A data processing method, apparatus, device, medium, and product

Abstract

The application discloses a kind of data processing method, device, equipment, medium and product, involve railway data processing technical field.The method comprises: real-time acquisition railway data and store to time series database;The railway data includes analog data, switch data and event data;According to abnormality judgment threshold, the parameter data of detection equipment is detected in the time series database in real time, and the abnormality detection result of the detection equipment is obtained;According to equipment topological relationship atlas, the abnormality detection result is analyzed in time and space correlation root cause, and the abnormal root cause result is obtained.Through the above technical scheme, the real-time of railway data processing can be improved, and the abnormality and reason can be captured in time.

Description

Technical Field

[0001] This invention relates to the field of railway data processing technology, and in particular to a data processing method, apparatus, equipment, medium, and product. Background Technology

[0002] The Centralized Signal Monitoring System (CSM) is a critical system for ensuring railway traffic safety, responsible for real-time monitoring of the operational status of core equipment such as track circuits, switch machines, signals, and power supply panels. Existing systems face significant challenges in anomaly detection and fault location. Therefore, a data processing method is urgently needed to perform real-time anomaly detection and root cause analysis on railway data. Summary of the Invention

[0003] This invention provides a data processing method, apparatus, equipment, medium, and product to improve the real-time performance of railway data processing and to promptly capture anomalies and their causes.

[0004] According to one aspect of the present invention, a data processing method is provided, the method comprising: Real-time acquisition of railway data and storage in a time-series database; the railway data includes analog data, digital data, and event data. Based on the anomaly judgment threshold, the detection parameter data of the detection device in the time series database is subjected to real-time anomaly detection to obtain the anomaly detection result of the detection device. Based on the equipment topology map, a spatiotemporal correlation root cause analysis was performed on the anomaly detection results to obtain the anomaly root cause results.

[0005] According to another aspect of the present invention, a data processing apparatus is provided, the apparatus comprising: The real-time data acquisition and storage module is used to acquire railway data in real time and store it in a time-series database; the railway data includes analog data, digital data, and event data. Anomaly detection module is used to perform real-time anomaly detection on the detection parameter data of the detection device in the time series database according to the anomaly judgment threshold, and obtain the anomaly detection result of the detection device; The root cause analysis module is used to perform spatiotemporal correlation root cause analysis on the anomaly detection results based on the device topology relationship map to obtain the anomaly root cause results.

[0006] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data processing method according to any embodiment of the present invention.

[0007] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the data processing method described in any embodiment of the present invention.

[0008] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the data processing method according to any embodiment of the present invention.

[0009] The technical solution of this invention involves real-time acquisition of railway data and storage in a time-series database. The railway data includes analog data, digital data, and event data. Based on anomaly detection thresholds, real-time anomaly detection is performed on the detection parameter data of the detection equipment in the time-series database to obtain the anomaly detection results. Spatiotemporal correlation root cause analysis is then performed on the anomaly detection results based on the equipment topology graph to obtain the anomaly root cause results. This technical solution, based on multi-level sliding window parallel computing and an adaptive baseline model, achieves sub-second response and, combined with equipment topology relationships and temporal causal reasoning, enables automatic root cause localization.

[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of a data processing method provided according to an embodiment of the present invention; Figure 2 This is a flowchart of a data processing method provided according to an embodiment of the present invention; Figure 3 This is an architecture diagram of a data processing system provided according to an embodiment of the present invention; Figure 4This is a schematic diagram of the structure of a data processing device according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device that implements the data processing method of the present invention. Detailed Implementation

[0013] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0014] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0015] Furthermore, it should be noted that the collection, storage, use, processing, transmission, provision, and disclosure of detection equipment and railway data and other related data involved in the technical solution of this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0016] Existing solutions, such as the fixed threshold anomaly detection scheme, set fixed upper and lower thresholds for key parameters of each type of equipment. The monitoring system compares the sampled values ​​in real time, and generates an alarm when the limit is exceeded. However, this scheme cannot adapt to dynamic changes: the equipment operating baseline is affected by factors such as ambient temperature, load size, and equipment aging, and the fixed threshold cannot be adjusted adaptively. Actual measurement data shows that track resistance increases by 10-15% during high summer temperatures, and the normal voltage range shifts downward overall, leading to an increase in the false alarm rate; early faults are missed: many faults exhibit "abnormal trends" rather than "threshold exceedances" in their early stages. For example, the operating current of a switch machine rises slowly, and each sample does not exceed the limit, but there is already a potential mechanical jamming hazard; lack of pattern recognition: it cannot identify complex fault modes such as periodic fluctuations, step abrupt changes, and slow drift.

[0017] For example, offline detection solutions based on statistical analysis employ scheduled tasks (e.g., executed hourly) to perform statistical analysis on historical data: calculating the mean μ and standard deviation σ of device parameters, and using the 3σ principle to determine anomalies: |x - μ| > 3σ. However, this solution suffers from poor timeliness: batch processing results in detection delays of 10 minutes to 1 hour, failing to meet real-time early warning requirements; limitations of static models: statistical parameters calculated based on historical full data cannot quickly respond to baseline changes (e.g., in scenarios with sudden load increases); and lack of multidimensional correlation: independent analysis of each device fails to detect correlational anomalies between devices (e.g., multiple devices on the same power supply circuit experiencing simultaneous fluctuations).

[0018] Another example is a machine learning-based fault prediction scheme, which extracts time-series features (such as mean, variance, and peak value) from historical equipment data and trains a classification model (such as random forest or SVM) to predict equipment faults. However, this scheme has high data preparation costs: data needs to be exported from files or databases and feature engineering (missing value handling, normalization, etc.) needs to be performed, and the entire process is time-consuming; model updates are difficult: when new equipment types are added or fault modes change, data needs to be re-labeled and the model needs to be retrained, which is very difficult to engineer; it lacks interpretability: the black-box model cannot provide the cause of the fault, and maintenance personnel cannot understand the basis of the prediction; it does not integrate root cause analysis: it only outputs "a certain device may fail", and cannot answer "why it failed" and "where the source of the fault is".

[0019] For example, existing root cause analysis methods rely on the experience of maintenance personnel, combined with equipment manuals and historical fault cases, to manually analyze alarm information and equipment topology relationships. However, this approach is entirely manual: there are no automated tracing tools, the localization process is time-consuming, and accuracy depends on personnel experience; it lacks decision support: the system has not established equipment dependency models and causal reasoning capabilities, and cannot provide a probability ranking of possible causes; knowledge transfer is difficult: experiential knowledge is hard to accumulate and reuse, and personnel turnover leads to fluctuations in fault handling capabilities.

[0020] Figure 1 This is a flowchart of a data processing method according to an embodiment of the present invention. This embodiment is applicable to the anomaly analysis of data in a centralized railway signal monitoring system. The method can be executed by a data processing device, which can be implemented in hardware and / or software. This device can be configured in an electronic device that carries data processing functions, such as a server. Figure 1 As shown, the method includes: S110: Real-time collection of railway data and storage in a time-series database.

[0021] In this embodiment, railway data refers to data obtained from the centralized railway signal monitoring system. Optionally, railway data includes analog data, digital data, and event data. Analog data refers to continuously changing physical quantities such as voltage, current, power, temperature, and humidity, with a sampling frequency of 1Hz-100Hz. Digital data refers to discrete data such as equipment status (e.g., turnout positioning / reverse position) and relay status. Event data refers to non-periodic sudden events such as equipment alarms, operation records, and fault logs.

[0022] Specifically, railway data is collected in real time from the centralized railway signal monitoring system and stored in a time-series database.

[0023] S120. Based on the anomaly judgment threshold, perform real-time anomaly detection on the detection parameter data of the detection equipment in the time series database to obtain the anomaly detection result of the detection equipment.

[0024] In this embodiment, the anomaly detection results include abnormal events, abnormal equipment, etc. The anomaly judgment threshold is used to determine whether data in the time-series database is abnormal and can be dynamically and adaptively updated. Optionally, the anomaly judgment threshold is determined as follows: For the detection parameters of the detection equipment, the average value of the parameters over a historical set time period is used as the initial baseline; a seasonal adjustment coefficient is determined based on the reference temperature, ambient temperature, and equipment type of the detection equipment; a load adjustment factor is determined based on the equipment's workload, average load, maximum design load, and load influence coefficient; an aging trend function is obtained by linear fitting based on the historical usage data of the detection equipment; the equipment's usage time is substituted into the aging trend function to determine the aging trend; a dynamic baseline is determined based on the initial baseline, seasonal adjustment coefficient, load adjustment factor, and aging trend; and the anomaly judgment threshold for the detection parameters is determined based on the dynamic baseline and the standard deviation of the recent data of the detection equipment.

[0025] Among them, the seasonal adjustment factor refers to the factor that affects the normal operation of railway equipment due to seasonal factors (such as increased track resistance and voltage drop in summer). The load adjustment factor refers to the factor that affects the normal operation of railway equipment due to load factors (such as voltage drop during peak hours and equipment voltage drop). The aging trend is the trend of the normal operation of railway equipment being affected by aging factors (such as the gradual decline in performance parameters as the equipment's service life increases).

[0026] Specifically, for the detection parameters of the testing equipment, such as voltage, the average historical parameter value for the same period over a historical set time period, such as the past N days, is used as the initial baseline. Then, the difference between the ambient temperature and the reference temperature is divided by the reference temperature to obtain the temperature sensitivity. The temperature sensitivity is multiplied by the temperature sensitivity coefficient, and the result is incremented by 1 to obtain the seasonal adjustment factor. The temperature sensitivity coefficient is determined based on the equipment type; for example, the temperature sensitivity coefficient for track circuits is 0.015, and the temperature sensitivity coefficient for switch machines is 0.008. Next, the difference between the equipment workload and the average load is divided by the maximum design load to obtain the load sensitivity. The result is then multiplied by the load influence coefficient. The difference between 1 and the product of the load sensitivity and the load influence coefficient is used as the load adjustment factor. The equipment workload includes, for example, the frequency of turnout operation and the number of track occupancy times. The load influence coefficient can be set based on experience, for example, between 0.05 and 0.10. Linear fitting is performed based on the historical usage data of the testing equipment to obtain the aging trend function, which can be a linear function. The equipment usage time of the testing equipment is substituted into the aging trend function to determine the aging trend. Then, the seasonal adjustment coefficient, load adjustment factor, and aging trend are multiplied together and added to the initial baseline to obtain the dynamic baseline. Based on the dynamic baseline and the standard deviation of recent data from the detection equipment, the anomaly judgment threshold of the detection parameters is determined. The anomaly judgment threshold includes an upper threshold and a lower threshold. Specifically, the upper threshold is obtained by adding the product of the dynamic baseline, the standard deviation, and the adjustable parameter, and the lower threshold is obtained by subtracting the product of the dynamic baseline, the standard deviation, and the adjustable parameter. The adjustable parameter can be adjusted according to the false alarm tolerance, preferably 3.

[0027] It is understandable that, compared to a fixed threshold, this invention updates the anomaly judgment threshold using a baseline, which has strong seasonal adaptability and significantly reduces the false alarm rate; moreover, the baseline update cycle can be performed in real time.

[0028] An optional approach involves performing real-time anomaly detection on data in a time-series database based on anomaly judgment thresholds to obtain anomaly detection results. This includes: performing multi-level sliding window calculations on the corresponding detection parameter data of the detection device in the time-series database to obtain the real-time detection value of the detection device; and judging anomalies in the detection device based on the anomaly judgment thresholds and the real-time detection values ​​to obtain anomaly detection results.

[0029] Specifically, window functions and continuous aggregation in the time-series database are used to perform multi-level sliding window calculations on the corresponding detection parameter data of the testing equipment in the time-series database in parallel. These multi-level sliding windows include second-level, minute-level, and hour-level sliding windows. For example, second-level window sliding calculations can be performed to obtain real-time detection values ​​corresponding to the testing equipment's inspection parameters, such as instantaneous rate of change and peak detection values. For example, minute-level window sliding calculations can also be performed to obtain real-time detection values ​​corresponding to the testing equipment's inspection parameters, such as moving mean, moving standard deviation, and fluctuation coefficient. For example, hour-level window sliding calculations can also be performed to obtain real-time detection values ​​corresponding to the testing equipment's inspection parameters, such as linear trend slope and trend significance.

[0030] Understandably, through multi-level sliding window calculations, second-level window calculations can detect instantaneous changes and spike interference; minute-level window calculations can detect abnormalities in the device's operation process and short-term fluctuations; hour-level window calculations can detect long-term trend anomalies and performance degradation; and multi-level window parallel detection can reduce detection latency and multi-scale coverage avoid missed detections.

[0031] S130. Based on the equipment topology diagram, perform spatiotemporal correlation root cause analysis on the anomaly detection results to obtain the anomaly root cause results.

[0032] In this embodiment, the root cause of an anomaly refers to the root cause of the equipment malfunction. The term "equipment topology relationship" is used to characterize the relationships and influences between equipment.

[0033] Specifically, based on the anomaly detection results, the device chains related to the abnormal device can be found in the device topology graph. Then, based on the root cause analysis model, spatiotemporal correlation root cause analysis is performed on the device chains to obtain the anomaly root cause results. The root cause analysis model can be a neural network model.

[0034] The technical solution of this invention involves real-time acquisition of railway data and storage in a time-series database. The railway data includes analog data, digital data, and event data. Based on anomaly detection thresholds, real-time anomaly detection is performed on the detection parameter data of the detection equipment in the time-series database to obtain the anomaly detection results. Spatiotemporal correlation root cause analysis is then performed on the anomaly detection results based on the equipment topology graph to obtain the anomaly root cause results. This technical solution, based on multi-level sliding window parallel computing and an adaptive baseline model, achieves sub-second response and, combined with equipment topology relationships and temporal causal reasoning, enables automatic root cause localization.

[0035] Figure 2This is a flowchart of a data processing method provided by an embodiment of the present invention; based on the above embodiment, this embodiment further optimizes the step of "performing spatiotemporal correlation root cause analysis on anomaly detection results according to the equipment topology map to obtain anomaly root cause results", providing an optional implementation scheme. For example... Figure 2 As shown, the method includes: S210: Real-time collection of railway data and storage in a time-series database.

[0036] Railway data includes analog data, digital data, and event data; S220. Based on the anomaly judgment threshold, perform real-time anomaly detection on the detection parameter data of the detection equipment in the time series database to obtain the anomaly detection result of the detection equipment.

[0037] S230. Based on the equipment topology diagram, perform spatiotemporal correlation root cause analysis on the anomaly detection results to obtain the anomaly root cause results.

[0038] An optional approach involves performing spatiotemporal correlation root cause analysis on anomaly detection results based on a device topology graph to obtain anomaly root cause results. This includes: clustering the anomaly detection results to obtain anomaly clustering results; performing temporal correlation analysis on the anomaly clustering results to obtain anomaly temporal scores; finding the shortest path between devices in the device dependency directed graph based on the anomaly clustering results to determine topology dependency scores; reconstructing the fault propagation chain based on the anomaly temporal scores and topology dependency scores; and performing Bayesian network probabilistic inference based on the anomaly root causes corresponding to the fault propagation chain to obtain root cause analysis results.

[0039] The device dependency directed graph is constructed based on the electrical connections and signal control logic of devices. For example, the device dependency directed graph G=(V, E) is a set of devices, edge E represents the dependency relationship, and edge weight W represents the dependency factor (0 to 1). The so-called anomaly time series score is used to evaluate the potential correlation of device events. The so-called topological dependency score refers to the degree of device dependency between devices associated with anomalies. The so-called fault propagation chain refers to the device propagation chain formed by a device failure leading to upstream and downstream devices.

[0040] Specifically, firstly, anomalous events in the anomaly detection results are clustered, for example, all anomalous events within the last 10 minutes are clustered to obtain anomaly clustering results. The time interval between event pairs is calculated, and anomaly temporal scores are determined based on empirically established linear equations. Based on the anomalous devices identified in the clustering results, the shortest path to the device is found in the device dependency directed graph, and the topological dependency score is obtained based on the dependency factors on the shortest path. Then, based on the anomaly temporal scores and topological dependency scores, the devices in the shortest path are reconstructed to obtain the fault propagation chain. Finally, a Bayesian network is used to perform probabilistic inference on the root causes of the anomalies corresponding to the fault propagation chain, obtaining the root cause analysis results, namely, the top-ranked root causes and their confidence levels.

[0041] Understandably, root cause analysis and reasoning using device-dependent directed graphs and Bayesian networks can automate source tracing, pinpoint locations in seconds, provide probabilistic decision support, and offer strong interpretability.

[0042] Another optional approach involves performing spatiotemporal correlation root cause analysis on the anomaly detection results based on the device topology map. After obtaining the anomaly root cause results, the approach further includes: acquiring the data health status corresponding to the detection parameter data of the detection device; wherein, the data health status includes analog quantity health status, switch quantity health status, and event quantity health status; dynamically adjusting the health status weights according to the device type and data quality of the detection device to obtain the fusion weights; determining the device health score based on the data health status and the corresponding fusion weights; and determining the target health level based on the correspondence between the health score and the health level.

[0043] Data health refers to the health or safety level of the data used to assess and inspect the parameters.

[0044] Specifically, the health status of the detection parameters from the testing equipment is obtained. Then, the health status weights are dynamically adjusted based on the equipment type and data quality to obtain a fusion weight. The health status of analog quantities, switch quantities, and event quantities are multiplied by their respective fusion weights, and the sum of these results is used as the equipment health score. Finally, based on the correspondence between the health score and the health level, the equipment health score is mapped to a target health level.

[0045] Understandably, by performing multimodal data fusion and equipment health assessment on the equipment, the health level of the equipment can be evaluated in real time, which facilitates equipment maintenance.

[0046] As an optional aspect of the present invention, it further includes: displaying the anomaly detection results and anomaly root cause results through a visual interface.

[0047] Specifically, the results of anomaly detection and the root causes of anomalies can be displayed through a visual interface.

[0048] Understandably, visualizing the results of abnormal detection and the root causes of abnormalities makes it easier to understand the abnormal situation and cause of the equipment.

[0049] The technical solution of this invention involves real-time acquisition of railway data and storage in a time-series database. The railway data includes analog data, digital data, and event data. Based on anomaly detection thresholds, real-time anomaly detection is performed on the detection parameter data of the detection equipment in the time-series database to obtain the anomaly detection results. Spatiotemporal correlation root cause analysis is then performed on the anomaly detection results based on the equipment topology graph to obtain the anomaly root cause results. This technical solution, based on multi-level sliding window parallel computing and an adaptive baseline model, achieves sub-second response and, combined with equipment topology relationships and temporal causal reasoning, enables automatic root cause localization.

[0050] Figure 3 This is an architecture diagram of a data processing system provided according to an embodiment of the present invention; such as Figure 3 As shown, the data processing system includes a data acquisition layer, a time-series data storage layer, a real-time streaming anomaly detection engine, a spatiotemporal correlation root cause analysis engine, and a visualization and decision support layer. Among these, Data acquisition layer: Real-time acquisition of analog, digital, and event data from equipment such as switch machines, track circuits, signals, and power supply panels; Time-series data storage layer: Employs TimescaleDB time-series database, featuring Hypertable automatic partitioning, columnar storage and compression, and high-throughput writing (>50K records / s); Real-time streaming anomaly detection engine: For the detection parameters of the detection equipment, the average value of the parameters over a historical set time period is used as the initial baseline; a seasonal adjustment coefficient is determined based on the reference temperature, ambient temperature, and equipment type; a load adjustment factor is determined based on the equipment's workload, average load, maximum design load, and load influence coefficient; an aging trend function is obtained by linear fitting based on the historical usage data of the detection equipment; the equipment's usage time is substituted into the aging trend function to determine the aging trend; a dynamic baseline is determined based on the initial baseline, seasonal adjustment coefficient, load adjustment factor, and aging trend; and anomaly judgment thresholds for the detection parameters are determined based on the dynamic baseline and the standard deviation of the recent data of the detection equipment. Real-time anomaly detection is performed on the detection parameter data of the detection equipment in the time-series database based on the anomaly judgment thresholds to obtain the anomaly detection results of the detection equipment.

[0051] The spatiotemporal correlation root cause analysis engine performs clustering on anomaly detection results to obtain anomaly clustering results; it performs temporal correlation analysis on the anomaly clustering results to obtain anomaly temporal scores; it searches for the shortest path between devices in the device dependency directed graph based on the anomaly clustering results to determine the topology dependency scores; it reconstructs the fault propagation chain based on the anomaly temporal scores and topology dependency scores; and it performs Bayesian network probabilistic inference based on the anomaly root causes corresponding to the fault propagation chain to obtain root cause analysis results.

[0052] Visualization and Decision Support Layer: Provides real-time alarm dashboards, root cause analysis reports, and device health dashboards.

[0053] Figure 4 This is a schematic diagram of a data processing device according to an embodiment of the present invention. This embodiment is applicable to anomaly analysis of data in a centralized railway signal monitoring system. The data processing device can be implemented in hardware and / or software, and can be configured in an electronic device that carries data processing functions, such as a server. Figure 4 As shown, the device includes: The real-time data acquisition and storage module 410 is used to acquire railway data in real time and store it in a time-series database; the railway data includes analog data, digital data, and event data. The anomaly detection module 420 is used to perform real-time anomaly detection on the detection parameter data of the detection device in the time series database according to the anomaly judgment threshold, and obtain the anomaly detection result of the detection device. The root cause analysis module 430 is used to perform spatiotemporal correlation root cause analysis on the anomaly detection results based on the equipment topology relationship map to obtain the anomaly root cause results.

[0054] The technical solution of this invention involves real-time acquisition of railway data and storage in a time-series database. The railway data includes analog data, digital data, and event data. Based on anomaly detection thresholds, real-time anomaly detection is performed on the detection parameter data of the detection equipment in the time-series database to obtain the anomaly detection results. Spatiotemporal correlation root cause analysis is then performed on the anomaly detection results based on the equipment topology graph to obtain the anomaly root cause results. This technical solution, based on multi-level sliding window parallel computing and an adaptive baseline model, achieves sub-second response and, combined with equipment topology relationships and temporal causal reasoning, enables automatic root cause localization.

[0055] Optionally, the anomaly detection module 420 is used for: Multi-level sliding window calculations are performed on the corresponding detection parameter data of the detection equipment in the time-series database to obtain the real-time detection value of the detection equipment. Anomalies are detected by the detection equipment based on the anomaly judgment threshold and real-time detection values, and anomaly detection results are obtained.

[0056] Optionally, the device further includes a threshold determination module for: For the detection parameters of the detection equipment, the average value of the parameters over a historical set time period is used as the initial baseline; The seasonal adjustment factor is determined based on the reference temperature, ambient temperature, and the type of testing equipment. The load adjustment factor is determined based on the equipment's working load, average load, maximum design load, and load influence coefficient. The aging trend function is obtained by linear fitting based on the historical usage data of the testing equipment. Substitute the equipment usage time of the testing equipment into the aging trend function to determine the aging trend; The dynamic baseline is determined based on the initial baseline, seasonal adjustment factor, load adjustment factor, and aging trend; The anomaly detection threshold for the detection parameters is determined based on the dynamic baseline and the standard deviation of recent data from the detection equipment.

[0057] Optionally, the root cause analysis module 430 is used for: Clustering of anomaly detection results yields anomaly clustering results; Temporal correlation analysis was performed on the abnormal clustering results to obtain abnormal temporal scores; Based on the abnormal clustering results, the shortest path of the device is found from the device dependency directed graph to determine the topology dependency. Reconstruct the fault propagation chain based on the anomaly timing segment and topological dependency segment; Based on the abnormal root causes corresponding to the fault propagation chain, Bayesian network probabilistic inference is performed to obtain the root cause analysis results.

[0058] Optionally, the device also includes a health analysis module for: Based on the equipment topology diagram, a spatiotemporal correlation root cause analysis is performed on the anomaly detection results. After obtaining the anomaly root cause results, the data health of the detection parameters of the detection equipment is obtained. Among them, the data health includes analog quantity health, switch quantity health, and event quantity health. The health score weights are dynamically adjusted based on the type of testing equipment and the quality of the data to obtain the fusion weights. The device health score is determined based on the data health level and the corresponding fusion weight; Based on the correspondence between health score and health level, the target health level is determined according to the equipment health score.

[0059] Optionally, the device also includes a visualization module for: The results of anomaly detection and the root causes of anomalies are displayed through a visual interface.

[0060] The data processing apparatus provided in the embodiments of the present invention can execute the data processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0061] According to embodiments of the present invention, the present invention also provides an electronic device, a readable storage medium, and a computer program product.

[0062] Figure 5 This is a schematic diagram of the structure of an electronic device that implements the data processing method of the present invention. Figure 5 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0063] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0064] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0065] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as data processing methods.

[0066] In some embodiments, the data processing method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the data processing method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the data processing method by any other suitable means (e.g., by means of firmware).

[0067] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0068] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0069] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0070] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0071] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0072] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0073] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0074] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data processing method, characterized in that, include: Real-time acquisition of railway data and storage in a time-series database; the railway data includes analog data, digital data, and event data. Based on the anomaly judgment threshold, the detection parameter data of the detection device in the time series database is subjected to real-time anomaly detection to obtain the anomaly detection result of the detection device. Based on the equipment topology map, a spatiotemporal correlation root cause analysis was performed on the anomaly detection results to obtain the anomaly root cause results.

2. The method according to claim 1, characterized in that, Real-time anomaly detection is performed on the data in the time-series database based on anomaly judgment thresholds to obtain anomaly detection results, including: The real-time detection value of the detection device is obtained by performing multi-level sliding window calculations on the corresponding detection parameter data of the detection device in the time series database. The detection device is subjected to anomaly detection based on the anomaly judgment threshold and the real-time detection value to obtain anomaly detection results.

3. The method according to claim 1 or 2, characterized in that, The anomaly detection threshold is determined in the following manner: For the detection parameters of the detection equipment, the average value of the parameters over a historical set time period is used as the initial baseline; The seasonal adjustment factor is determined based on the reference temperature, ambient temperature, and the type of the detection equipment. The load adjustment factor is determined based on the equipment's working load, average load, maximum design load, and load influence coefficient. A linear fit is performed based on the historical usage data of the testing equipment to obtain the aging trend function; The aging trend is determined by substituting the device usage time of the detection equipment into the aging trend function. A dynamic baseline is determined based on the initial baseline, the seasonal adjustment coefficient, the load adjustment factor, and the aging trend; The anomaly detection threshold for the detection parameter is determined based on the dynamic baseline and the standard deviation of recent data from the detection device.

4. The method according to claim 1, characterized in that, Based on the equipment topology map, a spatiotemporal correlation root cause analysis is performed on the anomaly detection results to obtain the anomaly root cause results, including: The anomaly detection results are clustered to obtain anomaly clustering results; Temporal correlation analysis is performed on the abnormal clustering results to obtain abnormal temporal scores; Based on the abnormal clustering results, the shortest path of the device is found from the device dependency directed graph to determine the topology dependency. Reconstruct the fault propagation chain based on the abnormal temporal sequence and the topological dependency; Based on the abnormal root causes corresponding to the fault propagation chain, Bayesian network probabilistic inference is performed to obtain the root cause analysis results.

5. The method according to claim 1, characterized in that, After performing spatiotemporal correlation root cause analysis on the anomaly detection results based on the equipment topology map to obtain the anomaly root cause results, the analysis further includes: Obtain the data health status corresponding to the detection parameter data of the detection device; wherein, the data health status includes analog quantity health status, switch quantity health status, and event quantity health status; The health weights are dynamically adjusted based on the equipment type and data quality of the detection equipment to obtain the fusion weights. The device health score is determined based on the data health level and the corresponding fusion weight; Based on the correspondence between health score and health level, the target health level is determined according to the device health score.

6. The method according to claim 1, characterized in that, Also includes: The anomaly detection results and the root cause results are displayed through a visual interface.

7. A data processing apparatus, characterized in that, include: The real-time data acquisition and storage module is used to acquire railway data in real time and store it in a time-series database; the railway data includes analog data, digital data, and event data. Anomaly detection module is used to perform real-time anomaly detection on the detection parameter data of the detection device in the time series database according to the anomaly judgment threshold, and obtain the anomaly detection result of the detection device; The root cause analysis module is used to perform spatiotemporal correlation root cause analysis on the anomaly detection results based on the device topology relationship map to obtain the anomaly root cause results.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data processing method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the data processing method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the data processing method according to any one of claims 1-6.

Images