analysis Module: Used to perform data analysis and risk prediction based on the final reasoning results of the event, and obtain risk prediction results;

[0240] The visualization and decision-making module includes a left-side display area, a middle display area, and a right-side display area. The left-side display area is used to display the event list and filter conditions, the middle display area is used to display the knowledge graph (including nodes, relationships, and paths), and the right-side display area is used to display event details, risk prediction results, and handling suggestions. Decision-makers can use the visualization and decision-making module to more intuitively understand the situation of emergency events, thereby making accurate and comprehensive decisions quickly.

[0241] The data acquisition module, semantic parsing module, knowledge graph module, inference and computation module, data analysis module, and visualization and decision-making module communicate with each other via message queues (MQ) and a unified interface (RESTful API). The system is deployed using a microservice architecture to ensure module decoupling and horizontal scalability.

[0242] The above description is merely the optimal embodiment of the present invention and is not intended to limit the present invention. Any modifications or substitutions made by those skilled in the art without departing from the essence and scope of protection of the present invention should also be within the scope of protection of the present invention.

Claims

1. A knowledge graph-based intelligent correlation analysis method for emergency events, characterized in that, Includes the following steps: S1. Collect multi-source heterogeneous data and perform format standardization and field consistency conversion on the multi-source heterogeneous data through ETL to obtain standardized data; S2. Transform standardized data into structured semantic information to generate an event semantic tree; S3. Generate nodes and relationships based on the structured semantic information in the event semantic tree, thereby constructing a knowledge graph G=(V,E), where V is the set of event nodes and entity nodes, and E is the set of edges; S4. Use a graph database to store the knowledge graph; S5. Based on the event information in the knowledge graph and combined with graph neural networks and large language models, calculate the semantic cosine similarity between events and perform intelligent association reasoning to obtain the final reasoning result for the events. S6. Based on the final reasoning results of the event, conduct data analysis and risk prediction to obtain the risk prediction results; S7. Finally, the knowledge graph and risk prediction results are displayed on the interface for decision-makers to use.

2. The knowledge graph-based intelligent correlation analysis method for emergency events according to claim 1, characterized in that, S5 includes the following steps: S51. Use a pre-trained language model to obtain the text vector h_text_v for the original text description t_v of each event node in the knowledge graph. For long texts in the original text description t_v, a sliding window or summarization strategy can be used to first extract and complete the semantics through a large language model, and then feed them into the pre-trained language model. S52. For each event node in the knowledge graph, the structured attribute a_v is mapped to a structured attribute vector h_attr_v through MLP; S53. Concatenate or weightedly fuse the text vector h_text_v and the structured attribute vector h_attr_v to obtain the initial node. ; S54. Graph structure based on graph neural network for initial nodes conduct Layer aggregation calculation: Aggregating distances to target nodes using graph neural networks. No more than By analyzing the information of the neighboring nodes, we obtain the final node embedding vector. : ； in, Represents the initial node feature vector. Represents the target node of The set of skip neighbor nodes; S55, Calculate query event nodes and target node Semantic cosine similarity between : ； in, Indicates querying event nodes The embedding vector; Represents the target node The final node embedding vector; Indicates querying event nodes The transpose of the embedding vector and the target node The dot product of the final node embedding vectors; Indicates querying event nodes The magnitude of the vector; Represents the target node The magnitude of the final node embedding vector; S56. By using graph path search and large language model, causal reasoning is performed on candidate event nodes whose semantic cosine similarity exceeds a preset threshold, and the causal relationship is completed to obtain the reasoning result. At the same time, the association confidence is output. Events with higher association confidence are considered to be more likely to occur. S57. Perform consistency checks and model fusion on the inference results to obtain the final inference result.

3. The knowledge graph-based intelligent correlation analysis method for emergency events according to claim 2, characterized in that, In S57, the specific steps for generating the final reasoning result include: S571, Rule-driven consistency detection: Detecting the inference results of graph neural networks and large language models based on predefined rules; S572, Model Fusion, including: S5721. Result Comparison: Compare the inference results obtained by the graph neural network and the large language model to check whether they are consistent in the type and direction of event relationships; S5722. Fusion Strategy: If the inference results of the graph neural network and the large language model are consistent, they can be directly used as the final inference result; if the results are inconsistent, one of the following strategies can be adopted: Priority: The inference results of models with higher priority levels are given priority; the priority is determined by the impact of the event on the business and the urgency of resolving the event; where impact describes the degree of failure and urgency describes the importance of the event object; Weighted fusion: The inference results of graph neural networks and large language models are weighted and fused to combine the advantages of both. S5723, Multi-model validation: Further verify the consistency of inference results using other auxiliary models; S573. Output Association Confidence: After consistency testing and model fusion, output the final inference result and calculate the confidence score for the relationship between each event.

4. The knowledge graph-based intelligent correlation analysis method for emergency events according to claim 2, characterized in that, In S5, for historical events, after obtaining the initial node... Next, offline batch pre-training of graph neural networks is performed, including: Contrastive learning is used to bring semantically similar events closer together and dissimilar events further apart in historical events; this involves a contrastive learning loss function. Calculation: ； in, Event semantic vector and its positive samples Similarity between them, event semantic vectors Indicates the first The event semantic vector representation obtained after processing by feature encoding, graph neural network, or encoder model for each event node is used to characterize the comprehensive semantic features of the event; positive samples Representation and event Semantic vectors of positive sample events that are semantically or causally related. For temperature parameters, The normalization term for negative samples is used to calculate the semantic vector of all samples and events. similarity, Representation and event Semantic vectors of negative sample events that have no direct correlation or significant semantic differences; Downstream fine-tuning: After pre-training a graph neural network using self-supervised comparative learning of historical events, it is then fine-tuned using labeled data from downstream tasks.

5. The knowledge graph-based intelligent correlation analysis method for emergency events according to claim 4, characterized in that, The collection of negative samples adopts a hybrid sampling strategy of random negative sampling and hard negative sampling. Hard negative sampling can sample from events that are semantically close but not causally related, thereby improving the model's discrimination ability.

6. The knowledge graph-based intelligent correlation analysis method for emergency events according to claim 2, characterized in that, During the construction of the knowledge graph, new event streams are monitored. If the semantic cosine similarity with an existing node is greater than a set threshold, node fusion is performed. If a new relationship chain not existing in the knowledge graph is found, a new edge is automatically inserted and the topology is updated.

7. The knowledge graph-based intelligent correlation analysis method for emergency events according to claim 1, characterized in that, The ETL described in S1 includes the following steps: S11. Extract heterogeneous data from multiple sources in a unified manner. The data includes real-time data, historical data, and external data. During the data extraction process, data is accessed through different data protocols with external platforms to ensure that no data source is missed. S12. Standardized Data: Convert the extracted multi-source heterogeneous data format into a unified standard format to eliminate format differences between different data sources and achieve format standardization; and perform field mapping for differences in content and units of data from different sources, standardize field names and unify time formats and numerical units. S13. Filter out duplicate, abnormal, or invalid data in the standardized data to ensure data quality; S14. Load the filtered, standardized data into the target database or data warehouse to form a data pool.

8. The knowledge graph-based intelligent correlation analysis method for emergency events according to claim 1, characterized in that, S2 includes the following steps: S21. Use a natural language processing model to perform named entity recognition on standardized data and extract key event elements; S22. By performing dependency parsing on standardized data using a large language model, the contextual relationships are analyzed, causal relationships and implicit event logic are automatically completed, and the semantic relationships of words in the sentence are obtained. S23. The analysis results of each large language model are scored. When the confidence level is lower than the threshold, it is automatically entered into the manual review queue to ensure semantic consistency and reliability. S24. Generate an event semantic tree by using key event elements as nodes and semantic relationships between words in sentences as edges.

9. The knowledge graph-based intelligent correlation analysis method for emergency events according to claim 1, characterized in that, S6 includes the following steps: S61. Perform event topology analysis on the final reasoning results, construct an event relationship network, and conduct in-depth analysis based on the event relationship network to extract potential connections and causal relationships between events, and obtain the final event topology analysis conclusions. S62. Perform time window analysis: Set a specific time range for the time window, and within the time window, identify the trigger sequence of events by analyzing the order of occurrence and time intervals between events. S63. Based on the trigger sequence within a time window, evaluate the probability of the event triggering order occurring with other events within a specific time window; S64. Combining the event topology with the trigger sequence within the time window, the following predictions are made: (1) Identification of risk event nodes: Based on the historical event sequence and the topological analysis conclusion of the final event, predict potential risk event nodes and realize the identification of risk event nodes; (2) Risk level assessment: Based on the time series information and the final event topology analysis conclusion, the risk level of each event is assessed, and the risk level is divided into low, medium and high. (3) Propagation path and scope of impact: Based on the topological analysis conclusions of the final event and the time series model, calculate the propagation path and scope of impact of future events.

10. An intelligent correlation analysis system for emergency events based on knowledge graphs, characterized in that, include: Data acquisition module: used to collect multi-source heterogeneous data and perform format standardization and field consistency conversion on the multi-source heterogeneous data through ETL to obtain standardized data; Semantic parsing module: used to transform standardized data into structured semantic information and generate an event semantic tree; Knowledge Graph Module: Used to generate nodes and relationships based on structured semantic information in the event semantic tree, thereby constructing a knowledge graph G=(V,E); Reasoning and computation module: used to calculate the semantic cosine similarity between events based on event information in the knowledge graph and perform intelligent association reasoning to obtain the final reasoning result for the event; Data Analysis Module: Used to perform data analysis and risk prediction based on the final reasoning results of the event, and obtain risk prediction results; Visualization and Decision Module: Used to display event information, knowledge graphs, risk prediction results, and provide decision-making suggestions.

Images