Intelligent substation monitoring log filling and reporting method based on knowledge enhancement and voice interaction

Abstract

The invention provides a power transformation monitoring log intelligent filling and reporting method based on knowledge enhancement and voice interaction, and relates to the technical field of power monitoring logs. The method comprises the steps of generating knowledge enhancement representation for a monitoring event by constructing a power transformation monitoring field knowledge graph, and realizing event positioning, log field automatic generation and increment revision under voice interaction of a monitoring watchman in combination with voice recognition, intention recognition and slot extraction. The system forms monitoring log entries to be confirmed in multiple rounds of voice interaction, the monitoring log entries are filed after being confirmed by a watchman, and monitoring event semantic information, voice interaction texts and final log entries are aligned and stored. Based on semantic differences, statistical distribution differences, consistency scores and novelty scores, the incremental contribution degree of newly added logs is comprehensively evaluated, and the knowledge base in the power transformation monitoring field is adaptively updated, so that the log filling efficiency and the completeness and timeliness of the knowledge base are improved. The problem that a sustainable self-learning intelligent filling function cannot be realized is solved.

Description

Technical Field

[0001] This invention relates to the field of power monitoring log technology, and in particular to an intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction. Background Technology

[0002] With the continuous improvement of power grid scale and automation level, various substations are widely deploying dispatch automation systems, centralized control systems, and online monitoring systems to monitor a large amount of operational information in real time, such as voltage, current, switch positions, protection actions, load flow, and online monitoring. Currently, the recording of monitoring logs mainly relies on manual operators who manually enter information such as the time of event, equipment name, alarm content, handling process, and result into the log system or operation and maintenance management system based on alarms from monitoring screens, communication with dispatch and maintenance personnel, and on-site handling feedback. Although some systems provide semi-automatic filling functions based on fixed templates, they usually only simply input the alarm code, equipment name, and time field. The main content of the log still relies on manual editing, supplementation, and modification, which is labor-intensive, inconsistent, and prone to problems such as information omissions and non-standard descriptions.

[0003] In the field of power system operation and control, with the development of technologies such as artificial intelligence, big data, and knowledge graphs, substation monitoring is evolving towards intelligence, scenario-based applications, and human-machine collaboration. On the one hand, technologies such as knowledge graphs and knowledge base question answering are being used to structure and model information such as equipment topology, procedures and specifications, and fault cases. This is already being applied in equipment management, fault diagnosis, and operation and maintenance decision support, providing operators with knowledge-enhanced auxiliary analysis capabilities. On the other hand, technologies such as speech recognition, speech synthesis, and dialogue management are maturing, and intelligent voice assistants and voice interaction interfaces are being piloted in scenarios such as dispatch communication, information query, and simple command control. In terms of log management, there are also explorations using rule engines or simple machine learning models to generate some log fields based on alarm codes, equipment types, and preset templates, and attempts are being made to perform text analysis on historical logs for report statistics and typical case mining. The overall development trend is to evolve monitoring logs from passive recording tools into important data assets supporting fault analysis, risk warning, and operation assessment.

[0004] Existing technologies still have significant shortcomings in intelligent reporting of substation monitoring logs. Current semi-automatic reporting methods primarily rely on copying original alarm fields or splicing fixed phrases, lacking semantic fusion of multi-source data. They cannot automatically combine information such as operating modes, maintenance plans, defect records, and historical similar events to generate event descriptions and handling process records with complete contextual logic. Monitoring telephone recordings and multi-round telephone communications contain a wealth of crucial information about event causes, on-site investigation results, and handling measures. However, current solutions typically only archive these as voice files, without fine-grained alignment and joint modeling with log text. Furthermore, there is a lack of mechanisms to continuously optimize domain knowledge and generation strategies using voice and log alignment data. In addition, existing voice interaction applications are mostly limited to simple voice queries and command execution, failing to form an integrated technical path for multi-round voice interaction and knowledge-enhanced reasoning for monitoring log scenarios. Therefore, the monitoring log reporting process still suffers from cumbersome operations, easy omissions, inconsistent semantics, and difficulty in self-iterative improvement of system capabilities. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies, the purpose of this invention is to provide an intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction. This invention solves the problem that existing technologies for substation monitoring log reporting lack an integrated technical solution that organically combines multi-source operating data, knowledge enhancement modeling, and multi-round voice interaction, and cannot achieve sustainable self-learning intelligent reporting functions while ensuring semantic integrity and standardized uniformity.

[0006] To achieve the above objectives, the present invention provides the following solution:

[0007] A method for intelligent reporting of substation monitoring logs based on knowledge enhancement and voice interaction includes: acquiring substation monitoring operation data and preprocessing the substation monitoring operation data to obtain preprocessed substation monitoring operation data, wherein the substation monitoring operation data includes: alarm data, telemetry data, operation mode data, maintenance plan data, equipment defect record data, historical monitoring logs, and voice data corresponding to monitoring telephone recordings; aggregating the preprocessed substation monitoring operation data into monitoring events according to a preset time window and equipment identifier, and associating the monitoring events with corresponding context information to obtain a monitoring event semantic set; constructing a substation monitoring domain knowledge base; generating corresponding knowledge-enhanced representations for each monitoring event in the monitoring event semantic set based on the substation monitoring domain knowledge base, to obtain a knowledge-enhanced monitoring event representation set; receiving voice input from the monitoring duty officer and performing voice recognition to obtain voice-transcribed text, and performing intent recognition on the voice-transcribed text to obtain log-related intents; and based on the daily... Based on the relevant intent of the monitoring event semantic set, the semantic context of the target event to be updated is determined; based on the knowledge-enhanced monitoring event representation set, monitoring log candidate entries are generated, and the fields of the monitoring log candidate entries are modified according to the incremental constraints in the semantic context of the target event to obtain a set of monitoring log candidate entries; based on the set of monitoring log candidate entries, the monitoring log candidate entries are output to the monitoring duty officer via voice broadcast, and the monitoring log candidate entries are supplemented and revised based on multiple rounds of voice interaction to obtain monitoring log entries to be confirmed; if the monitoring duty officer confirms the monitoring log entries to be confirmed, the monitoring log entries to be confirmed are archived to obtain the final monitoring log entries; the monitoring event semantic information, voice interaction text information, and final monitoring log entry information corresponding to the final monitoring log entries are aligned and stored, and the substation monitoring domain knowledge base is updated based on the alignment and storage results to obtain the updated substation monitoring domain knowledge base.

[0008] The present invention discloses the following technical effects:

[0009] This invention provides an intelligent substation monitoring log filling method based on knowledge enhancement and voice interaction. This invention performs unified preprocessing and event-level semantic aggregation on multi-source substation monitoring operation data, introduces a substation monitoring domain knowledge base and knowledge graph to enhance the representation of monitoring events, and combines speech recognition, intent recognition, and slot extraction to achieve multi-round voice-interactive intelligent filling of log-related information with monitoring operators. Compared to the semi-automatic method in the prior art that relies solely on copying original alarm fields and splicing fixed templates, this invention can automatically integrate key information from operating modes, maintenance plans, equipment defects, historical logs, and monitoring telephone voice messages to generate monitoring log entries with complete context and standardized structure. After operator confirmation, the event semantics, voice interaction text, and final log are stored in an aligned manner. An incremental contribution evaluation mechanism is used to continuously update the domain knowledge base, thereby significantly reducing manual data entry workload, minimizing information omissions and non-standard expressions, improving log consistency and usability, and forming a self-learning and evolving intelligent monitoring log filling system. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 The flowchart illustrates a method for intelligent reporting of substation monitoring logs based on knowledge enhancement and voice interaction, as provided in this embodiment of the invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0014] like Figure 1 As shown, this invention provides an intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction, including:

[0015] Step 100: Obtain substation monitoring operation data and preprocess the substation monitoring operation data to obtain preprocessed substation monitoring operation data. The substation monitoring operation data includes: alarm data, telemetry data, operation mode data, maintenance plan data, equipment defect record data, historical monitoring logs, and voice data corresponding to monitoring telephone recordings.

[0016] Step 200: Aggregate the preprocessed substation monitoring operation data into monitoring events according to the preset time window and equipment identifier, and associate the monitoring events with the corresponding context information to obtain a monitoring event semantic set;

[0017] Step 300: Construct a knowledge base for substation monitoring;

[0018] Step 400: Generate corresponding knowledge-enhanced representations for each monitoring event in the monitoring event semantic set based on the substation monitoring domain knowledge base, and obtain a set of knowledge-enhanced monitoring event representations;

[0019] Step 500: Receive the voice input from the monitoring duty officer and perform voice recognition to obtain the voice-transcribed text, and perform intent recognition on the voice-transcribed text to obtain the log-related intent;

[0020] Step 600: Based on the log-related intent, determine the target event semantic context to be updated according to the monitoring event semantic set and the monitoring event semantic set;

[0021] Step 700: Generate monitoring log candidate entries based on the knowledge-enhanced monitoring event representation set, and modify the fields of the monitoring log candidate entries according to the incremental constraints in the semantic context of the updated target event to obtain a monitoring log candidate entry set;

[0022] Step 800: Based on the set of candidate monitoring log entries, output the candidate monitoring log entries to the monitoring duty officer via voice broadcast, and supplement and revise the candidate monitoring log entries based on multiple rounds of voice interaction to obtain the monitoring log entries to be confirmed.

[0023] Step 900: If the monitoring duty officer confirms the monitoring log entry to be confirmed, the monitoring log entry to be confirmed is archived to obtain the final monitoring log entry;

[0024] Step 1000: Align and store the semantic information of the monitoring event, the voice interaction text information, and the final monitoring log entry information corresponding to the final monitoring log entry, and update the substation monitoring domain knowledge base based on the alignment and storage results to obtain the updated substation monitoring domain knowledge base.

[0025] Furthermore, the specific implementation process of step 100 is as follows:

[0026] This embodiment first collects alarm data, telemetry data, operation mode data, maintenance plan data, equipment defect record data, and historical monitoring logs from the dispatch automation system, centralized control system, and online monitoring system. It then parses and structures the various raw data according to a unified field specification. Using a field rule base, it fills in or infers missing time fields, equipment identification fields, and event type fields, transforming operational data from different sources and formats into a structured operational data set with semantically consistent time, equipment identification, and event type fields. To improve the accuracy of subsequent event aggregation, this embodiment performs a unified time base conversion on the time field in the structured operational data set, aligning timestamps from different time sources to a unified time zone and time format. The timestamps are then normalized according to a preset time granularity, mapping second-level or even millisecond-level raw time records to discrete time slots used for event clustering, generating a time-aligned operational data set. This provides a precise time scale for time window-based monitoring event identification.

[0027] This embodiment uses a speech recognition engine to automatically transcribe the audio data corresponding to recorded surveillance calls, obtaining transcribed text containing dialogue turns, speaker direction, and audio content. By combining the call start time, the timestamp generated by the recording system, and the device identifier associated with the call, each transcribed text segment is bound to its corresponding timestamp and device identifier information. This allows the surveillance call text to be aligned and mapped with other operational data along the timeline and device dimension, forming a surveillance call text data set. In this way, this embodiment can convert unstructured information contained in voice interactions, such as fault explanations, on-site handling feedback, and dispatch instructions, into text format with time and device attributes, providing a directly usable text data source for subsequent semantic modeling of surveillance events.

[0028] After completing the construction of the time-aligned running data set and the monitoring telephone text data set, this embodiment merges the two according to a unified data model. Using the time field and device identifier field as primary keys, structured running records within the same time range and under the same device identifier are associated with corresponding telephone text records at the row or fragment level. This eliminates differences in field naming, encoding methods, and storage structures between different subsystems, and outputs the preprocessed substation monitoring running data according to a pre-designed unified data format. Through the above preprocessing steps, this embodiment transforms heterogeneous data originally scattered across multiple monitoring subsystems and voice recording systems into a spatiotemporally unified, semantically aligned, and readily applicable foundational data set for subsequent event aggregation and knowledge enhancement modeling. This provides a complete and standardized input for the subsequent construction of monitoring event semantic sets and intelligent log reporting.

[0029] Furthermore, the specific implementation process of step 200 is as follows:

[0030] After constructing the pre-processed substation monitoring operation data, this embodiment first divides the data into two dimensions—time and device—based on preset time window parameters and device identifiers. The time axis is divided into continuous time window segments at predetermined time granularities such as minutes or seconds. Within each time window, alarm data, telemetry data, operation mode data, maintenance plan data, equipment defect record data, and monitoring telephone text data with the same device identifier are aggregated and organized. Through this process, this embodiment merges multiple records that were originally stored separately according to data source and record type into a candidate event data set with "time window plus device" granularity. This ensures that alarms, telemetry fluctuations, operation mode switching, and related call content occurring on the same device within a certain time period are grouped into the same candidate set, providing the necessary data foundation for subsequent determination of event start and end points and event types.

[0031] After obtaining the candidate event data set, this embodiment introduces preset event triggering rules to analyze candidate records under the same time window and the same device identifier. It comprehensively judges the start and end points of events based on multiple clues, including alarm level changes, telemetry over-limit duration, operation mode switching actions, maintenance plan execution status, and key semantic markers in monitoring telephone text, thereby completing event boundary determination. Furthermore, it determines the event type label based on alarm code combinations, telemetry anomaly patterns, and relevant semantic content. For each individual monitoring event formed by the rules, this embodiment generates a unique event identifier and records the event's start and end times, as well as attribute information such as event type, forming a basic set of monitoring events. This allows subsequent processing to perform semantic expansion and log generation based on events as the basic unit.

[0032] After constructing a basic set of monitoring events, this embodiment further utilizes the event identifier and start / end time of each monitoring event to selectively retrieve relevant operating mode data, maintenance plan data, equipment defect record data, and historical monitoring logs from the preprocessed substation monitoring operation data. Data that overlaps with the event's time period or has an impact on the equipment within a preset time range before or after the event is appended as context information to the corresponding monitoring event, forming an extended set of monitoring events containing both event ontology and context information. Based on this, this embodiment represents each monitoring event and its associated context data according to a unified semantic structure, organizing event attributes, operating background, maintenance status, past defects, and historical similar event records into computable structured semantic objects. This ultimately forms a semantic set of monitoring events for subsequent knowledge-enhanced modeling and intelligent log entry.

[0033] Furthermore, the specific implementation process of step 300 is as follows:

[0034] In constructing the knowledge base for substation monitoring, this embodiment first extracts information such as substations, bays, equipment, and their connections based on existing substation equipment asset lists and primary wiring data. This generates an equipment topology with equipment entities as nodes and electrical connections and monitoring affiliations as edges. Furthermore, each equipment entity is associated with its corresponding monitoring point table information, and monitoring points such as telemetry, remote signaling, protection action signals, and alarm signals are attached to the equipment nodes as monitoring point entities. Through this modeling, this embodiment transforms the original topology and monitoring point configuration, which existed in tables and drawings, into searchable and reasonable structured knowledge. This allows for rapid location of upstream and downstream equipment and association of relevant monitoring quantities based on equipment identifiers during log generation, and enables understanding of the system location and impact range of alarms using topological relationships.

[0035] This embodiment further extracts and organizes knowledge related to commonly used alarm codes, alarm meanings, event categories, and handling procedures in substation monitoring operations. Each alarm code is defined as a monitoring event type entity, and this entity is associated with attributes such as alarm description, alarm level, affiliated equipment type, typical cause patterns, and recommended handling measures. Simultaneously, the steps, precautions, and operating conditions in the standard handling procedures are broken down into a set of handling measure entities, which are associated with the corresponding alarm event type entities through relationships such as "applicable to" and "recommended for." To ensure the standardization of expression during the monitoring log generation process, this embodiment also abstracts the field definitions, text format constraints, and required field rules in the log template specification into log field constraint entities, recording the constraint relationships of each type of event's corresponding log fields in terms of content, format, and optional values. This creates a clear mapping channel between event types and log fields in the domain knowledge base.

[0036] Based on the aforementioned structured knowledge, this embodiment incorporates historical monitoring logs as important data assets into the domain knowledge base. By parsing existing monitoring logs, fields such as event type, equipment name, time information, cause analysis, and handling measures are extracted. These fields are then aligned with corresponding monitoring event type entities, equipment entities, and handling measure entities, forming historical case-level associations. Typical excerpts from the log text are recorded as example corpora to enrich the semantic expression and handling experience for each type of event. By unifying equipment topology, monitoring point tables, alarm codes and meanings, standard handling procedures, log template specifications, and aligned historical monitoring logs into a unified knowledge base structure containing substation equipment entities, monitoring event type entities, handling measure entities, and log field constraint entities, this embodiment constructs a substation monitoring domain knowledge base capable of supporting knowledge-enhanced monitoring event representation and intelligent log generation. This provides complete domain semantic support for knowledge retrieval, feature fusion, and log template constraints in subsequent steps.

[0037] Furthermore, the specific implementation process of step 400 is as follows:

[0038] After constructing the substation monitoring knowledge base, this embodiment first performs structured modeling of the substation equipment entities, monitoring event type entities, handling measure entities, and log field constraint entities contained in the knowledge base. A point-edge structure is used to uniformly represent the equipment topology relationships, alarm code-to-event type mapping relationships, the applicability relationships between event types and handling procedures, and the mapping relationships between event types and log field constraints into a traversable and reasonable substation monitoring knowledge graph. In this knowledge graph, this embodiment assigns a clear entity type label to each type of entity and defines relationship types and directions for different relationships. This allows for subsequent graph traversal or graph retrieval operations to accurately locate relevant knowledge fragments in the graph based on equipment identifiers and event types, achieving a structured transformation from the original knowledge base to a knowledge graph representation.

[0039] In this embodiment, after obtaining the knowledge graph representation of the substation monitoring domain, for each monitoring event in the semantic set of monitoring events, the device identifier, event type, alarm code, and semantic tag information related to the handling process of the monitoring event are read and used as search conditions to perform graph query operations in the knowledge graph. This retrieves the device entity, event type entity, alarm code entity, handling measure entity, and their relationships corresponding to the current monitoring event, resulting in a set of candidate domain knowledge subgraphs surrounding the monitoring event. For each monitoring event, this embodiment, according to preset relevance evaluation rules, eliminates nodes and relationships in the candidate domain knowledge subgraphs that have a low semantic matching degree with the current event or are clearly inconsistent with the current operating mode or maintenance status. Only knowledge fragments that match the device type, event type, alarm code, and handling procedure are feasible in the current operating state are retained. These fragments are then aggregated into four semantic units: device information, event type information, handling procedure information, and log template constraint information, forming the domain knowledge context corresponding to the monitoring event.

[0040] This embodiment, based on the construction of a domain knowledge context set, performs feature fusion processing on the semantic representation of each monitoring event in the monitoring event semantic set and its corresponding domain knowledge context. Specifically, it constructs embedded representations for the semantic feature vector of the monitoring event and the device features, event type features, handling procedure steps features, and log field constraint features in the domain knowledge context, respectively. Then, it uses vector concatenation, weighted summation, or attention-weighted fusion to combine the event's own observation features with the structured knowledge features extracted from the knowledge graph into a unified high-dimensional representation. Through the above feature fusion, this embodiment generates a knowledge-enhanced monitoring event representation for each monitoring event, containing the original operational data semantics, topological location, standard handling scheme, and log field specifications. This ultimately forms a set of knowledge-enhanced monitoring event representations, providing event-level input that combines data-driven and knowledge-constrained elements for subsequent log candidate entry generation and field correction.

[0041] Furthermore, the specific implementation process of step 500 is as follows:

[0042] After constructing the semantic set of monitoring events and the knowledge-enhanced monitoring event representation set, this embodiment receives the voice input of the monitoring duty officer during log entry through a voice terminal or microphone device. The collected voice signal is sent to the speech recognition module for acoustic and language modeling processing, and outputs the speech-transcribed text corresponding to the current voice input. To reduce the impact of spoken expression on subsequent understanding, this embodiment performs basic text normalization processing on the speech-transcribed text after speech recognition output, including the standardized replacement of numerical values, time expressions, and common professional terms, making the obtained text closer to the written expression in the monitoring business scenario, and providing stable input data for intent recognition.

[0043] After obtaining the standardized speech-to-text, this embodiment uses a pre-built log intent recognition model to perform semantic analysis and intent classification on the text, identifying the instructive expressions and operational requirements related to log entry. Specifically, this embodiment designs an intent tag set for monitoring log scenarios, including log entry initiation intent, information supplementation intent, and log confirmation and modification intent. When the speech-to-text contains semantics such as initiating a new log record, explaining that a certain alarm or action needs to be recorded, it is determined to be a log entry initiation intent; when the speech content adds details, supplements reasons, or completes the action steps around certain fields of an existing log entry, it is determined to be an information supplementation intent; when the speech content involves checking an existing log entry, modifying a field, or confirming whether the current version is effective, it is determined to be a log confirmation and modification intent. Through the above intent recognition process, this embodiment transforms continuous natural language speech input into structured log-related intents, providing clear semantic driving signals for subsequent event location, field updates, and multi-round interactive control.

[0044] Furthermore, the specific implementation process of step 600 is as follows:

[0045] After recognizing the intent of the monitoring operator's voice input, this embodiment further extracts slots from the speech-to-text, extracting information closely related to log reporting into structured slots, including event location slots, field update slots, and confirmation status slots. The event location slot carries device identifiers, time ranges, event type descriptions, and other semantic fragments sufficient to indicate specific monitoring events in the voice. The field update slot carries the operator's instructions to add, modify, or delete fields such as log title, occurrence time, end time, device name, cause analysis, and handling measures. The confirmation status slot carries status instructions in the voice regarding whether the current log version is confirmed, whether further modification is needed, and whether to switch to another event. This embodiment assembles log-related intents with the above slot information into a log interaction request carrying intent and slot information, providing a unified input interface for subsequent target event selection and semantic context updates.

[0046] This embodiment performs a retrieval operation on the monitoring event semantic set based on the device identifier, time range, and event type conditions parsed from the event location slot. Monitoring events that match the voice description in time, have the same device identifier, and match the event type are selected to form a candidate target monitoring event set. Subsequently, this embodiment further filters based on the combination of the candidate target monitoring event set and log-related intents: when the log-related intent is a log entry initiation intent, the monitoring event most recently in time with the current voice interaction time and meeting the retrieval conditions is selected as the target monitoring event; when the log-related intent is an information supplement intent or a log confirmation and modification intent, the monitoring event most consistent with the current dialogue context is selected from the candidate target monitoring event set, combining event references in the speech-to-text, round connection information, and the event context selected in the previous round of interaction. Through the above strategy, this embodiment can maintain the consistency of event references during multiple rounds of voice interaction, avoiding semantic jumps and event confusion.

[0047] After identifying the target monitoring event, this embodiment retrieves the corresponding knowledge-enhanced monitoring event representation from the knowledge-enhanced monitoring event representation set using the event identifier of the target monitoring event. This representation is then fused with historical voice interaction information accumulated before the current session round to construct a target event semantic context that includes event ontology attributes, domain knowledge constraints, historical dialogue instructions, and log generation status. Based on this, this embodiment incrementally updates the corresponding event attributes and log field content in the target event semantic context according to the field name, field value, and operation type carried in the field update slot. Simultaneously, based on the confirmation status slot reflecting confirmation status, whether to continue modification, and other status information, the semantic tags and log field constraint status in the target event semantic context are updated to form the latest updated target event semantic context. This updated semantic context will serve as the direct basis for the generation and sorting of subsequent monitoring log candidate entries, enabling the ability to refine and correct log content round by round as voice interaction progresses.

[0048] Furthermore, the specific implementation process of step 700 is as follows:

[0049] After obtaining the semantic context of the target event to be updated, this embodiment first utilizes the event identifier, event type, and knowledge retrieval index information contained therein to select the target knowledge-enhanced monitoring event representation that corresponds one-to-one with the semantic context from the knowledge-enhanced monitoring event representation set, as the semantic input basis for the automatic generation of the current round of logs. Through this selection process, this embodiment ensures that the feature vector used to generate log content includes not only the observation features of the monitoring event itself, but also structured knowledge such as device topology, standard handling procedures, and log field constraints injected by the domain knowledge graph, providing a unified semantic reference for the consistent generation of subsequent log fields.

[0050] This embodiment, based on target knowledge-enhanced monitoring event representation, automatically generates log fields such as log title, occurrence time, end time, equipment name, equipment location, event type, cause analysis, and handling measures, according to the constraints on the meaning and sentence structure of each field in the substation monitoring log template specification. This yields initial monitoring log candidate entries covering the core fields. During the generation process, this embodiment maps the event time features in the target knowledge-enhanced monitoring event representation to the occurrence time and end time fields, maps equipment entity features to the equipment name and equipment location fields, maps event type features and alarm code features to the event type field, and maps the cause and measure features obtained by fusing historical cases and handling procedures to the cause analysis and handling measures fields, thereby forming a structurally complete and semantically coherent initial log text. Based on this, this embodiment corrects and completes the specified fields in the initial monitoring log candidate entries one by one according to the incremental constraint information in the semantic context of the updated target event. When the field update slot indicates that a certain field needs to be overwritten and updated, the corresponding field is replaced with the content in the latest voice interaction. When the incremental constraint indicates that a certain field needs to be supplemented, the original field content is expanded and supplemented to obtain the monitoring log candidate entries after field correction.

[0051] This embodiment, after generating candidate entries for monitoring logs with corrected fields, combines the confirmation status slot information and session history constraint information in the semantic context of the updated target event to determine the validity and version status of the candidate entries for the current round of logs. When the confirmation status slot indicates that the duty officer has clearly confirmed the current version as the final result, this embodiment marks the candidate entry as a high-priority version. When the confirmation status slot indicates that some fields still need to be discussed further or alternative expressions need to be retained, this embodiment retains multiple candidate entries generated under different correction paths, and scores and sorts the candidate entries according to the duty officer's preferences recorded in the session history (e.g., preference for brief or detailed descriptions). Multiple log versions available for the monitoring duty officer to select or confirm in the current round are output according to a preset sorting rule, forming a set of candidate monitoring log entries. Through the above processing, this embodiment enables the monitoring duty officer to quickly select log records that conform to the actual scenario and expression habits from multiple version candidates, while retaining the ability to iteratively optimize log content using incremental voice constraints.

[0052] Furthermore, the specific implementation process of step 800 is as follows:

[0053] After obtaining the set of candidate monitoring log entries, this embodiment first selects one or more candidate monitoring log entries corresponding to the current target event based on the semantic context of the updated target event. The log title, occurrence time, device name, event type, and key information from the cause analysis in each selected candidate entry are compressed and refined to generate a summary of the candidate monitoring log entries for voice broadcast. During the summarization process, this embodiment uses preset field priority rules and simplified sentence templates to reduce long sentences and detailed descriptions in the complete log into phrases or short sentences that are easy to understand verbally. This ensures that the monitoring operator can quickly distinguish the differences between multiple candidate versions in the voice channel, while retaining enough key information to support the selection decision.

[0054] This embodiment, based on the generated monitoring log candidate entry summary information, calls the speech synthesis module to convert the summary content into speech broadcast output. Following the one-to-one correspondence between candidate entries and summaries, the complete field content of each monitoring log candidate entry is simultaneously displayed on the visualization interface, forming the monitoring log candidate entry display result. During the speech broadcast, this embodiment can sequentially broadcast the sequence number and summary information of each candidate version, guiding the monitoring operator to provide feedback according to the candidate version number. Simultaneously, the currently broadcast candidate entry is highlighted on the interface, allowing the operator to intuitively compare the field content while listening to the speech broadcast, reducing the difficulty of selection in complex operating conditions or scenarios with multiple concurrent alarms. After listening to the speech broadcast and viewing the display result, the monitoring operator provides feedback via voice. This embodiment performs speech recognition and intent recognition on this voice feedback, focusing on extracting semantic information related to log field supplementation, field revision, version selection, and continued modification needs, constructing an incremental voice command containing field specification, modified content, and operation type.

[0055] This embodiment, based on the field target, update content, and operation type carried by the incremental voice command, and combined with the semantic context of the update target event, performs incremental update operations such as supplementation, modification, or deletion on the corresponding fields of the currently displayed monitoring log candidate entries to obtain the monitoring log candidate entries updated in the current interaction round. Subsequently, when performing intent recognition on the voice feedback, this embodiment determines whether it contains an intent to continue modification: if an intent to continue modification is detected, the monitoring log candidate entries updated in the current interaction round are used as new base entries, the corresponding summary information is regenerated, voice broadcast and interface display are performed again, and the system waits for the next round of incremental voice commands to gradually improve the log content under multi-round voice-driven processes; if the voice feedback no longer contains an intent to continue modification, but contains a clear confirmation or end command, this embodiment fixes the monitoring log candidate entries updated in the current interaction round as the final output of this voice interaction process, as monitoring log entries to be confirmed, providing complete log text that has undergone multiple rounds of manual review for the subsequent final confirmation and log storage stages.

[0056] Furthermore, the specific implementation process of steps 900-1000 is as follows:

[0057] In this embodiment, after the monitoring operator explicitly confirms the monitoring log entry to be confirmed via voice or a visual interface, the entry is archived as the final record of the current monitoring event, generating a final monitoring log entry, which is then written into the monitoring log archive library. Specifically, this embodiment saves structured fields such as log title, occurrence time, end time, device name, device location, event type, cause analysis, and handling measures, as well as the complete text content during archiving. A unique log identifier is assigned to the final monitoring log entry for reference in subsequent retrieval and knowledge base updates. Simultaneously, this embodiment binds the final monitoring log entry to the corresponding monitoring event identifier to ensure that each archived log can find its corresponding basic event information and knowledge-enhanced representation in the monitoring event semantic set, providing a stable association index for subsequent knowledge updates.

[0058] After archiving the final monitoring log entry, this embodiment further aligns and stores the multi-source information corresponding to the entry. Specifically, this includes aligning the monitoring event semantic information related to the event in the monitoring event semantic set, the voice interaction text information collected during multi-round interactions and formed by voice recognition, and the structured fields and complete text content of the final monitoring log entry one by one, using the monitoring event identifier as the primary key. All three types of information are then stored in an alignment repository. Monitoring event semantic information refers to the event-level semantic representation built based on monitoring operation data and domain knowledge, including semantic attributes such as event start and end time, device identifier, event type, context operation mode, maintenance status, and defect records. Voice interaction text information refers to the transcribed text generated by the monitoring operator through voice input during the generation of the final log entry, as well as the log-related intent and slot content parsed from it. The final monitoring log entry information is the structured log result confirmed by the operator. This embodiment, through the above-mentioned aligned storage, enables each newly added log entry to form a complete link of data from the original event semantics to the interaction process and finally to the text record, providing a data foundation for subsequent evaluation of the contribution and reliability of the newly added knowledge entry to the knowledge base in the field of substation monitoring.

[0059] This embodiment defines a comprehensive incremental contribution score for newly added knowledge entries and their corresponding monitoring events, based on the newly aligned and stored logs. This score measures the value and necessity of updating the existing substation monitoring knowledge base. Specifically, this embodiment first extracts the knowledge-enhanced monitoring event representation corresponding to the new event from the knowledge-enhanced monitoring event representation set. This representation is then mapped to an internal semantic encoding vector through a feature transformation module, denoted as the new event semantic code. Simultaneously, it retrieves one or more existing event representations in the current knowledge base that are semantically closest, and obtains their corresponding reference semantic codes through the same feature transformation module, denoted as the knowledge base reference semantic code. This embodiment calculates the difference between the new event semantic code and the knowledge base reference semantic code in the semantic space. This difference is interpreted as the semantic part of the "semantic and statistical difference item," used to measure the degree of similarity or difference between the new event and existing events in the knowledge base in terms of semantic representation. The greater the difference, the more new patterns or combinations the event has semantically, and the higher its value for expanding the knowledge base.

[0060] In terms of statistical characteristics, this embodiment performs frequency and combination statistics on several key fields in the logs based on the aligned and stored final monitoring log entries, constructing a statistical distribution of log fields corresponding to the new monitoring event. This distribution can be understood as the feature distribution of the new event in the statistical space of cause category, handling measure template, event type subclass, and device type combination. Simultaneously, this embodiment retrieves a group of historical event logs of the same or similar type as the new event in the current knowledge base, and aggregates and statistically analyzes the same fields of these events to obtain a reference statistical distribution at the knowledge base level. This embodiment uses the information divergence measurement method to calculate the difference between the log field statistical distribution of the new event and the reference statistical distribution of the knowledge base, using this difference as the statistical part of the semantic and statistical difference item to measure the degree of deviation of the new event from the log field combination pattern. If the deviation is small, it indicates that the event is similar to the typical pattern in the existing knowledge base, and is more likely to be an enhancement or verification of existing knowledge; if the deviation is large, it may indicate that the event has novel features in cause combination, handling path, or device type combination.

[0061] Regarding logical consistency and novelty, this embodiment first extracts the correlation between the monitoring event semantic information, voice interaction text information, and final log entry information corresponding to the new event from the aligned storage results. A comprehensive consistency score is then generated through a rule engine and consistency evaluation module. The comprehensive consistency score is a custom metric defined in this embodiment, used to reflect the degree of consistency of the new log entry in the following aspects: First, whether the event start and end times, alarm levels, and operating methods in the monitoring event semantic information match the time description, event severity, and operating method description recorded in the final log entry; second, whether the supplementary and revision instructions proposed by the duty officer in the multi-round voice interaction text are correctly responded to and reflected in the final log entry; and third, whether the field content of the final log entry conforms to the existing handling procedures and log template specifications in the substation monitoring domain knowledge base. The comprehensive consistency score is typically normalized to between 0 and 1; a higher score indicates greater consistency between the new log and the event facts, interaction process, and domain specifications, and thus higher credibility.

[0062] To measure the innovativeness of new events in the knowledge graph structure and semantic combination, this embodiment defines a custom metric called effective novelty score. The effective novelty score mainly reflects the innovative contributions of new events in the following aspects: First, whether the new event forms a new structural pattern that differs from existing events in terms of device topology paths, alarm chains, or event triggering condition combinations, such as new alarm combinations triggered by the same device under different operating modes; Second, whether the combination of cause analysis and handling measures in the final log entry constitutes a combination that has not yet appeared in the knowledge base or appears with extremely low frequency, and whether this combination is verified as reasonable and effective through consistency scoring; Third, whether the new event introduces new log field values ​​or expands the typical expression of certain fields. The effective novelty score can also be normalized to between 0 and 1, with a higher score indicating that the event provides more new structural or semantic information to the knowledge base.

[0063] This embodiment introduces three weighting coefficients based on the semantic and statistical difference item, overall consistency score, and effective novelty score to balance the influence of different parts in the overall contribution calculation and provide an overall incremental contribution score. The first weighting coefficient balances the semantic and statistical difference item and the logical consistency and novelty item. When this coefficient is close to 1, it emphasizes the differences between the new event and the knowledge base in terms of semantic encoding and statistical distribution; when it is close to 0, it emphasizes the contribution of the new event in terms of logical consistency and novelty. The second weighting coefficient adjusts the relative importance of semantic and statistical differences within the semantic and statistical difference item. For example, in some scenarios, the weight of semantic differences can be increased to highlight the differences in the semantic representation dimension of the new event; in other scenarios, the weight of statistical differences can be increased to focus on changes in the log field distribution pattern. The third weighting coefficient makes a trade-off between the overall consistency score and the effective novelty score. When it is desirable to prioritize the introduction of knowledge with stable quality, the weight of the overall consistency score can be increased; when it is desirable to encourage the discovery of new disposal patterns or novel combination relationships, the weight of the effective novelty score can be increased.

[0064] To avoid ambiguity in the manual, this embodiment further provides examples of the values ​​for the aforementioned weighting coefficients and scoring indicators. In actual deployment, this embodiment can set the balance coefficient between semantic and statistical differences and logical consistency and novelty to 0.5, meaning that the contribution of semantic differences is roughly equivalent to that of consistency plus novelty; the balance coefficient between semantic and statistical differences can be set to 0.7 to emphasize the role of semantic coding differences in the overall score; and the balance coefficient between the comprehensive consistency score and the effective novelty score can be set to 0.6 to ensure reasonable novelty while maintaining knowledge reliability. When the comprehensive incremental contribution score is higher than a preset threshold, such as higher than 0.6, this embodiment will include the corresponding new event and its final log entry in the update scope of the substation monitoring domain knowledge base: on the one hand, the knowledge-enhanced monitoring event representation of the new event is inserted or merged into the knowledge graph, supplementing new relational edges between the corresponding equipment entities, event type entities, and handling measure entities; on the other hand, the typical cause analysis expression, handling step description, and log field value mode in the final monitoring log entry are updated to the log template specification and historical case library, thereby forming an updated substation monitoring domain knowledge base. Through the above specific implementation methods, this embodiment not only achieves selective absorption of new log entries, but also ensures the controllability and transparency of the knowledge base update process in terms of semantic rationality, statistical stability and structural novelty.

[0065] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0066] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for intelligently filling in substation monitoring logs based on knowledge enhancement and voice interaction, characterized in that, include: The system acquires substation monitoring operation data and preprocesses the substation monitoring operation data to obtain preprocessed substation monitoring operation data. The substation monitoring operation data includes: alarm data, telemetry data, operation mode data, maintenance plan data, equipment defect record data, historical monitoring logs, and voice data corresponding to monitoring telephone recordings. The preprocessed substation monitoring operation data is aggregated into monitoring events based on a preset time window and device identifier, and the monitoring events are associated with the corresponding context information to obtain a semantic set of monitoring events. Build a knowledge base for substation monitoring; Based on the substation monitoring domain knowledge base, a corresponding knowledge-enhanced representation is generated for each monitoring event in the monitoring event semantic set to obtain a knowledge-enhanced monitoring event representation set. The system receives voice input from the monitoring duty officer and performs voice recognition to obtain speech-transcribed text. It then performs intent recognition on the speech-transcribed text to obtain log-related intent. Based on the log-related intent, the target event semantic context for updating is determined according to the monitoring event semantic set and the monitoring event semantic set. Based on the knowledge-enhanced monitoring event representation set, candidate entries for monitoring logs are generated, and the fields of the candidate entries for monitoring logs are modified according to the incremental constraints in the semantic context of the updated target event, so as to obtain a set of candidate entries for monitoring logs. Based on the set of candidate monitoring log entries, candidate monitoring log entries are output to the monitoring duty officer via voice broadcast, and the candidate monitoring log entries are supplemented and revised based on multiple rounds of voice interaction to obtain monitoring log entries to be confirmed. Once the monitoring duty officer confirms the monitoring log entry to be confirmed, the monitoring log entry to be confirmed is archived to obtain the final monitoring log entry; The monitoring event semantic information, voice interaction text information, and final monitoring log entry information corresponding to the final monitoring log entry are aligned and stored, and the substation monitoring domain knowledge base is updated based on the alignment and storage results to obtain the updated substation monitoring domain knowledge base.

2. The intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction according to claim 1, characterized in that, The process of acquiring substation monitoring operation data and preprocessing the substation monitoring operation data to obtain preprocessed substation monitoring operation data includes: The alarm data, telemetry data, operation mode data, maintenance plan data, equipment defect record data and historical monitoring log in the substation monitoring operation data set are formatted and fields are completed to ensure that the time field, equipment identification field and event type field of various types of data are semantically consistent, so as to obtain a structured operation data set. The time field in the structured runtime dataset is time-aligned, and the timestamps are normalized according to a preset time granularity to obtain the time-aligned runtime dataset. Speech recognition is performed on the voice data corresponding to the monitoring telephone recordings in the substation monitoring operation data set to obtain the voice-transcribed text of the monitoring telephone, and the voice-transcribed text of the monitoring telephone is associated with timestamp information and device identification information to obtain the monitoring telephone text data set; The time-aligned running data set and the monitoring telephone text data set were merged and processed, and output according to a unified data format to obtain the preprocessed substation monitoring running data.

3. The intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction as described in claim 1, characterized in that, The process involves aggregating the preprocessed substation monitoring operation data into monitoring events based on a preset time window and device identifier, and associating the monitoring events with corresponding context information to obtain a semantic set of monitoring events, including: The preprocessed substation monitoring operation data is divided into time segments according to the preset time window, and alarm data, telemetry data, operation mode data, maintenance plan data, equipment defect record data and monitoring telephone text data that are in the same time window and have the same equipment identifier are initially aggregated to obtain a candidate event data set. Based on preset event triggering rules, the candidate event data set under the same time window and the same device identifier is subjected to event boundary determination and type identification to obtain a single monitoring event. A unique event identifier, event start and end time and event type information are generated for each monitoring event to obtain the basic set of monitoring events. Based on the event identifier and start and end time of the basic set of monitoring events, the operation mode data, maintenance plan data, equipment defect record data and historical monitoring logs related to the current monitoring event are retrieved from the preprocessed substation monitoring operation data. The retrieved relevant data is then used as context information to associate with the corresponding monitoring event to obtain the extended set of monitoring events. Based on the extended set of monitoring events, a structured representation of each monitoring event and its associated context information is obtained, resulting in a semantic set of monitoring events.

4. The intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction according to claim 1, characterized in that, The knowledge base for substation monitoring includes: The system includes the topology of power equipment, monitoring point table, alarm codes and meanings, standard handling procedures, log template specifications, and historical monitoring logs, as well as constraints on power equipment entities, monitoring event type entities, handling measures entities, and log field entities.

5. The intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction according to claim 1, characterized in that, The step involves generating corresponding knowledge-enhanced representations for each monitoring event in the semantic set of monitoring events based on the substation monitoring domain knowledge base, resulting in a knowledge-enhanced monitoring event representation set, including: Based on a knowledge base in the field of substation monitoring, a structured model is constructed to obtain a knowledge graph representation of the substation monitoring field. Based on each monitoring event in the semantic set of monitoring events, knowledge entities and relationships corresponding to the equipment identifier, event type, alarm code and handling process of the monitoring event are retrieved from the knowledge graph representation of the substation monitoring domain to obtain a set of candidate domain knowledge subgraphs; Based on the candidate domain knowledge subgraph set, the candidate domain knowledge subgraph for each monitoring event is filtered and aggregated, and the device information, event type information, handling procedure information and log template constraint information that are closely related to the semantics of the monitoring event are combined to obtain the domain knowledge context set; Based on the domain knowledge context set, the semantic representation of each monitoring event in the monitoring event semantic set is fused with the corresponding domain knowledge context to obtain a knowledge-enhanced monitoring event representation set.

6. The intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction according to claim 1, characterized in that, The log-related intents include: The intentions behind log entry, information supplementation, and log confirmation and modification.

7. The intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction according to claim 1, characterized in that, The step of determining the target event semantic context for updating based on the log-related intent, according to the monitoring event semantic set and the monitoring event semantic set, includes: The speech-to-text is then subjected to intent recognition and slot extraction to obtain log-related intents and corresponding slot information, resulting in a log interaction request carrying intents and slot information. The slot information includes: event location slots, field update slots, and confirmation status slots. Based on the event location slot information, the monitoring events that match the device identifier, time range and event type involved in the speech-to-text are retrieved from the monitoring event semantic set to obtain a candidate target monitoring event set; The candidate target monitoring events are filtered based on the candidate target monitoring event set and the log-related intent. When the log-related intent is the intent to initiate log filling, the monitoring event most closely related to the current voice interaction is determined as the target monitoring event. When the log-related intent is the intent to supplement information or the intent to confirm and modify logs, the monitoring event that best matches the current log interaction context is selected from the candidate target monitoring event set based on the event reference information and time sequence information in the speech-to-text, thus obtaining the target monitoring event. Based on the target monitoring event and the set of knowledge-enhanced monitoring event representations, obtain the knowledge-enhanced monitoring event representation corresponding to the target monitoring event, and combine it with the historical voice interaction information of the current session round to obtain the semantic context of the target event; Based on the incremental constraint information in the field update slot and the confirmation status slot, the event attributes, log field constraints and semantic tags in the target event semantic context are updated to obtain the updated target event semantic context.

8. The intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction according to claim 1, characterized in that, The monitoring log candidate entries are generated based on the knowledge-enhanced monitoring event representation set, and the fields of the monitoring log candidate entries are modified according to the incremental constraints in the semantic context of the updated target event, resulting in a monitoring log candidate entry set, including: Based on the updated target event semantic context and the set of knowledge-enhanced monitoring event representations, a knowledge-enhanced monitoring event representation corresponding to the updated target event semantic context is selected to obtain the target knowledge-enhanced monitoring event representation. Based on target knowledge, the representation of monitoring events is enhanced. Combined with the substation monitoring log template specification, the log fields of log title, occurrence time, end time, equipment name, equipment location, event type, cause analysis and handling measures are automatically generated to obtain initial monitoring log candidate entries. Based on the incremental constraint information in the semantic context of the updated target event, the corresponding fields in the initial monitoring log candidate entries are corrected and supplemented item by item to obtain the monitoring log candidate entries after field correction. Based on the field-corrected candidate entries of the monitoring logs and the confirmation status slot information and session history constraint information in the semantic context of the updated target event, candidate entries of the monitoring logs are determined. Based on the candidate entries of the monitoring logs, multiple log versions available for selection or confirmation by the monitoring duty officer in the current round are output according to the preset sorting rules, thus obtaining a set of candidate entries for the monitoring logs.

9. The intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction according to claim 1, characterized in that, Based on the set of candidate monitoring log entries, candidate monitoring log entries are output to the monitoring duty officer via voice broadcast. These candidate entries are then supplemented and revised through multiple rounds of voice interaction to obtain monitoring log entries to be confirmed, including: Based on the set of candidate monitoring log entries, one or more candidate monitoring log entries corresponding to the semantic context of the target event to be updated are selected, and the key field content of the selected candidate monitoring log entries is summarized to obtain the summary information of the candidate monitoring log entries. Based on the summary information of candidate entries in the monitoring logs, the voice broadcast is given to the monitoring duty officer through speech synthesis, and the corresponding content of the candidate entries in the monitoring logs is displayed on the visualization interface at the same time, so as to obtain the display result of the candidate entries in the monitoring logs. The system receives voice feedback from the monitoring duty officer after listening to the voice broadcast and viewing the display results of candidate entries in the monitoring log. It performs voice recognition and intent recognition on the voice feedback, extracts incremental information related to log supplementation and field revision, and obtains voice incremental instructions. Based on voice incremental commands, the corresponding fields in the display results of monitoring log candidate entries are supplemented, modified or deleted by updating the semantic context of the target event, so as to obtain the monitoring log candidate entries after the current interaction round. If the voice feedback from the monitoring operator indicates an intention to continue modifying the candidate entries of the monitoring log updated in the current interaction round, and if so, the candidate entries are used as the new base entries, and the process returns to continue voice broadcasting and voice feedback. If the voice feedback does not indicate an intention to continue modifying, the candidate entries are used as the final output of this interaction, resulting in the monitoring log entries to be confirmed.

10. The intelligent reporting method for substation monitoring logs based on knowledge enhancement and voice interaction according to claim 1, characterized in that, The expression for the updated substation monitoring knowledge base is: ； in, The overall incremental contribution of the newly added knowledge items will be scored; Vector encoding for knowledge-enhanced monitoring event representations built upon this new event; The vector encoding is used to enhance the representation of the monitoring event by providing the existing knowledge in the current knowledge base that is closest to the new event. This is a feature transformation function for performing nonlinear semantic mapping on the vector representation of monitoring events; Let Euclidean distance be the squared distance between the new event and the closest event in the knowledge base in the semantic space. This is a discrete probability distribution obtained by statistically analyzing the log fields corresponding to the new monitoring events; This is a reference probability distribution obtained by statistically analyzing the set of events of the same or similar type as the new event retrieved from the current knowledge base; The Kullback-Leibler divergence of the probability distribution of new events relative to the knowledge base reference distribution; For overall consistency scoring; The score is given to the effective novelty of new events in the knowledge graph structure or semantic combination. This is a coefficient that balances the weights between semantic and statistical differences and logical consistency and novelty. To control the balance coefficient between the relative importance of the Euclidean distance term and the KL divergence term, This is the weighting factor between the overall consistency score and the effective novelty score.

Images