Power safety log anomaly detection method and system

Abstract

This invention provides a method and system for detecting anomalies in power safety logs. First, it acquires multi-source heterogeneous raw log data from the power safety field, and after preprocessing and standardization, constructs a log dataset adapted to this scenario. Second, based on this dataset, it builds a large language model log analysis framework using a dual-model collaborative architecture (including a semantic extractor, a vector space aligner, and a large model discriminant analyzer). Next, it employs a three-stage adjustment strategy to collaboratively train each component of the framework, and, combined with the aforementioned log dataset, adapts the framework to various industrial control protocols in the power safety scenario. Finally, it collects real-time log data to be analyzed, completes preprocessing and standardization, inputs it into the trained framework, and uses multi-step reasoning with chain reasoning technology to output detection results, simultaneously locating the anomaly and explaining its cause.

Description

Technical Field

[0001] This invention relates to the field of power safety detection technology, specifically to a method and system for detecting anomalies in power safety logs, and more particularly to a log analysis method in the power field based on thinking chain technology. Background Technology

[0002] In the field of power system safety operation and maintenance, log data serves as a core basis for reflecting system operating status and identifying potential safety hazards. It often exhibits multi-source heterogeneous characteristics and encompasses information related to various industrial control protocols. Its accuracy and anomaly detection efficiency directly affect the stable operation of the power system. Currently, traditional log anomaly detection methods largely rely on manual analysis or simple rule matching, resulting in low detection accuracy, poor adaptability, and an inability to accurately locate anomalies or explain their causes. These methods fail to meet the high-efficiency and accurate detection requirements of multi-source heterogeneous logs in power safety scenarios and cannot effectively address the log analysis challenges posed by various industrial control protocols. Therefore, a technical solution that can adapt to power safety scenarios and improve log anomaly detection performance is urgently needed to overcome the shortcomings of existing technologies.

[0003] The paper titled "LogLLM: Log-based Anomaly Detection Using Large Language Models" (Guan W, Cao J, Qian S, et al. LogLLM: Log-based Anomaly Detection Using Large Language Models[J]. 2024.) proposes the LogLLM framework, a log anomaly detection scheme based on large language models (LLMs). Its core lies in constructing a collaborative architecture of "semantic extraction-spatial alignment-sequence classification" and simplifying the preprocessing process. However, the technology in this paper lacks adaptability to the power industry. It primarily targets general system logs and lacks prior knowledge and processing capabilities for power control protocols and power-specific attack patterns. Furthermore, the technology suffers from insufficient interpretability. Although it uses large language models, the output is merely a "normal / abnormal" label, lacking a reasoning and explanation mechanism that incorporates thought processes, thus failing to fully leverage the powerful advantages of large language models and failing to meet interpretability requirements. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the purpose of this invention is to provide a method and system for detecting anomalies in power safety logs.

[0005] A method for detecting anomalies in power safety logs according to the present invention includes the following steps: Step S1: Obtain multi-source heterogeneous raw log data in the field of power safety, preprocess and standardize the raw log data, and construct a log dataset adapted to the power safety scenario; Step S2: Based on the log dataset constructed in Step S1, build a log analysis framework based on a large language model; the log analysis framework adopts a dual-model collaborative architecture, including a semantic extractor, a vector space aligner, and a large model discriminant analyzer; Step S3: For the log analysis framework built in step S2, a three-stage adjustment strategy is adopted to collaboratively train the semantic extractor, the vector space aligner and the large model discriminant analyzer. Combined with the log data in the log dataset built in step S1, the entire log analysis framework is adapted to various industrial control protocols in the power safety scenario. Step S4: Collect real-time log data of the power system to be analyzed, preprocess and standardize the real-time log data, and then input it into the log analysis framework trained in Step S3. Combine the thinking chain reasoning technology to perform multi-step reasoning, output the log anomaly detection results, locate the specific location of the anomaly, and explain the specific cause of the anomaly.

[0006] Preferably, step S1 specifically includes the following steps: Step S1.1: Obtain general system logs from the Loghub open-source repository, and simultaneously collect power security log data as multi-source raw log data for power security; the power security log data includes smart grid network physical attack datasets, traffic monitoring data according to the IEC 60870-104 protocol, and traffic monitoring data according to the IEC 61850 protocol; Step S1.2: Clean and denoise the multi-source raw log data collected in step S1.1, remove invalid data, redundant data and abnormal interference data, and extract the key core fields in each log, including timestamp, device IP and operation instructions. Step S1.3: Perform unified structured parsing on the log data processed in step S1.2, and convert each line of log data into a unified JSON standard format; Step S1.4: Based on the structured JSON log data obtained in step S1.3, a sliding window mechanism is used to set a fixed window size and concatenate and integrate single structured logs according to window rules, transforming them into long log sequences containing contextual information, and finally generating a standardized, labeled log dataset adapted to power safety scenarios.

[0007] Preferably, step S2 specifically includes the following steps: Step S2.1: Set the BERT model as the semantic extractor of the log analysis framework, replacing the word segmenter and embedding layer of the large language model Qwen3-Coder; the BERT model is responsible for receiving the log data in the log dataset constructed in step S1 and converting each log into a semantic vector that can be used for subsequent analysis. Step S2.2: Construct a vector space aligner and integrate the constructed vector space aligner between the semantic extractor and the Qwen3-Coder model in step S2.1; the vector space aligner is responsible for aligning the vector spaces of the BERT model and the Qwen3-Coder model, and mapping the semantic vectors output by the BERT model in step S2.1 to make them fit the vector space specifications of the Qwen3-Coder model; Step S2.3: Use the Qwen3-Coder model from step S2.1 as the large model discriminant analyzer of the log analysis framework to obtain a log analysis framework with a dual-model collaborative architecture; the large model discriminant analyzer is responsible for receiving the semantic vector processed by the vector space aligner in step S2.2, concatenating the preset prompt words with the semantic vector, and guiding the Qwen3-Coder model to focus on the power safety log anomaly detection task through the prompt words.

[0008] Preferably, step S3 specifically includes the following steps: Step S3.1: Based on the log dataset constructed in Step S1 and the log analysis framework built in Step S2, freeze the parameters of the semantic extractor and the vector space aligner, and only train and adjust the large model discriminant analyzer to guide it to adapt to the preset "anomaly detection question and answer" output template in the power safety log anomaly detection scenario. Step S3.2: Based on the completion of step S3.1, freeze the parameters of the adjusted large model discriminant analyzer, train and adjust the vector space aligner and semantic extractor, optimize the collaborative performance between the two, so that the vector space aligner can align the semantic vector output by the semantic extractor with the vector space of the Qwen3-Coder model; Step S3.3: Integrate the adjustment results of steps S3.1 and S3.2, and perform a full-model joint adjustment on the semantic extractor, vector space aligner and large model discriminant analyzer. Combine the industrial control protocol log data in the log dataset of step S1 to improve the log classification accuracy of the log analysis framework, optimize the log analysis framework's ability to judge abnormal situations in power log sequences, and realize the adaptation of the log analysis framework to power safety industrial control protocol scenarios.

[0009] Preferably, step S4 specifically includes the following steps: Step S4.1: Collect real-time log data to be analyzed in the power system, and the collected log data covers various industrial control equipment and protocol-related logs in power safety scenarios, and is compatible with the log data types collected in step S1. Step S4.2: Load the full model after the three-stage adjustment in step S3. After preprocessing and standardization, input the log data to be analyzed collected in step S4.1 into the log analysis framework and start the log analysis process. Step S4.3: Construct a thought chain prompt template for power safety log analysis, adapting the thought chain prompt template to the output standard of the adjusted Qwen3-Coder model in Step S3 and the power safety log anomaly detection standard. Embed the thought chain prompt template into the log analysis framework of Step S4.2, guiding the Qwen3-Coder model to perform multi-step reasoning based on the semantic features of the log to be analyzed, and outputting a result of "normal / abnormal + natural language explanation". The natural language explanation can clearly identify the specific location and corresponding cause of the anomaly.

[0010] This invention also provides a power safety log anomaly detection system, comprising the following modules: Module M1: Acquires multi-source heterogeneous raw log data in the field of power safety, performs preprocessing and standardization on the raw log data, and constructs a log dataset adapted to power safety scenarios; Module M2: Based on the log dataset built in Module M1, a log analysis framework based on a large language model is constructed. The log analysis framework adopts a dual-model collaborative architecture, including a semantic extractor, a vector space aligner, and a large model discriminant analyzer. Module M3: For the log analysis framework built in Module M2, a three-stage adjustment strategy is adopted to collaboratively train the semantic extractor, the vector space aligner and the large model discriminant analyzer. Combined with the log data in the log dataset built in Module M1, the entire log analysis framework is adapted to various industrial control protocols in the power safety scenario. Module M4: Collects real-time log data to be analyzed from the power system, performs preprocessing and standardization on the real-time log data, and then inputs it into the log analysis framework trained by Module M3. Combined with the thinking chain reasoning technology, it performs multi-step reasoning, outputs log anomaly detection results, locates the specific location of the anomaly, and explains the specific cause of the anomaly.

[0011] Preferably, module M1 specifically includes the following modules: Module M1.1: Acquires general system logs from the Loghub open-source repository, and simultaneously collects power security log data as multi-source raw log data for power security; the power security log data includes smart grid network physical attack datasets, traffic monitoring data of the IEC 60870-104 protocol, and traffic monitoring data of the IEC 61850 protocol; Module M1.2: Cleans and denoises the multi-source raw log data collected by module M1.1, removing invalid data, redundant data, and abnormal interference data, and extracts the key core fields from each log, including timestamp, device IP, and operation instructions; Module M1.3: Performs unified structured parsing on the log data processed by module M1.2, converting each line of log data into a unified JSON standard format; Module M1.4: Based on the structured JSON log data obtained from Module M1.3, it adopts a sliding window mechanism, sets a fixed window size, and concatenates and integrates individual structured logs according to window rules to transform them into long log sequences containing contextual information, ultimately generating a standardized, labeled log dataset adapted to power safety scenarios.

[0012] Preferably, module M2 specifically includes the following modules: Module M2.1: Sets the BERT model as the semantic extractor of the log analysis framework, replacing the word segmenter and embedding layer of the large language model Qwen3-Coder; the BERT model is responsible for receiving log data from the log dataset constructed by module M1 and converting each log into a semantic vector that can be used for subsequent analysis; Module M2.2: Constructs a vector space aligner, which is then integrated between the semantic extractor in Module M2.1 and the Qwen3-Coder model. The vector space aligner is responsible for aligning the vector spaces of the BERT model and the Qwen3-Coder model, and mapping the semantic vectors output by the BERT model in Module M2.1 to fit the vector space specifications of the Qwen3-Coder model. Module M2.3: The Qwen3-Coder model in Module M2.1 is used as the large model discriminant analyzer of the log analysis framework to obtain a log analysis framework with a dual-model collaborative architecture. The large model discriminant analyzer is responsible for receiving the semantic vector processed by the vector space aligner in Module M2.2, concatenating the preset prompt words with the semantic vector, and guiding the Qwen3-Coder model to focus on the power safety log anomaly detection task through the prompt words.

[0013] Preferably, module M3 specifically includes the following modules: Module M3.1: Based on the log dataset built by Module M1 and the log analysis framework built by Module M2, the parameters of the semantic extractor and vector space aligner are frozen, and only the large model discriminant analyzer is trained and adjusted to guide it to adapt to the preset "anomaly detection question and answer" output template in the power safety log anomaly detection scenario; Module M3.2: Based on the completion of Module M3.1, freeze the parameters of the adjusted large model discriminant analyzer, train and adjust the vector space aligner and semantic extractor, optimize the collaborative performance between the two, so that the vector space aligner can align the semantic vectors output by the semantic extractor with the vector space of the Qwen3-Coder model; Module M3.3 integrates the adjustments made to Modules M3.1 and M3.2, performs joint adjustments to the semantic extractor, vector space aligner, and large model discriminant analyzer, and combines the industrial control protocol log data in the log dataset of Module M1 to improve the log classification accuracy of the log analysis framework, optimize the log analysis framework's ability to judge abnormal situations in power log sequences, and achieve the adaptation of the log analysis framework to power safety industrial control protocol scenarios.

[0014] Preferably, module M4 specifically includes the following modules: Module M4.1: Collects real-time log data to be analyzed in the power system, and the collected log data covers various industrial control equipment and protocol-related logs in power safety scenarios, and is compatible with the log data types collected in Module M1. Module M4.2: Loads the full model after the three-stage adjustment in module M3, and inputs the log data to be analyzed collected by module M4.1 into the log analysis framework after preprocessing and standardization, and starts the log analysis process; Module M4.3: Constructs a thought chain prompt template for power safety log analysis, adapting the thought chain prompt template to the output standards of the adjusted Qwen3-Coder model in Module M3 and the power safety log anomaly detection standards. The thought chain prompt template is embedded into the log analysis framework of Module M4.2, guiding the Qwen3-Coder model to perform multi-step reasoning based on the semantic features of the log to be analyzed, and outputting a result of "normal / abnormal + natural language explanation". The natural language explanation can clearly identify the specific location and corresponding cause of the anomaly.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention employs a structured multi-source heterogeneous log dataset construction method to uniformly clean, denoise, and structure general system logs and power industrial control protocol data. This solves the problem of diverse log data sources, heterogeneous field definitions, and data formats in power safety scenarios, which makes it difficult to adapt to the same log analysis framework. It achieves the effect of transforming complex heterogeneous power data into a unified standard format, providing a high-quality, standardized domain data foundation for fine-tuning large models and effectively improving the model's ability to process power-specific protocols.

[0016] 2. This invention uses the BERT model instead of the word segmenter and embedding layer of a large language model as a semantic extractor to transform each log into a semantic vector structure. This solves the problem of insufficient GPU memory when fine-tuning the model using long log sequence datasets, achieving the effect of saving computing resources and successfully processing power safety log sequences with longer contexts and more fields.

[0017] 3. This invention adopts Qwen3-Coder, a vertical model that performs better in code processing and logical reasoning, as the base of the large model discriminant analyzer (replacing the LLaMA general large language model in the original LogLLM architecture). By leveraging its keen perception of log data, i.e. code-like text, it solves the problem of insufficient understanding ability of the general large language model when processing data-driven, non-natural language structured log data, thus achieving the effect of improving the accuracy of log anomaly detection.

[0018] 4. This invention employs the Chain of Reasoning (CoT) technique to guide the model's output of analysis and interpretation of detection results. This solves the problem that traditional deep learning log analysis frameworks can only output discrimination labels and lack logical display and interpretability of decisions. The framework can locate and analyze abnormal states and ultimately output "normal / abnormal + natural language explanation", thus enhancing the transparency and interpretability of the power safety log analysis framework. Attached Figure Description

[0019] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a schematic diagram illustrating the principle of an anomaly detection method for power safety logs. Detailed Implementation

[0020] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0021] Example 1 like Figure 1 As shown, this embodiment provides a method for detecting anomalies in power safety logs, aiming to solve the problems of insufficient adaptability and lack of interpretability of existing log anomaly detection technologies in the power field, and to achieve accurate detection, location, and cause interpretation of log anomalies in power safety scenarios. Specifically, it includes the following steps: Step S1: Construct a log dataset adapted to power safety scenarios.

[0022] Step S1 is used to acquire multi-source heterogeneous raw log data in the field of power safety, and through preprocessing and standardization, form a log dataset that meets the needs of model training and detection, specifically including: Multi-source log data collection: In step S1.1, on the one hand, general system logs (such as public log datasets such as HDFS and BGL) in the Loghub open-source repository are obtained as basic comparison data; on the other hand, power security-specific log data is collected in a targeted manner. The power security log data includes attack log datasets generated by simulation of physical attacks on smart grid networks, power remote control equipment flow monitoring logs based on the IEC60870-104 protocol, and substation automation system flow monitoring logs based on the IEC61850 protocol. It also covers power SCADA system operation logs, smart meter collection logs, and other power scenario-specific related logs, forming a multi-source raw log data set covering general scenarios and power-specific scenarios.

[0023] Log data cleaning and core field extraction: In step S1.2, data quality verification rules are used to clean and denoise the multi-source raw log data. Specifically, invalid data with format errors and field missing rates exceeding 30% are removed, redundant data with duplicate records are merged, and meaningless abnormal interference data caused by temporary equipment failures are filtered out. At the same time, based on regular expressions and keyword matching algorithms, key core fields in each log are extracted. In addition to timestamps, device IPs, and operation instructions, these key core fields also include key information specific to the power scenario, such as protocol type, device model, data transmission status, operation permission level, and message identifier, providing a foundation for subsequent structured processing.

[0024] Unified Structured Parsing: In step S1.3, for the cleaned data, a combination of protocol parser and general log parsing rules is used to perform unified structured parsing. For power-specific protocol logs such as IEC60870-104 and IEC61850, the meaning of parsed fields is defined based on the protocol frame format. For general system logs, power scenario-related fields are supplemented according to preset field mapping rules. Finally, each line of log data is converted into a clear key-value pair JSON standard format to ensure data structure uniformity. The JSON format fields must at least include "timestamp-device IP-device model-protocol type-operation instruction-data transmission status-operation permission level-original log content".

[0025] Log sequence construction and dataset labeling: In step S1.4, based on structured JSON log data, a sliding window mechanism is used to construct the log sequence. The window size is adaptively set according to the power system log generation frequency (preferably 5-20 logs per window and 1-5 logs per sliding step). Single structured logs within a continuous time window are concatenated and integrated in chronological order to form a long log sequence containing contextual information. Subsequently, power safety operation and maintenance experts, in conjunction with power industrial control protocol specifications and common attack characteristics, label the log sequence as "normal / abnormal". Abnormal labeling must clearly define the type of abnormality (such as protocol violation attack, data tampering, unauthorized operation, equipment failure warning, etc.). Finally, a standardized log dataset with accurate labeling adapted to power safety scenarios is generated. The dataset is divided into training set, validation set, and test set in a 7:2:1 ratio.

[0026] Step S2: Build a dual-collaborative log analysis framework based on a large language model.

[0027] Step S2, based on the log dataset constructed in Step S1, establishes a dual-model collaborative log analysis framework adapted to the power scenario. Through the collaborative operation of semantic extraction, vector alignment, and discriminant analysis, it improves log semantic understanding and anomaly detection capabilities, specifically including: Semantic extractor configuration: In step S2.1, the pre-trained BERT-base-uncased model is selected as the semantic extractor of the log analysis framework to replace the word segmenter and embedding layer of the large language model Qwen3-Coder. After being fine-tuned by the power log corpus, the BERT model is responsible for receiving the log sequences in the log dataset constructed in step S1. It captures the semantic features of a single log and the contextual association between logs through a multi-layer Transformer encoder, and transforms each log and log sequence into a high-dimensional semantic vector. The semantic vector dimension is set to 768 dimensions to adapt to the subsequent vector space alignment requirements.

[0028] Vector Space Aligner Construction and Integration: In step S2.2, a vector space aligner based on a fully connected neural network is constructed. This aligner includes an input layer, two hidden layers (each with 1024 and 768 neurons respectively), and an output layer. The activation function is ReLU, and the dimension of the output layer is consistent with the dimension of the input vector of the Qwen3-Coder model (set to 2048 dimensions). This vector space aligner is integrated between the semantic extractor and the Qwen3-Coder model. Its core function is to transform the 768-dimensional semantic vector output by the BERT model into a 2048-dimensional vector that is compatible with the Qwen3-Coder model through linear transformation and nonlinear mapping, thereby eliminating the vector space difference between the two models and ensuring the coherent transmission of semantic information.

[0029] Large Model Discriminant Analyzer Configuration: In step S2.3, the Qwen3-Coder-30B-A3B-Instruct model is selected as the large model discriminant analyzer for the log analysis framework. Together with the semantic extractor and vector space aligner, it forms a dual-model collaborative architecture. The large model discriminant analyzer is pre-loaded with a knowledge base in the field of power safety (including industrial control protocol specifications, common attack characteristics, fault handling cases, etc.). It is responsible for receiving the semantic vector after processing by the vector space aligner, and concatenating the preset prompt words with the semantic vector. The preset prompt words need to clearly guide the model to focus on the power safety log anomaly detection task, such as "Based on the power industrial control protocol specifications and log semantic features, determine whether the log sequence is abnormal. If it is abnormal, please preliminarily identify the anomaly type."

[0030] Step S3: Three-stage collaborative training to optimize framework adaptability.

[0031] Step S3 involves a three-stage adjustment strategy for collaborative training of the log analysis framework built in Step S2. This ensures the framework is fully adaptable to various industrial control protocols and anomaly modes in power safety scenarios. Specifically, this includes: Phase 1: Adaptation Training of the Large Model Discriminant Analyzer: In step S3.1, based on the training and validation sets divided in step S1, the parameters of the semantic extractor (BERT model) and vector space aligner are frozen, and only the large model discriminant analyzer (Qwen3-Coder model) is trained and adjusted. During the training process, the cross-entropy loss function is used, the learning rate is set to 2e-5, and the training rounds are 3-5. The core objective is to guide the Qwen3-Coder model to adapt to the preset "anomaly detection question and answer" output template in the power safety log anomaly detection scenario. This template must clearly define the output format as "detection result (normal / abnormal) + preliminary anomaly type" to ensure the standardization of the model output.

[0032] Phase 2: Co-training of Semantic Extractor and Aligner: In step S3.2, the parameters of the large model discriminant analyzer adjusted in step S3.1 are frozen, and the vector space aligner and semantic extractor are jointly trained. During the training process, a combination of contrastive learning loss function and mean squared error loss function is adopted, with the learning rate set to 1e-5 and the training rounds being 5-8. By optimizing the parameters of both, the accuracy of semantic vector extraction and the adaptability of vector space alignment are improved, ensuring that the semantic features of the power log extracted by the BERT model can be effectively recognized by the Qwen3-Coder model.

[0033] Phase 3: Joint Fine-tuning and Optimization of the Entire Model: In step S3.3, the parameter freeze state of all model components is lifted. Based on the industrial control protocol log data in the dataset from step S1 (mainly including logs related to IEC60870-104 and IEC61850 protocols), the semantic extractor, vector space aligner, and large model discriminant analyzer are jointly adjusted. During training, a mixed precision training strategy is adopted, with a learning rate set to 5e-6 and 8-12 training rounds. At the same time, a power scenario-specific loss function (such as weighted cross-entropy loss based on anomaly type weights) is introduced to optimize the model's ability to identify power-specific anomaly patterns (such as protocol message violations, illegal equipment access, data tampering attacks, etc.). Ultimately, the log analysis framework is deeply adapted to the power safety industrial control protocol scenario, ensuring that the model's anomaly detection F1 value on the validation set is not lower than 0.95.

[0034] Step S4: Real-time log anomaly detection and interpretable output.

[0035] Step S4 is used to detect anomalies in the real-time logs of the power system. It combines thought chain reasoning technology to achieve multi-step reasoning and outputs detection results including location and cause explanations. Specifically, it includes: Real-time log data acquisition: In step S4.1, log data to be analyzed in the power system is collected in real time through devices such as power system log acquisition gateway and protocol analyzer. The acquisition scope covers various industrial control equipment such as substation automation system, SCADA system, smart meter, and remote control equipment, as well as logs related to mainstream power industrial control protocols such as IEC60870-104 and IEC61850. The acquisition frequency is synchronized with the log generation frequency (preferably the acquisition delay does not exceed 1 second) to ensure that the data type is consistent with the log data type collected in step S1 and to ensure detection compatibility.

[0036] Real-time log preprocessing and framework loading: In step S4.2, the collected real-time log data undergoes the same preprocessing and standardization processes as in steps S1.2-S1.4—data cleaning, core field extraction, JSON structured parsing, and sliding window sequence construction are completed sequentially; at the same time, the full model (including semantic extractor, vector space aligner, and large model discriminant analyzer) after the three-stage adjustment in step S3 is loaded, and the preprocessed real-time log sequence is input into the log analysis framework to start the log analysis process, with the analysis delay controlled within 5 seconds.

[0037] Interpretable output guided by the thought chain: In step S4.3, a thought chain prompt template for power safety log analysis is constructed. This template needs to contain multi-step reasoning guidance logic, such as "Step 1: Analyze whether the protocol type and operation instructions in the log sequence comply with the IEC60870-104 / IEC61850 protocol specifications; Step 2: Determine whether the device IP belongs to the authorized access range and whether the operation permission level matches; Step 3: Combine the context log to locate the specific log entry where the anomaly occurred and the corresponding device; Step 4: Based on the power safety knowledge base, explain the cause of the anomaly (such as illegal access, protocol attack, equipment failure, etc.)". This thought chain prompt template is embedded in the log analysis framework to guide the Qwen3-Coder model to perform multi-step reasoning based on the semantic features of real-time logs, and finally output a structured result of "normal / abnormal + anomaly location + cause explanation". The anomaly location needs to be specified to the specific device IP, log timestamp and log entry. The cause explanation needs to be clearly explained in natural language in combination with power industrial control protocol specifications and common anomaly patterns to ensure that power safety operation and maintenance personnel can quickly understand and take countermeasures.

[0038] The method in this embodiment significantly improves the adaptability and practicality of log anomaly detection in the power sector by constructing a power-specific dataset, building a dual-model collaborative architecture, conducting three-stage targeted training, and designing an interpretable thought chain. It can effectively address the analysis needs of multi-source heterogeneous logs in the power system and provide accurate and efficient technical support for power safety operation and maintenance.

[0039] The present invention also provides a power safety log anomaly detection system, which can be implemented by executing the process steps of the power safety log anomaly detection method. That is, those skilled in the art can understand the power safety log anomaly detection method as a preferred embodiment of the power safety log anomaly detection system.

[0040] Example 2 like Figure 1As shown, this embodiment provides a power safety log anomaly detection system, aiming to solve the problems of insufficient adaptability and lack of interpretability of existing log anomaly detection technologies in the power field, and to achieve accurate detection, location, and cause interpretation of log anomalies in power safety scenarios. Specifically, it includes the following modules: Module M1: Constructs a log dataset adapted to power safety scenarios.

[0041] Module M1 is used to acquire multi-source heterogeneous raw log data in the field of power safety, and through preprocessing and standardization, form a log dataset that meets the needs of model training and detection, specifically including: Multi-source log data acquisition: In module M1.1, on the one hand, it acquires general system logs (such as public log datasets like HDFS and BGL) from the Loghub open-source repository as basic comparison data; on the other hand, it specifically collects power security-specific log data. The power security log data includes attack log datasets generated by simulation of physical attacks on smart grid networks, power remote control equipment flow monitoring logs based on the IEC60870-104 protocol, and substation automation system flow monitoring logs based on the IEC61850 protocol. It also covers power SCADA system operation logs, smart meter collection logs, and other power scenario-specific related logs, forming a multi-source raw log data set covering general scenarios and power-specific scenarios.

[0042] Log data cleaning and core field extraction: In module M1.2, data quality verification rules are used to clean and denoise multi-source raw log data. Specifically, invalid data with format errors and a field missing rate exceeding 30% is removed, redundant data with duplicate records is merged, and meaningless abnormal interference data caused by temporary equipment failures is filtered out. At the same time, based on regular expressions and keyword matching algorithms, key core fields in each log are extracted. In addition to timestamps, device IPs, and operation instructions, these key core fields also include key information specific to the power scenario, such as protocol type, device model, data transmission status, operation permission level, and message identifier, providing a foundation for subsequent structured processing.

[0043] Unified Structured Parsing: In module M1.3, for the cleaned data, a combination of protocol parser and general log parsing rules is used for unified structured parsing. For power-specific protocol logs such as IEC60870-104 and IEC61850, the meaning of parsed fields is defined based on the protocol frame format. For general system logs, power scenario-related fields are supplemented according to preset field mapping rules. Finally, each line of log data is converted into a clear key-value pair JSON standard format to ensure data structure uniformity. The JSON format fields must at least include "timestamp-device IP-device model-protocol type-operation instruction-data transmission status-operation permission level-original log content".

[0044] Log Sequence Construction and Dataset Labeling: In module M1.4, a sliding window mechanism is used to construct log sequences based on structured JSON log data. The window size is adaptively set according to the frequency of power system log generation (preferably 5-20 log entries, with a sliding step of 1-5 log entries). Single structured log entries within a continuous time window are concatenated and integrated in chronological order to form a long log sequence containing contextual information. Subsequently, power safety operation and maintenance experts label the log sequences as "normal" or "abnormal" based on power industrial control protocol specifications and common attack characteristics. Abnormal labels must clearly specify the type of abnormality (such as protocol violation attacks, data tampering, unauthorized operations, equipment fault warnings, etc.). Finally, a standardized log dataset with precise labels adapted to power safety scenarios is generated. The dataset is divided into training, validation, and test sets in a 7:2:1 ratio.

[0045] Module M2: Builds a dual-collaborative log analysis framework based on a large language model.

[0046] Module M2, based on the log dataset built in Module M1, establishes a dual-model collaborative log analysis framework adapted to power scenarios. Through the collaborative operation of semantic extraction, vector alignment, and discriminant analysis, it enhances log semantic understanding and anomaly detection capabilities, specifically including: Semantic extractor configuration: In module M2.1, a pre-trained BERT-base-uncased model is selected as the semantic extractor of the log analysis framework, replacing the word segmenter and embedding layer of the large language model Qwen3-Coder itself; after being pre-fine-tuned by the power log corpus, the BERT model is responsible for receiving the log sequences in the log dataset constructed by module M1, capturing the semantic features of a single log and the contextual association between logs through a multi-layer Transformer encoder, and converting each log and log sequence into a high-dimensional semantic vector, wherein the semantic vector dimension is set to 768 dimensions to adapt to the subsequent vector space alignment requirements.

[0047] Vector Space Aligner Construction and Integration: In module M2.2, a vector space aligner based on a fully connected neural network is constructed. This aligner includes an input layer, two hidden layers (each with 1024 and 768 neurons respectively), and an output layer. The activation function is ReLU, and the output layer dimension is consistent with the input vector dimension of the Qwen3-Coder model (set to 2048 dimensions). This vector space aligner is integrated between the semantic extractor and the Qwen3-Coder model. Its core function is to transform the 768-dimensional semantic vector output by the BERT model into a 2048-dimensional vector adapted to the Qwen3-Coder model through linear transformation and nonlinear mapping, eliminating the vector space difference between the two models and ensuring the coherent transmission of semantic information.

[0048] Large Model Discriminant Analyzer Configuration: In module M2.3, the Qwen3-Coder-30B-A3B-Instruct model is selected as the large model discriminant analyzer for the log analysis framework. Together with the semantic extractor and vector space aligner, it forms a dual-model collaborative architecture. The large model discriminant analyzer preloads a knowledge base in the field of power safety (including industrial control protocol specifications, common attack characteristics, fault handling cases, etc.) and is responsible for receiving the semantic vector after processing by the vector space aligner. At the same time, it concatenates the preset prompt words with the semantic vector. The preset prompt words need to clearly guide the model to focus on the power safety log anomaly detection task, such as "Based on the power industrial control protocol specifications and log semantic features, determine whether the log sequence is abnormal. If abnormal, please preliminarily identify the anomaly type."

[0049] Module M3: Adaptability of the three-stage collaborative training optimization framework.

[0050] Module M3, based on the log analysis framework built by Module M2, employs a three-stage adjustment strategy for collaborative training to ensure the framework is fully adaptable to various industrial control protocols and anomaly modes in power safety scenarios. Specifically, this includes: Phase 1: Adaptation Training of the Large Model Discriminant Analyzer: In module M3.1, based on the training and validation sets partitioned by module M1, the parameters of the semantic extractor (BERT model) and vector space aligner are frozen, and only the large model discriminant analyzer (Qwen3-Coder model) is trained and adjusted. During training, the cross-entropy loss function is used, the learning rate is set to 2e-5, and the training rounds are 3-5. The core objective is to guide the Qwen3-Coder model to adapt to the preset "anomaly detection question and answer" output template in the power safety log anomaly detection scenario. This template must clearly define the output format as "detection result (normal / abnormal) + preliminary anomaly type" to ensure the standardization of the model output.

[0051] Phase 2: Co-training of Semantic Extractor and Aligner: In module M3.2, the parameters of the adjusted large model discriminant analyzer in module M3.1 are frozen, and the vector space aligner and semantic extractor are jointly trained. During the training process, a combination of contrastive learning loss function and mean squared error loss function is used, with the learning rate set to 1e-5 and the training rounds being 5-8. By optimizing the parameters of both, the accuracy of semantic vector extraction and the adaptability of vector space alignment are improved, ensuring that the semantic features of electricity logs extracted by the BERT model can be effectively recognized by the Qwen3-Coder model.

[0052] Phase 3: Joint Fine-tuning and Optimization of the Entire Model: In module M3.3, the parameter freeze state of all model components is lifted. Based on the industrial control protocol log data in the module M1 dataset (especially including logs related to IEC60870-104 and IEC61850 protocols), the semantic extractor, vector space aligner, and large model discriminant analyzer are jointly adjusted. During training, a mixed precision training strategy is adopted, with a learning rate set to 5e-6 and 8-12 training rounds. At the same time, a power scenario-specific loss function (such as weighted cross-entropy loss based on anomaly type weights) is introduced to optimize the model's ability to identify power-specific anomaly patterns (such as protocol message violations, illegal device access, data tampering attacks, etc.). Ultimately, the log analysis framework is deeply adapted to the power safety industrial control protocol scenario, ensuring that the model's anomaly detection F1 value on the validation set is not lower than 0.95.

[0053] Module M4: Real-time log anomaly detection and interpretable output.

[0054] Module M4 is used for anomaly detection in real-time power system logs. It combines thought chain reasoning technology to achieve multi-step reasoning and outputs detection results including location and cause explanations, specifically including: Real-time log data acquisition: In module M4.1, log data to be analyzed in the power system is collected in real time through devices such as power system log acquisition gateway and protocol analyzer. The acquisition scope covers various industrial control equipment such as substation automation system, SCADA system, smart meter, remote control equipment, as well as logs related to mainstream power industrial control protocols such as IEC60870-104 and IEC61850. The acquisition frequency is synchronized with the log generation frequency (preferably acquisition delay not exceeding 1 second) to ensure that the data type is consistent with the log data type collected in module M1, ensuring detection compatibility.

[0055] Real-time log preprocessing and framework loading: In module M4.2, the collected real-time log data undergoes the same preprocessing and standardization processes as modules M1.2-M1.4—data cleaning, core field extraction, JSON structured parsing, and sliding window sequence construction are completed sequentially. At the same time, the full model (including semantic extractor, vector space aligner, and large model discriminant analyzer) after three-stage adjustments in module M3 is loaded. The preprocessed real-time log sequence is then input into the log analysis framework to start the log analysis process, with the analysis latency controlled within 5 seconds.

[0056] Interpretable output guided by the thought chain: In module M4.3, a thought chain prompt template for power safety log analysis is constructed. This template needs to include multi-step reasoning guidance logic, such as "Step 1: Analyze whether the protocol type and operation instructions in the log sequence comply with the IEC60870-104 / IEC61850 protocol specifications; Step 2: Determine whether the device IP is within the authorized access range and whether the operation permission level matches; Step 3: Combine the context log to locate the specific log entry where the anomaly occurred and the corresponding device; Step 4: Based on the power safety knowledge base, explain the cause of the anomaly (such as unauthorized access, protocol attack, equipment failure, etc.)". This thought chain prompt template is embedded in the log analysis framework to guide the Qwen3-Coder model to perform multi-step reasoning based on the semantic features of real-time logs, and finally output a structured result of "normal / abnormal + anomaly location + cause explanation". The anomaly location needs to be specified down to the specific device IP, log timestamp, and log entry. The cause explanation needs to be clearly explained in natural language, combining power industrial control protocol specifications and common anomaly patterns, to ensure that power safety operation and maintenance personnel can quickly understand and take countermeasures.

[0057] The system in this embodiment significantly improves the adaptability and practicality of log anomaly detection in the power sector by constructing a power-specific dataset, building a dual-model collaborative architecture, conducting three-stage targeted training, and designing an interpretable thought chain. It can effectively address the analysis needs of multi-source heterogeneous logs in the power system and provide accurate and efficient technical support for power safety operation and maintenance.

[0058] Example 3 This embodiment proposes a log analysis method for power safety based on a large language model. This method constructs a structured multi-source heterogeneous log dataset of the power system, applies a dual-model collaborative architecture, and combines thinking chain technology to solve the problems of log classification and semantic understanding in the power system. This enables high-precision anomaly detection and interpretability analysis of power industrial control protocol data and the operating status of power system software and hardware.

[0059] The log analysis method for power safety based on a large language model proposed in this embodiment includes the following steps: Step 1: Obtain raw log data from multiple heterogeneous sources, perform preprocessing and standardization, and construct a dedicated log dataset for the power safety field.

[0060] Step 2: Construct a log analysis framework based on a large language model. This framework is a dual-model collaborative architecture, referencing the open-source framework LogLLM (https: / / github.com / guanwei49 / LogLLM), and consists of a semantic extractor (BERT), a vector space aligner (Projector), and a large model discriminant analyzer (Qwen3-Coder).

[0061] Step 3: Use a three-stage fine-tuning strategy to train the model to adapt it to the industrial control protocol in the power safety scenario.

[0062] Step 4: Collect the power logs to be analyzed, use the trained model, combine it with the thinking chain technique to perform reasoning, output the anomaly detection results, locate the location of the anomaly, and explain the specific cause.

[0063] Further, step 1 includes the following steps: Step 1.1: Data Collection. Obtain general system logs (such as HDFS, BGL, Thunderbird) from the Loghub open-source repository; collect power security-specific log data, including smart grid network physical attack datasets, traffic monitoring data from IEC60870-104 and IEC 61850 protocols, etc.

[0064] Step 1.2: Data Preprocessing. Clean and denoise the raw logs, and extract key fields such as timestamps, device IPs, and operation commands.

[0065] Step 1.3: Data Structuring. Each line of log data processed in "Step 1.2" is parsed and transformed into a unified JSON standard format.

[0066] Step 1.4: Long Log Sequence Construction. Using a sliding window mechanism, each line of structured log data is concatenated with a fixed window size to transform it into a long log sequence containing contextual information, generating a standardized, labeled dataset.

[0067] Further, step 2 includes the following steps: Step 2.1: Set the BERT model as the semantic extractor (Embedder), replacing the word segmenter and embedding layer of the large language model Qwen3-Coder, and be responsible for converting each log into a semantic vector.

[0068] Step 2.2: Construct a vector space aligner (Projector) to align the vector spaces of BERT and the Qwen3-Coder model, mapping the semantic vectors output by BERT to the vector space of the Qwen3-Coder model.

[0069] Step 2.3: Select Qwen3-Coder as the large model discriminant analyzer (Decoder), concatenate the semantic vectors corresponding to the prompt words and log sequences, and guide it to make core decisions for anomaly detection.

[0070] Furthermore, step 3 includes the following steps: Step 3.1: First stage fine-tuning: Freeze BERT and Projector, and only fine-tune Qwen3-Coder to adapt it to the specific "anomaly detection question and answer" output template.

[0071] Step 3.2: Second stage fine-tuning: Freeze Qwen3-Coder, fine-tune Projector and BERT to align the semantic vectors output by BERT with the vector space of Qwen3-Coder.

[0072] Step 3.3: Third stage fine-tuning: Jointly fine-tune all models to improve log classification accuracy and optimize the framework's ability to determine whether there are anomalies in the power log sequence.

[0073] Furthermore, step 4 includes the following steps: Step 4.1: Collect the power logs to be analyzed.

[0074] Step 4.2: Load the fine-tuned model. Use the framework built in Step 2 for log analysis.

[0075] Step 4.3: Design a CoT (Cooperation of Thought) prompt template for power safety log analysis to guide the model in answering the specific location and cause of the anomaly, so that its final output is "normal / abnormal + natural language explanation".

[0076] This invention achieves the following beneficial technical effects by constructing a power-specific multi-source log dataset, designing a collaborative architecture of BERT and Qwen3-Coder dual models and a vector space alignment mechanism, adopting a three-stage targeted training strategy, and incorporating a thought chain reasoning and interpretation mechanism: First, it significantly improves the adaptability to power scenarios, accurately adapting to power industrial control protocols such as IEC 60870-104 and IEC 61850, as well as unique attack modes, thus addressing the shortcomings of general log detection technologies in the power field. Second, it greatly improves anomaly detection accuracy. Through deep semantic feature extraction, cross-model vector space alignment, and full-model joint optimization, it ensures that the F1 score for anomaly identification in multi-source heterogeneous logs of the power system is no less than 0.95, effectively capturing power-specific anomalies such as protocol violations and unauthorized access. Third, it achieves highly interpretable output, breaking through the limitations of traditional binary label output. Through multi-step reasoning via thought chain, it clarifies the specific location of the device IP, timestamp, etc., corresponding to the anomaly, and clearly explains the cause of the anomaly in conjunction with a power field knowledge base, providing direct technical support for maintenance personnel in fault tracing and emergency response, significantly improving the efficiency and scientific nature of power safety maintenance and decision-making.

[0077] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0078] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A method for detecting anomalies in power safety logs, characterized in that, Includes the following steps: Step S1: Obtain multi-source heterogeneous raw log data in the field of power safety, preprocess and standardize the raw log data, and construct a log dataset adapted to the power safety scenario; Step S2: Based on the log dataset constructed in Step S1, build a log analysis framework based on a large language model; The log analysis framework adopts a dual-model collaborative architecture, including a semantic extractor, a vector space aligner, and a large model discriminant analyzer. Step S3: For the log analysis framework built in step S2, a three-stage adjustment strategy is adopted to collaboratively train the semantic extractor, the vector space aligner and the large model discriminant analyzer. Combined with the log data in the log dataset built in step S1, the entire log analysis framework is adapted to various industrial control protocols in the power safety scenario. Step S4: Collect real-time log data of the power system to be analyzed, preprocess and standardize the real-time log data, and then input it into the log analysis framework trained in Step S3. Combine the thinking chain reasoning technology to perform multi-step reasoning, output the log anomaly detection results, locate the specific location of the anomaly, and explain the specific cause of the anomaly.

2. The method for detecting anomalies in power safety logs according to claim 1, characterized in that, Step S1 specifically includes the following steps: Step S1.1: Obtain general system logs from the Loghub open-source repository, and simultaneously collect power security log data as multi-source raw log data for power security; the power security log data includes smart grid network physical attack datasets, traffic monitoring data according to the IEC 60870-104 protocol, and traffic monitoring data according to the IEC 61850 protocol; Step S1.2: Clean and denoise the multi-source raw log data collected in step S1.1, remove invalid data, redundant data and abnormal interference data, and extract the key core fields in each log, including timestamp, device IP and operation instructions. Step S1.3: Perform unified structured parsing on the log data processed in step S1.2, and convert each line of log data into a unified JSON standard format; Step S1.4: Based on the structured JSON log data obtained in step S1.3, a sliding window mechanism is used to set a fixed window size and concatenate and integrate single structured logs according to window rules, transforming them into long log sequences containing contextual information, and finally generating a standardized, labeled log dataset adapted to power safety scenarios.

3. The method for detecting anomalies in power safety logs according to claim 1, characterized in that, Step S2 specifically includes the following steps: Step S2.1: Set the BERT model as the semantic extractor of the log analysis framework, replacing the word segmenter and embedding layer of the large language model Qwen3-Coder; the BERT model is responsible for receiving the log data in the log dataset constructed in step S1 and converting each log into a semantic vector that can be used for subsequent analysis. Step S2.2: Construct a vector space aligner and integrate the constructed vector space aligner between the semantic extractor and the Qwen3-Coder model in step S2.1; the vector space aligner is responsible for aligning the vector spaces of the BERT model and the Qwen3-Coder model, and mapping the semantic vectors output by the BERT model in step S2.1 to make them fit the vector space specifications of the Qwen3-Coder model; Step S2.3: Use the Qwen3-Coder model from step S2.1 as the large model discriminant analyzer of the log analysis framework to obtain a log analysis framework with a dual-model collaborative architecture; the large model discriminant analyzer is responsible for receiving the semantic vector processed by the vector space aligner in step S2.2, concatenating the preset prompt words with the semantic vector, and guiding the Qwen3-Coder model to focus on the power safety log anomaly detection task through the prompt words.

4. The method for detecting anomalies in power safety logs according to claim 1, characterized in that, Step S3 specifically includes the following steps: Step S3.1: Based on the log dataset constructed in Step S1 and the log analysis framework built in Step S2, freeze the parameters of the semantic extractor and the vector space aligner, and only train and adjust the large model discriminant analyzer to guide it to adapt to the preset "anomaly detection question and answer" output template in the power safety log anomaly detection scenario. Step S3.2: Based on the completion of step S3.1, freeze the parameters of the adjusted large model discriminant analyzer, train and adjust the vector space aligner and semantic extractor, optimize the collaborative performance between the two, so that the vector space aligner can align the semantic vector output by the semantic extractor with the vector space of the Qwen3-Coder model; Step S3.3: Integrate the adjustment results of steps S3.1 and S3.2, and perform a full-model joint adjustment on the semantic extractor, vector space aligner and large model discriminant analyzer. Combine the industrial control protocol log data in the log dataset of step S1 to improve the log classification accuracy of the log analysis framework, optimize the log analysis framework's ability to judge abnormal situations in power log sequences, and realize the adaptation of the log analysis framework to power safety industrial control protocol scenarios.

5. The method for detecting anomalies in power safety logs according to claim 1, characterized in that, Step S4 specifically includes the following steps: Step S4.1: Collect real-time log data to be analyzed in the power system, and the collected log data covers various industrial control equipment and protocol-related logs in power safety scenarios, and is compatible with the log data types collected in step S1. Step S4.2: Load the full model after the three-stage adjustment in step S3. After preprocessing and standardization, input the log data to be analyzed collected in step S4.1 into the log analysis framework and start the log analysis process. Step S4.3: Construct a thought chain prompt template for power safety log analysis, adapting the thought chain prompt template to the output standard of the adjusted Qwen3-Coder model in step S3 and the power safety log anomaly detection standard. Embed the thought chain prompt template into the log analysis framework of step S4.2, guiding the Qwen3-Coder model to perform multi-step reasoning based on the semantic features of the log to be analyzed, and outputting a result of "normal / abnormal + natural language explanation". The natural language explanation can clearly identify the specific location and corresponding cause of the anomaly.

6. A power safety log anomaly detection system, characterized in that, Includes the following modules: Module M1: Acquires multi-source heterogeneous raw log data in the field of power safety, performs preprocessing and standardization on the raw log data, and constructs a log dataset adapted to power safety scenarios; Module M2: Based on the log dataset built in Module M1, a log analysis framework based on a large language model is constructed. The log analysis framework adopts a dual-model collaborative architecture, including a semantic extractor, a vector space aligner, and a large model discriminant analyzer. Module M3: For the log analysis framework built in Module M2, a three-stage adjustment strategy is adopted to collaboratively train the semantic extractor, the vector space aligner and the large model discriminant analyzer. Combined with the log data in the log dataset built in Module M1, the entire log analysis framework is adapted to various industrial control protocols in the power safety scenario. Module M4: Collects real-time log data to be analyzed from the power system, performs preprocessing and standardization on the real-time log data, and then inputs it into the log analysis framework trained by Module M3. Combined with the thinking chain reasoning technology, it performs multi-step reasoning, outputs log anomaly detection results, locates the specific location of the anomaly, and explains the specific cause of the anomaly.

7. The power safety log anomaly detection system according to claim 6, characterized in that, Module M1 specifically includes the following modules: Module M1.1: Acquires general system logs from the Loghub open-source repository, and simultaneously collects power security log data as multi-source raw log data for power security; the power security log data includes smart grid network physical attack datasets, traffic monitoring data of the IEC 60870-104 protocol, and traffic monitoring data of the IEC 61850 protocol; Module M1.2: Cleans and denoises the multi-source raw log data collected by module M1.1, removing invalid data, redundant data, and abnormal interference data, and extracts the key core fields from each log, including timestamp, device IP, and operation instructions; Module M1.3: Performs unified structured parsing on the log data processed by module M1.2, converting each line of log data into a unified JSON standard format; Module M1.4: Based on the structured JSON log data obtained from Module M1.3, it adopts a sliding window mechanism, sets a fixed window size, and concatenates and integrates individual structured logs according to window rules to transform them into long log sequences containing contextual information, ultimately generating a standardized, labeled log dataset adapted to power safety scenarios.

8. The power safety log anomaly detection system according to claim 6, characterized in that, Module M2 specifically includes the following modules: Module M2.1: Sets the BERT model as the semantic extractor of the log analysis framework, replacing the word segmenter and embedding layer of the large language model Qwen3-Coder; the BERT model is responsible for receiving log data from the log dataset constructed by module M1 and converting each log into a semantic vector that can be used for subsequent analysis; Module M2.2: Constructs a vector space aligner, which is then integrated between the semantic extractor in Module M2.1 and the Qwen3-Coder model. The vector space aligner is responsible for aligning the vector spaces of the BERT model and the Qwen3-Coder model, and mapping the semantic vectors output by the BERT model in Module M2.1 to fit the vector space specifications of the Qwen3-Coder model. Module M2.3: The Qwen3-Coder model in Module M2.1 is used as the large model discriminant analyzer of the log analysis framework to obtain a log analysis framework with a dual-model collaborative architecture. The large model discriminant analyzer is responsible for receiving the semantic vector processed by the vector space aligner in Module M2.2, concatenating the preset prompt words with the semantic vector, and guiding the Qwen3-Coder model to focus on the power safety log anomaly detection task through the prompt words.

9. The power safety log anomaly detection system according to claim 6, characterized in that, Module M3 specifically includes the following modules: Module M3.1: Based on the log dataset built by Module M1 and the log analysis framework built by Module M2, the parameters of the semantic extractor and vector space aligner are frozen, and only the large model discriminant analyzer is trained and adjusted to guide it to adapt to the preset "anomaly detection question and answer" output template in the power safety log anomaly detection scenario; Module M3.2: Based on the completion of Module M3.1, freeze the parameters of the adjusted large model discriminant analyzer, train and adjust the vector space aligner and semantic extractor, optimize the collaborative performance between the two, so that the vector space aligner can align the semantic vectors output by the semantic extractor with the vector space of the Qwen3-Coder model; Module M3.3 integrates the adjustments made to Modules M3.1 and M3.2, performs joint adjustments to the semantic extractor, vector space aligner, and large model discriminant analyzer, and combines the industrial control protocol log data in the log dataset of Module M1 to improve the log classification accuracy of the log analysis framework, optimize the log analysis framework's ability to judge abnormal situations in power log sequences, and achieve the adaptation of the log analysis framework to power safety industrial control protocol scenarios.

10. The power safety log anomaly detection system according to claim 6, characterized in that, Module M4 specifically includes the following modules: Module M4.1: Collects real-time log data to be analyzed in the power system, and the collected log data covers various industrial control equipment and protocol-related logs in power safety scenarios, and is compatible with the log data types collected in Module M1. Module M4.2: Loads the full model after the three-stage adjustment in module M3, and inputs the log data to be analyzed collected by module M4.1 into the log analysis framework after preprocessing and standardization, and starts the log analysis process; Module M4.3: Constructs a thought chain prompt template for power safety log analysis, adapting the thought chain prompt template to the output standards of the adjusted Qwen3-Coder model in Module M3 and the power safety log anomaly detection standards. The thought chain prompt template is embedded into the log analysis framework of Module M4.2, guiding the Qwen3-Coder model to perform multi-step reasoning based on the semantic features of the log to be analyzed, and outputting a result of "normal / abnormal + natural language explanation". The natural language explanation can clearly identify the specific location and corresponding cause of the anomaly.

Images