Big data anomaly rule intelligent generation method, system, device and medium

Abstract

This invention discloses a method, system, device, and medium for intelligent generation of big data anomaly rules, relating to the field of power grid data anomaly judgment technology. The method includes: acquiring corpus and a semantic model; parsing the corpus using the semantic model to extract key business elements; mapping the key business elements to preset business domains and data fields to generate anomaly judgment rules. This invention solves the problems of low efficiency and insufficient accuracy in existing technologies.

Description

Technical Field

[0001] This invention relates to the field of power grid data anomaly determination technology, and in particular to a method, system, device and medium for intelligent generation of big data anomaly rules. Background Technology

[0002] In the field of power grid operation and management, relying on the database and anomaly judgment rules in the intelligent control system, massive amounts of power grid business data can be automatically checked to identify abnormal data, thereby providing technical support for inspection and supervision. These anomaly judgment rules are typically used to describe under what conditions data is considered abnormal, such as over-capacity power consumption or excessive frequency of repeated maintenance.

[0003] Currently, the maintenance of data anomaly detection rules still relies primarily on manual methods. When business scenarios change or new monitoring needs arise, technical personnel must manually add, modify, or delete the corresponding anomaly rules. This process requires technical personnel to first understand the natural language business requirements raised by non-technical staff, then consult the business system's data dictionary to identify the relevant fields, and finally manually write rule scripts or code.

[0004] However, this manual maintenance method has the following main problems: First, traditional manual rule formulation is inefficient. Since the formulation of exception rules involves multiple steps such as requirement understanding, field matching, and code writing, the manual operation process is cumbersome and time-consuming. When faced with a large number or frequent rule change requests, the manual response speed is slow, making it difficult to quickly adapt to dynamically changing business supervision requirements, resulting in a long rule formulation cycle. Second, the manual conversion process is prone to insufficient rule accuracy: the correspondence between elements in business requirements and data fields in the underlying system relies entirely on manual experience. Due to differences in the data structures of different business systems, technicians may make matching errors or logical omissions when manually associating fields, causing the generated exception rules to fail to accurately apply to the target data, thus affecting the accuracy of exception identification. Summary of the Invention

[0005] This invention provides a method, system, device, and medium for intelligent generation of big data anomaly rules, which solves the problems of low efficiency and insufficient accuracy in existing technologies.

[0006] In view of this, the first aspect of the present invention provides a method for intelligent generation of big data anomaly rules, the method comprising:

[0007] Acquire corpus and semantic model;

[0008] The semantic model is used to parse the corpus and extract key business elements;

[0009] The key business elements are mapped to preset business domains and data fields to generate anomaly detection rules.

[0010] Optionally, when the key business elements include: a first entity and first entity attributes, a first numerical condition, a first time condition, and a first logical relationship, the step of mapping the key business elements to preset business domains and data fields to generate anomaly judgment rules includes:

[0011] Obtain a preset logic template, wherein the preset logic template includes at least two of the following: a first entity field, a first numerical condition field, a first time condition field, and a first logical relationship field;

[0012] The second entity is obtained by matching the attributes of the first entity with the data fields of the corresponding business system;

[0013] Select the corresponding logical template according to the semantic type, fill the second entity, the first numerical condition, the first time condition, and the first logical relationship into the corresponding first entity field, first numerical condition field, first time condition field, and first logical relationship field, and generate the anomaly judgment rule.

[0014] Optionally, the step of matching the first entity attribute with the data fields of the corresponding business system to obtain the second entity includes:

[0015] Retrieve the pre-built entity attribute-system field mapping table;

[0016] Based on the entity attribute-system field mapping table, the first entity and its attributes are matched with fields in the preset business domain, data dictionary, and rule template that have the same attributes to obtain the second entity.

[0017] Optionally, the step of parsing the corpus using the semantic model to extract key business elements further includes:

[0018] The semantic model is used to perform intent recognition on the corpus to obtain a corpus type, which includes anomaly rule creation and data query.

[0019] When the corpus type is the abnormal rule creation, the step of mapping the key business elements to preset business domains and data fields to generate abnormal judgment rules is executed;

[0020] When the corpus type is the data query, the preset steps of querying the database are executed.

[0021] Optionally, the semantic model is obtained through the following steps:

[0022] Obtain existing anomaly rules, transcribe them into natural language and annotate them. The annotation includes: annotation time, object, threshold business element, user demand type and business domain, to obtain a training dataset; wherein, the user demand type includes anomaly rule creation and data query.

[0023] Based on the training dataset, a supervised learning algorithm is used to train the preset initial semantic model to obtain the semantic model.

[0024] Optionally, the initial semantic model is one of BERT, RoBERTa, or Chinese BERT-base.

[0025] Optionally, the generation of anomaly determination rules may further include:

[0026] The anomaly detection rules are converted into executable scripts and stored in the rule engine library.

[0027] A second aspect of the present invention provides a big data anomaly rule intelligent generation system, the system comprising:

[0028] Acquisition unit, used to acquire corpus and semantic model;

[0029] The parsing unit is used to parse the corpus using the semantic model and extract key business elements;

[0030] The generation unit is used to map the key business elements to preset business domains and data fields, and generate anomaly judgment rules.

[0031] A third aspect of the present invention provides a big data anomaly rule intelligent generation device, the device comprising a processor and a memory:

[0032] The memory is used to store program code and transmit the program code to the processor;

[0033] The processor is used to execute the steps of the big data anomaly rule intelligent generation method as described in the first aspect above, according to the instructions in the program code.

[0034] A fourth aspect of the present invention provides a computer-readable storage medium for storing program code for executing the intelligent generation method for big data anomaly rules described in the first aspect above.

[0035] As can be seen from the above technical solutions, the present invention has the following advantages:

[0036] This invention provides an intelligent method for generating big data anomaly rules, comprising: acquiring corpus and a semantic model; parsing the corpus using the semantic model to extract key business elements; and mapping the key business elements to preset business domains and data fields to generate anomaly judgment rules. This effectively solves the problems of low efficiency and insufficient accuracy in traditional manual rule formulation. In summary, the intelligent method for generating big data anomaly rules provided by this invention allows non-technical personnel to generate rules using only natural language without needing to master code or complex rule syntax, significantly shortening the rule formulation cycle. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a flowchart illustrating an embodiment of the intelligent generation method for big data anomaly rules of the present invention.

[0039] Figure 2 This is a flowchart illustrating a second embodiment of the intelligent generation method for big data anomaly rules of the present invention.

[0040] Figure 3 This is a flowchart illustrating a third embodiment of the intelligent generation method for big data anomaly rules of the present invention.

[0041] Figure 4 This is a flowchart illustrating Embodiment 4 of the intelligent generation method for big data anomaly rules of the present invention.

[0042] Figure 5 This is a flowchart illustrating Embodiment 5 of the intelligent generation method for big data anomaly rules of the present invention.

[0043] Figure 6 This is a flowchart illustrating Embodiment Six of the intelligent generation method for big data anomaly rules of the present invention.

[0044] Figure 7 This is a schematic diagram of the module structure of the big data anomaly rule intelligent generation system of the present invention. Detailed Implementation

[0045] To make the objectives, features, and advantages of this invention more apparent and understandable, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0046] Example 1:

[0047] It's important to note that in traditional big data anomaly monitoring scenarios, especially in inspection work within industries like power, the formulation of anomaly detection rules often relies on manual processes. Due to the complexity of the business areas involved, encompassing administration, engineering construction, marketing, and more, and the need to integrate specific business data and scenario details, manual formulation is not only inefficient but also prone to inaccuracies and incomplete coverage due to differences in individual experience, making it difficult to meet the demands of rapid screening of massive amounts of business data. Furthermore, non-technical personnel cannot directly participate in rule formulation, requiring the involvement of technical personnel, further increasing the rule generation cycle and communication costs.

[0048] To address the aforementioned issues, this invention proposes a big data anomaly rule intelligent generation method. This method aims to automate and intelligently generate anomaly rules through natural language processing technology, thereby improving the efficiency and accuracy of rule formulation. Simultaneously, it lowers the barrier to entry for non-technical personnel, enabling them to directly describe business needs through natural language and quickly generate anomaly judgment rules that conform to actual scenarios, thus better supporting the conduct of inspections and other supervisory work.

[0049] See Figure 1 The method includes:

[0050] S100, acquiring corpus and semantic model;

[0051] S200. The semantic model is used to parse the corpus and extract key business elements;

[0052] S300. Map the key business elements to preset business domains and data fields to generate anomaly judgment rules.

[0053] In this embodiment, the acquired corpus first includes anomaly detection rules formed during historical inspections, actual data records in the business system, and daily supervision requests from employees. This corpus, after being organized and labeled, forms the basis for training the semantic model. The semantic model is optimized based on a general natural language processing model, combined with business terminology and scenario features specific to fields such as power grid inspections, enabling it to accurately understand natural language expressions within the domain. In practical implementation, when a user inputs a supervision request in natural language form, such as "find vehicles that have had the same part repaired twice within the last 3 months," the semantic model performs deep analysis on the corpus, extracting key business elements, including entities such as vehicles and parts, attributes such as repair time and number of repairs, and conditions such as "within 3 months" and "repeatedly repaired twice." Subsequently, based on these business elements, and referring to a preset business domain classification, they are mapped to the corresponding business domain, such as the administrative office domain, and associated with specific data fields in the business system through a data source mapping table (such as the entity attribute-system field mapping table in the following embodiment), such as the repair time field and part name field in the vehicle repair record. By combining the extracted conditions and mapped fields, the system calls a preset rule template library, such as time-based templates and numerical comparison templates, to automatically assemble and generate executable exception handling rules, such as corresponding SQL scripts or rule engine scripts.

[0054] This invention leverages natural language processing (NLP) technology to transform semantics into business elements, and provides collaborative support from a rule template library and a data source mapping table. The semantic model, trained on domain corpora, possesses the ability to recognize business terms and parse logical relationships, transforming the natural language requirements of non-technical personnel into structured business elements. The rule template library extracts common logic based on historical rules, providing a reusable logical framework for different types of business needs. The data source mapping table ensures a precise correspondence between business elements and actual business data fields, enabling the generated rules to directly apply to business system data.

[0055] Understandably, this invention first requires the collection and organization of corpora, including sorting out historical inspection rules, business data dictionaries, employee requirement records, etc., to form a corpus covering multiple business domains, and labeling the corpus with tags such as entities, attributes, and conditions. Based on this corpus, a domain-adaptive training method is used to optimize the semantic model, enabling it to accurately understand professional expressions such as "excessive electricity consumption" and "abnormal connection between the three calculations." When a user inputs a supervision requirement through natural language, the semantic model performs word segmentation, entity recognition, and logical parsing on the input text, extracting business elements such as the supervision object, key indicators, time range, and numerical thresholds. Next, the corresponding business domain is determined based on the extracted elements, such as the marketing domain, and the specific data fields corresponding to the elements are found through the data source mapping table, such as the application capacity field and load collection field in the electricity consumption file. Subsequently, based on the logical relationship of the elements, such as "actual value is greater than standard value," the corresponding template in the rule template library is matched, and the specific parameters are filled in to generate the initial rule. The generated rules will be tested by the testing module to verify their accuracy using historical business data. This includes checking whether the rules can accurately hit known anomaly cases. If there are deviations, the parameters will be adjusted to ultimately form anomaly judgment rules that can be directly used in the business system.

[0056] The intelligent generation method for big data anomaly rules in this invention effectively solves the problems of low efficiency and insufficient accuracy in traditional manual rule formulation. It allows non-technical personnel to generate rules using only natural language, without needing to master coding or complex rule syntax, significantly shortening the rule formulation cycle. The combination of semantic models and rule template libraries ensures that rules are tailored to business scenarios, reducing omissions and misjudgments. Furthermore, the precise mapping of data sources enables rules to directly apply to business data, achieving automatic screening of anomalies. This significantly improves the efficiency and accuracy of inspection and other supervisory work, providing strong support for routine supervision in a big data environment.

[0057] Example 2:

[0058] It's important to note that in the traditional anomaly rule generation process, the matching of business elements with business domains and data fields often relies on manual intervention. This requires not only technical personnel to be familiar with the field structures of various business systems but also to understand the natural language requirements of non-technical personnel. This involves numerous conversion steps, high communication costs, and is prone to matching errors due to individual misunderstandings. For example, when a user mentions "excessive electricity consumption," a human might mistakenly associate it with capacity data in the engineering and construction field, when it should actually correspond to electricity consumption records in the marketing field. This discrepancy directly leads to the rule not accurately applying to business data, affecting the effectiveness of anomaly identification. Furthermore, the rule logic varies across different business scenarios, and manual selection of an appropriate logical framework can easily lead to oversights, resulting in rules that are either too simplistic to cover complex scenarios or logically flawed and difficult to execute.

[0059] See Figure 2 In one embodiment, when the key business element includes: a first entity and a first entity attribute, a first numerical condition, a first time condition, and a first logical relationship, the step of mapping the key business element to a preset business domain and data field to generate anomaly judgment rules, S300, includes:

[0060] S310. Obtain a preset logic template, wherein the preset logic template includes at least two of the following: a first entity field, a first numerical condition field, a first time condition field, and a first logical relationship field;

[0061] S320. Match the attributes of the first entity with the data fields of the corresponding business system to obtain the second entity;

[0062] S330. Select the corresponding logical template according to the semantic type, fill the second entity and the parsed first numerical condition, first time condition and first logical relationship into the corresponding first entity field, first numerical condition field, first time condition field and first logical relationship field, and generate the anomaly judgment rule.

[0063] To address these issues, this embodiment proposes a method for generating anomaly judgment rules based on business element mapping. Through a systematic parsing and matching mechanism, it achieves accurate conversion of business elements into anomaly rules, reduces manual intervention, improves the efficiency and accuracy of rule generation, and enables non-technical personnel to quickly generate effective anomaly judgment rules through natural language, thus better supporting inspection and other supervisory work.

[0064] In this embodiment, multiple logical templates are preset. These templates are extracted based on historical anomaly rules and cover different business scenarios. Each template contains a specific combination of fields. For example, the time-based template contains a first entity field, a first time condition field, and a first logical relation field, while the numerical comparison template contains a first entity field, a first numerical condition field, and a first logical relation field. These fields reserve space for subsequent element filling. When a user inputs a supervision request in natural language, the trained semantic model performs deep analysis on the corpus. For example, it analyzes "vehicles that have had the same part repaired twice within 3 months" into the first entity "vehicle", the first entity attributes "repaired parts" and "repair times", the first time condition "within 3 months", the first numerical condition "repeatedly repaired twice", and the first logical relation "and".

[0065] Next, based on the parsed first entity attributes, such as "repair parts" and "repair count," they are matched against a pre-defined data source mapping table. This data source mapping table records the correspondence between entity attributes in each business domain and the corresponding data fields in the business system. For example, "repair parts" corresponds to the "part name" field in the vehicle repair records of the administrative office system, and "repair count" corresponds to the "number of repair records" field. Through this matching, the first entity "vehicle" is precisely associated with specific business system data, forming a second entity—that is, entity information containing specific data fields.

[0066] Subsequently, based on the condition types obtained from semantic parsing, such as combinations of time and numerical conditions, a corresponding template is selected from preset logical templates, such as a time-numerical combination template. After selecting a template, the matched second entity is filled into the first entity field of the template, the parsed first time condition "within 3 months" is filled into the first time condition field, the first numerical condition "repeated repairs 2 times" is filled into the first numerical condition field, and the first logical relation "AND" is filled into the first logical relation field, thus completing the template filling.

[0067] The populated template is automatically converted into executable rule statements, such as corresponding SQL query statements or rule engine scripts. These statements can directly call data from the business system for calculation and comparison. The generated rules are also verified by the testing module, which uses historical anomaly data to check whether the rules can accurately hit known anomalies. If there is a deviation, the parameters of element parsing or template matching will be adjusted in reverse until the rules meet the preset accuracy requirements.

[0068] In this way, business elements are accurately transformed into anomaly detection rules that can be applied to business data. This not only reduces the errors and time required for manual transformation but also allows non-technical personnel to directly participate in rule creation, significantly improving the efficiency and applicability of rule generation. The generated rules can be quickly applied to business systems to achieve automatic screening and early warning of abnormal data, providing accurate and efficient technical support for supervision work and effectively solving the problems of slow rule creation and low matching accuracy under traditional manual methods.

[0069] Example 3:

[0070] It's important to note that after generating the anomaly detection rules, ensuring these rules function effectively in the actual business system becomes a crucial follow-up issue. Traditionally, even after generating the rules, technical personnel must manually convert them into recognizable code. This not only increases implementation costs but also easily introduces new errors during the conversion process, leading to inaccurate rule execution. Furthermore, the generated rules lack an effective unified management mechanism, making it extremely inconvenient to find and call rules when updates or reuse are needed, impacting the continuity and efficiency of monitoring work.

[0071] To achieve automated execution and centralized management of rules, enabling seamless integration of generated rules into business systems, improving rule execution efficiency and maintainability, and further enhancing the automation level of supervision work.

[0072] See Figure 3 In one embodiment, after step S300, the method further includes:

[0073] S400. The anomaly determination rules are converted into a system-executable script and stored in the rule engine library.

[0074] In this implementation, after the anomaly detection rules are generated, they are converted into a specific executable script format according to the target system's technical architecture and the requirements of the rule engine. For example, for a system based on the Drools rule engine, the rules are converted into a .drl format script supported by Drools. This script uses a syntax structure specific to the rule engine, including a conditional part (when) and an action part (then), which can clearly express business logic. During the conversion process, the entities, conditions, logical relationships, and other elements in the rules are automatically mapped to the corresponding elements in the script, ensuring that the semantics of the rules remain unchanged after conversion.

[0075] After the scripts are transformed, these executable scripts are stored in the rule engine library. The rule engine library is a centralized storage system that uses a categorized management approach, storing different types of rule scripts in corresponding directories based on business domains, such as administrative office rules, engineering construction rules, and marketing rules. Each rule script is associated with detailed metadata, including the rule name, creation time, applicable business scenario, and creator information, facilitating subsequent querying and management. Furthermore, the rule engine library supports version control; when rules need to be updated, historical versions are retained for traceability and comparison.

[0076] In this implementation, the rule engine library is integrated with the rule execution module of the business system. When the business system needs to screen for abnormal data, it automatically calls the corresponding script from the rule engine library and loads it into the rule engine for execution. The rule engine performs real-time analysis and comparison of the business data according to the logic in the script. Once data that meets the abnormal conditions is found, the corresponding early warning mechanism is immediately triggered, and the abnormal information is fed back to the supervisors.

[0077] In this way, the generated anomaly detection rules can be quickly and accurately transformed into executable scripts for effective management and invocation, achieving full automation from rule generation to execution. This not only reduces manual intervention and lowers implementation costs but also improves the efficiency and accuracy of rule execution, enabling more timely and effective detection of business anomalies and providing strong support for the company's compliant operations. Simultaneously, the centralized management of the rule engine library facilitates rule reuse and optimization, promotes the accumulation and transfer of supervisory experience, and further enhances the company's supervisory capabilities and management level.

[0078] Example 4:

[0079] It's important to note that in the traditional process of matching business elements with system fields, the differences in data structures across different business systems and the lack of a unified mapping standard between business terms and technical fields often lead to reliance on manual experience. This is not only inefficient but also prone to errors. For example, "user capacity" in a business requirement might be incorrectly matched to the "device capacity" field in the system, preventing subsequent rules from accurately applying to the target data. Furthermore, as business systems are continuously updated and expanded, new entity attributes and data fields constantly emerge, making it increasingly difficult to manually maintain matching relationships and ensuring accuracy and timeliness.

[0080] To achieve automated and accurate matching of business elements to system fields, reduce manual intervention, improve matching efficiency and accuracy, and provide a reliable data foundation for subsequent rule generation.

[0081] See Figure 4 In one embodiment, step S330 involves matching the attributes of the first entity with the data fields of the corresponding business system to obtain the second entity, including:

[0082] S331. Obtain the pre-built entity attribute-system field mapping table;

[0083] S332. Based on the entity attribute-system field mapping table, match the first entity and its attributes with fields in the preset business domain, data dictionary, and rule template that have the same attributes to obtain the second entity.

[0084] In this implementation, an entity attribute-system field mapping table is pre-established in the system. This mapping table is compiled based on the data dictionary and historical business rules of each business system. It records the correspondence between common entity attributes in the business domain and specific data fields in the business system. For example, in the inspection scenario of the power industry, the mapping table will clearly specify that "user capacity" corresponds to the "application capacity" field in the marketing system, and "number of repairs" corresponds to the "number of repair records" field in the vehicle repair table of the administrative office system, etc.

[0085] When the system needs to match the first entity and its attributes obtained from semantic parsing with data fields in the business system, it first searches the mapping table for fields with the same or similar names as the first entity's attributes. For example, when the parsed first entity attribute is "repair time", the system searches the mapping table for fields containing "time" and related to "repair", finding fields such as the "repair date" field in the "vehicle repair record table" of the administrative office system. This associates the first entity "vehicle" with the field of that system, forming the second entity.

[0086] During the matching process, priority is given to cases of exact matches, where the entity attribute name is exactly the same as the field name in the mapping table. If no exact match is found, semantic similarity analysis is performed. By comparing the field descriptions, contextual relationships, etc., the field with the closest semantics is found for matching. For example, when the entity attribute is "overcapacity ratio," if there is no completely identical field in the mapping table, but there is a calculated field "actual load / applied capacity - 1," the two are associated by analyzing their business meaning.

[0087] To improve matching accuracy, the mapping table is updated regularly. As new business systems are integrated and business rules change, new mapping relationships are continuously added, while existing inaccurate mappings are corrected. Furthermore, the system supports manual intervention. When the automatic matching results do not meet expectations, users can manually adjust the matching relationships and add the correct mappings to the mapping table, further improving its accuracy.

[0088] This approach, based on the entity attribute-system field mapping table, achieves efficient and accurate conversion of business elements into system fields, providing accurate data support for the subsequent generation of anomaly detection rules. This automated matching mechanism not only reduces human error but also significantly improves matching efficiency, enabling rapid response to business needs and timely generation of effective anomaly detection rules, thereby enhancing the automation and accuracy of supervisory work such as inspections.

[0089] Example 5:

[0090] It should be noted that after the semantic model parses the corpus and extracts key business elements, it is necessary to further determine the user's true intent in order to determine the subsequent execution process.

[0091] See Figure 5 In one embodiment, step S200, parsing the corpus using the semantic model to extract key business elements, further includes:

[0092] S210. The semantic model is used to perform intent recognition on the corpus to obtain a corpus type, wherein the corpus type includes anomaly rule creation and data query.

[0093] S220. When the corpus type is the abnormal rule creation, execute the step of mapping the key business elements to preset business domains and data fields to generate abnormal judgment rules.

[0094] S230. When the corpus type is the data query, execute the preset database query step.

[0095] In this implementation, one process is achieved through an "intent recognition submodule," the core of which is to distinguish whether the user input corpus is used for "creating exception rules" or "querying data," thus avoiding process confusion.

[0096] First, the intent recognition submodule receives key business elements output by the semantic model, including entities, attributes, and conditions, and analyzes them in conjunction with the sentence structure features of the original corpus. For example, if the original corpus is "Generate a rule for the same component to be repaired twice within 3 months", the sentence structure "generate... rule" directly points to the intent of "creating a rule"; if the corpus is "How many users in the Guzhen branch have exceeded their power capacity?", the interrogative sentence structure "How many..." points to the intent of "data query".

[0097] Next, the trained "intent classification model" is invoked. This model is trained on an annotated corpus containing a large number of samples labeled "rule creation" or "data query". The model analyzes keywords in the corpus (such as "generate", "create", "rule" corresponding to rule creation; "how many", "query", "what are" corresponding to data query), sentence structure (declarative sentences are mostly rule creation, interrogative sentences are mostly data query), and the completeness of business elements (rule creation requires complete elements such as entity and conditions, while query may only require entity and scope), and outputs intent classification results.

[0098] When the intent classification result is "Abnormal Rule Creation", the system triggers the rule generation process: matching the extracted business elements with the preset business domain mapping table to determine the corresponding business system (such as administrative office, marketing), then associating the specific data fields through the data source mapping table (such as "repair time" corresponding to "vehicle repair record. repair date"). Subsequently, the system calls the rule template library, fills the business elements into the matching template (such as the time-value combination template), generates an executable abnormal judgment rule, and stores it in the rule engine library.

[0099] If the intended classification result is "data query", the system will directly enter the data query process: based on the extracted entities and scope conditions (such as "Guzhen Branch" and "overcapacity electricity users"), generate the corresponding query statement (such as SQL), access the associated business database, filter the data that meets the conditions, and return the results to the user in a visual form (such as tables and charts). For example, for "How many overcapacity electricity users are there in Guzhen Branch", the system generates a query statement to count the number of users that meet the condition "actual load > applied capacity", and returns the specific value and details.

[0100] To ensure the accuracy of intent recognition, the system also sets a "confidence threshold" (e.g., 80%). When the confidence level of the intent classification output by the model falls below the threshold, a manual confirmation process is triggered, presenting the user with options such as "Do you want to create a rule?" or "Do you want to query data?" The user confirms before proceeding with the corresponding process. Simultaneously, cases of manual correction are recorded to optimize the intent classification model and gradually improve the accuracy of automatic recognition.

[0101] This mechanism, through clear intent-based traffic routing, avoids confusion between rule creation and data query processes, ensuring that user needs are met through the most direct path. For example, non-technical personnel do not need to distinguish technical processes; they can simply express their needs in natural language, and the system can automatically determine whether to generate rules or return data. This significantly lowers the barrier to entry and improves response efficiency, providing more flexible support for routine supervision through "big data + inspection."

[0102] Example 6:

[0103] See Figure 6 In one embodiment, S100, the semantic model is obtained through the following steps:

[0104] S110. Obtain existing anomaly rules, transcribe the existing anomaly rules into natural language and annotate them. The annotation includes: annotation time, object, threshold business element, user demand type and business domain, to obtain a training dataset; wherein, the user demand type includes anomaly rule creation and data query.

[0105] S120. Based on the training dataset, a supervised learning algorithm is used to train the preset initial semantic model to obtain the semantic model.

[0106] In one embodiment, the initial semantic model is one of BERT, RoBERTa, or Chinese BERT-base.

[0107] In this implementation, building the training corpus requires collecting existing anomaly rules. These rules are derived from experience summaries from historical inspections and the standardized requirements of business systems. These rules are then transcribed into natural language expressions. For example, "temporary electricity use for more than 6 months without conversion to formal electricity use and monthly average electricity consumption exceeding 1000 kWh" is transcribed as "find users whose temporary electricity use for more than half a year has not been converted to formal electricity use and whose monthly electricity consumption exceeds 1000 kWh." The transcribed corpus needs to be annotated in multiple dimensions, including time elements such as "6 months" and "half a year," object elements such as "temporary electricity use" and "user," and threshold elements such as "1000 kWh." It also needs to be labeled with the user's request type (whether it's an anomaly rule creation or a data query) and the business domain (e.g., marketing, engineering construction), forming a structured training dataset.

[0108] Based on the constructed training dataset, a supervised learning algorithm is used to train the initial semantic model. The initial semantic model can be one of BERT, RoBERTa, or Chinese BERT-base, all of which have strong foundational capabilities in the field of natural language processing. During training, labeled corpora are input into the model, and by adjusting the model parameters, it learns the mapping relationship between business elements and labeled tags. For example, when the input contains corpora containing "generate...rules," the model learns to classify it as an abnormal rule creation; when the input contains corpora containing elements such as time, object, and threshold, the model can accurately identify and extract these business elements.

[0109] Through continuous iterative training, the model gradually optimizes its ability to understand business language, ultimately resulting in a semantic model suitable for specific fields such as power grid inspection. This well-trained semantic model can accurately parse the natural language requirements input by users, identify the business elements and intent types within them, and provide a reliable semantic foundation for subsequent rule generation or data querying.

[0110] The above is a method for intelligently generating big data anomaly rules provided in the embodiments of the present invention. The following is a system for intelligently generating big data anomaly rules provided in the embodiments of the present invention.

[0111] See Figure 7 Furthermore, to achieve the above objectives, the present invention also provides a big data anomaly rule intelligent generation system, comprising:

[0112] Module 10 is used to acquire corpora and semantic models;

[0113] The parsing module 20 is used to parse the corpus through the semantic model and extract key business elements;

[0114] The generation unit 30 is used to map the key business elements to preset business domains and data fields, and generate anomaly judgment rules.

[0115] In this embodiment, the acquired corpus first includes anomaly detection rules formed during historical inspections, actual data records in the business system, and daily supervision requests from employees. This corpus, after being organized and labeled, forms the basis for training the semantic model. The semantic model is optimized based on a general natural language processing model, combined with business terminology and scenario features specific to fields such as power grid inspections, enabling it to accurately understand natural language expressions within the domain. In practical implementation, when a user inputs a supervision request in natural language form, such as "find vehicles that have had the same part repaired twice within the last 3 months," the semantic model performs deep analysis on the corpus, extracting key business elements, including entities such as vehicles and parts, attributes such as repair time and number of repairs, and conditions such as "within 3 months" and "repeatedly repaired twice." Subsequently, based on these business elements, and referring to a preset business domain classification, they are mapped to the corresponding business domain, such as the administrative office domain, and associated with specific data fields in the business system through a data source mapping table (such as the entity attribute-system field mapping table in the following embodiment), such as the repair time field and part name field in the vehicle repair record. Based on the extracted conditions and mapped fields, the system calls a preset rule template library, such as time-based templates and numerical comparison templates, to automatically assemble and generate executable exception handling rules, such as corresponding SQL scripts or rule engine scripts.

[0116] This invention leverages natural language processing (NLP) technology to transform semantics into business elements, and provides collaborative support from a rule template library and a data source mapping table. The semantic model, trained on domain corpora, possesses the ability to recognize business terms and parse logical relationships, transforming the natural language requirements of non-technical personnel into structured business elements. The rule template library extracts common logic based on historical rules, providing a reusable logical framework for different types of business needs. The data source mapping table ensures a precise correspondence between business elements and actual business data fields, enabling the generated rules to directly apply to business system data.

[0117] Understandably, this invention first requires the collection and organization of corpora, including sorting out historical inspection rules, business data dictionaries, employee requirement records, etc., to form a corpus covering multiple business domains, and labeling the corpus with tags such as entities, attributes, and conditions. Based on this corpus, a domain-adaptive training method is used to optimize the semantic model, enabling it to accurately understand professional expressions such as "excessive electricity consumption" and "abnormal connection between the three calculations." When a user inputs a supervision requirement through natural language, the semantic model performs word segmentation, entity recognition, and logical parsing on the input text, extracting business elements such as the supervision object, key indicators, time range, and numerical thresholds. Next, the corresponding business domain is determined based on the extracted elements, such as the marketing domain, and the specific data fields corresponding to the elements are found through the data source mapping table, such as the application capacity field and load collection field in the electricity consumption file. Subsequently, based on the logical relationship of the elements, such as "actual value is greater than standard value," the corresponding template in the rule template library is matched, and the specific parameters are filled in to generate the initial rule. The generated rules will be tested by the testing module to verify their accuracy using historical business data. This includes checking whether the rules can accurately hit known anomaly cases. If there are deviations, the system will be fed back for parameter adjustment, ultimately forming anomaly judgment rules that can be directly used in the business system.

[0118] The intelligent generation method for big data anomaly rules in this invention effectively solves the problems of low efficiency and insufficient accuracy in traditional manual rule formulation. It allows non-technical personnel to generate rules using only natural language, without needing to master coding or complex rule syntax, significantly shortening the rule formulation cycle. The combination of semantic models and rule template libraries ensures that rules are tailored to business scenarios, reducing omissions and misjudgments. Furthermore, the precise mapping of data sources enables rules to directly apply to business data, achieving automatic screening of anomalies. This significantly improves the efficiency and accuracy of inspection and other supervisory work, providing strong support for routine supervision in a big data environment.

[0119] In one embodiment, when the key business elements include: a first entity and first entity attributes, a first numerical condition, a first time condition, and a first logical relationship, the generation unit 30 is specifically used for:

[0120] Obtain a preset logic template, wherein the preset logic template includes at least two of the following: a first entity field, a first numerical condition field, a first time condition field, and a first logical relationship field;

[0121] The second entity is obtained by matching the attributes of the first entity with the data fields of the corresponding business system;

[0122] Select the corresponding logical template according to the semantic type, fill the second entity, the first numerical condition, the first time condition, and the first logical relationship into the corresponding first entity field, first numerical condition field, first time condition field, and first logical relationship field, and generate the anomaly judgment rule.

[0123] It should be noted that the method for generating anomaly judgment rules based on business element mapping proposed in this embodiment achieves accurate conversion of business elements into anomaly rules through a systematic parsing and matching mechanism, reduces manual intervention, improves the efficiency and accuracy of rule generation, and enables non-technical personnel to quickly generate effective anomaly judgment rules through natural language, thus better supporting inspection and other supervisory work.

[0124] In this embodiment, multiple logical templates are preset. These templates are extracted based on historical anomaly rules and cover different business scenarios. Each template contains a specific combination of fields. For example, the time-based template contains a first entity field, a first time condition field, and a first logical relation field, while the numerical comparison template contains a first entity field, a first numerical condition field, and a first logical relation field. These fields reserve space for subsequent element filling. When a user inputs a supervision request in natural language, the trained semantic model performs deep analysis on the corpus. For example, it analyzes "vehicles that have had the same part repaired twice within 3 months" into the first entity "vehicle", the first entity attributes "repaired parts" and "repair times", the first time condition "within 3 months", the first numerical condition "repeatedly repaired twice", and the first logical relation "and".

[0125] Next, based on the parsed first entity attributes, such as "repair parts" and "repair count," they are matched against a pre-defined data source mapping table. This data source mapping table records the correspondence between entity attributes in each business domain and the corresponding data fields in the business system. For example, "repair parts" corresponds to the "part name" field in the vehicle repair records of the administrative office system, and "repair count" corresponds to the "number of repair records" field. Through this matching, the first entity "vehicle" is precisely associated with specific business system data, forming a second entity—that is, entity information containing specific data fields.

[0126] Subsequently, based on the condition types obtained from semantic parsing, such as combinations of time and numerical conditions, a corresponding template is selected from preset logical templates, such as a time-numerical combination template. After selecting a template, the matched second entity is filled into the first entity field of the template, the parsed first time condition "within 3 months" is filled into the first time condition field, the first numerical condition "repeated repairs 2 times" is filled into the first numerical condition field, and the first logical relation "AND" is filled into the first logical relation field, thus completing the template filling.

[0127] The populated template is automatically converted into executable rule statements, such as corresponding SQL query statements or rule engine scripts. These statements can directly call data from the business system for calculation and comparison. The generated rules are also verified by the testing module, which uses historical anomaly data to check whether the rules can accurately hit known anomalies. If there is a deviation, the parameters of element parsing or template matching will be adjusted in reverse until the rules meet the preset accuracy requirements.

[0128] In this way, business elements are accurately transformed into anomaly detection rules that can be applied to business data. This not only reduces the errors and time required for manual transformation but also allows non-technical personnel to directly participate in rule creation, significantly improving the efficiency and applicability of rule generation. The generated rules can be quickly applied to business systems to achieve automatic screening and early warning of abnormal data, providing accurate and efficient technical support for supervision work and effectively solving the problems of slow rule creation and low matching accuracy under traditional manual methods.

[0129] In one embodiment, the big data anomaly rule intelligent generation system of the present invention further includes: a storage unit, used to: convert the anomaly judgment rule into a system-executable script and store it in the rule engine library.

[0130] In this implementation, after the anomaly detection rules are generated, they are converted into a specific executable script format according to the target system's technical architecture and the requirements of the rule engine. For example, for a system based on the Drools rule engine, the rules are converted into a .drl format script supported by Drools. This script uses a syntax structure specific to the rule engine, including a conditional part (when) and an action part (then), which can clearly express business logic. During the conversion process, the entities, conditions, logical relationships, and other elements in the rules are automatically mapped to the corresponding elements in the script, ensuring that the semantics of the rules remain unchanged after conversion.

[0131] After the scripts are transformed, these executable scripts are stored in the rule engine library. The rule engine library is a centralized storage system that uses a categorized management approach, storing different types of rule scripts in corresponding directories based on business domains, such as administrative office rules, engineering construction rules, and marketing rules. Each rule script is associated with detailed metadata, including the rule name, creation time, applicable business scenario, and creator information, facilitating subsequent querying and management. Furthermore, the rule engine library supports version control; when rules need to be updated, historical versions are retained for traceability and comparison.

[0132] In this implementation, the rule engine library is integrated with the rule execution module of the business system. When the business system needs to screen for abnormal data, it automatically calls the corresponding script from the rule engine library and loads it into the rule engine for execution. The rule engine performs real-time analysis and comparison of the business data according to the logic in the script. Once data that meets the abnormal conditions is found, the corresponding early warning mechanism is immediately triggered, and the abnormal information is fed back to the supervisors.

[0133] In this way, the generated anomaly detection rules can be quickly and accurately transformed into executable scripts for effective management and invocation, achieving full automation from rule generation to execution. This not only reduces manual intervention and lowers implementation costs but also improves the efficiency and accuracy of rule execution, enabling more timely and effective detection of business anomalies and providing strong support for the company's compliant operations. Simultaneously, the centralized management of the rule engine library facilitates rule reuse and optimization, promotes the accumulation and transfer of supervisory experience, and further enhances the company's supervisory capabilities and management level.

[0134] In one embodiment, the step of matching the first entity attribute with the data fields of the corresponding business system to obtain the second entity in the parsing module 20 includes:

[0135] Retrieve the pre-built entity attribute-system field mapping table

[0136] Based on the entity attribute-system field mapping table, the first entity and its attributes are matched with fields in the preset business domain, data dictionary, and rule template that have the same attributes to obtain the second entity.

[0137] In this implementation, an entity attribute-system field mapping table is pre-established in the system. This mapping table is compiled based on the data dictionary and historical business rules of each business system. It records the correspondence between common entity attributes in the business domain and specific data fields in the business system. For example, in the inspection scenario of the power industry, the mapping table will clearly specify that "user capacity" corresponds to the "application capacity" field in the marketing system, and "number of repairs" corresponds to the "number of repair records" field in the vehicle repair table of the administrative office system, etc.

[0138] When the system needs to match the first entity and its attributes obtained from semantic parsing with data fields in the business system, it first searches the mapping table for fields with the same or similar names as the first entity's attributes. For example, when the parsed first entity attribute is "repair time", the system searches the mapping table for fields containing "time" and related to "repair", finding fields such as the "repair date" field in the "vehicle repair record table" of the administrative office system. This associates the first entity "vehicle" with the field of that system, forming the second entity.

[0139] During the matching process, priority is given to cases of exact matches, where the entity attribute name is exactly the same as the field name in the mapping table. If no exact match is found, semantic similarity analysis is performed. By comparing the field descriptions, contextual relationships, etc., the field with the closest semantics is found for matching. For example, when the entity attribute is "overcapacity ratio," if there is no completely identical field in the mapping table, but there is a calculated field "actual load / applied capacity - 1," the two are associated by analyzing their business meaning.

[0140] To improve matching accuracy, the mapping table is updated regularly. As new business systems are integrated and business rules change, new mapping relationships are continuously added, while existing inaccurate mappings are corrected. Furthermore, the system supports manual intervention. When the automatic matching results do not meet expectations, users can manually adjust the matching relationships and add the correct mappings to the mapping table, further improving its accuracy.

[0141] This approach, based on the entity attribute-system field mapping table, achieves efficient and accurate conversion of business elements into system fields, providing accurate data support for the subsequent generation of anomaly detection rules. This automated matching mechanism not only reduces human error but also significantly improves matching efficiency, enabling rapid response to business needs and timely generation of effective anomaly detection rules, thereby enhancing the automation and accuracy of supervisory work such as inspections.

[0142] In one embodiment, the parsing module 20 is further configured to:

[0143] The semantic model is used to perform intent recognition on the corpus to obtain a corpus type, which includes anomaly rule creation and data query.

[0144] When the corpus type is the abnormal rule creation, the step of mapping the key business elements to preset business domains and data fields to generate abnormal judgment rules is executed;

[0145] When the corpus type is the data query, the preset steps of querying the database are executed.

[0146] In this implementation, one process is achieved through an "intent recognition submodule," the core of which is to distinguish whether the user input corpus is used for "creating exception rules" or "querying data," thus avoiding process confusion.

[0147] First, the intent recognition submodule receives key business elements output by the semantic model, including entities, attributes, and conditions, and analyzes them in conjunction with the sentence structure features of the original corpus. For example, if the original corpus is "Generate a rule for the same component to be repaired twice within 3 months", the sentence structure "generate... rule" directly points to the intent of "creating a rule"; if the corpus is "How many users in the Guzhen branch have exceeded their power capacity?", the interrogative sentence structure "How many..." points to the intent of "data query".

[0148] Next, the trained "intent classification model" is invoked. This model is trained on an annotated corpus containing a large number of samples labeled "rule creation" or "data query". The model analyzes keywords in the corpus (such as "generate", "create", "rule" corresponding to rule creation; "how many", "query", "what are" corresponding to data query), sentence structure (declarative sentences are mostly rule creation, interrogative sentences are mostly data query), and the completeness of business elements (rule creation requires complete elements such as entity and conditions, while query may only require entity and scope), and outputs intent classification results.

[0149] When the intent classification result is "Abnormal Rule Creation", the system triggers the rule generation process: matching the extracted business elements with the preset business domain mapping table to determine the corresponding business system (such as administrative office, marketing), then associating the specific data fields through the data source mapping table (such as "repair time" corresponding to "vehicle repair record. repair date"). Subsequently, the system calls the rule template library, fills the business elements into the matching template (such as the time-value combination template), generates an executable abnormal judgment rule, and stores it in the rule engine library.

[0150] If the intended classification result is "data query", the system will directly enter the data query process: based on the extracted entities and scope conditions (such as "Guzhen Branch" and "overcapacity electricity users"), generate the corresponding query statement (such as SQL), access the associated business database, filter the data that meets the conditions, and return the results to the user in a visual form (such as tables and charts). For example, for "How many overcapacity electricity users are there in Guzhen Branch", the system generates a query statement to count the number of users that meet the condition "actual load > applied capacity", and returns the specific value and details.

[0151] To ensure the accuracy of intent recognition, the system also sets a "confidence threshold" (e.g., 80%). When the confidence level of the intent classification output by the model falls below the threshold, a manual confirmation process is triggered, presenting the user with options such as "Do you want to create a rule?" or "Do you want to query data?" The user confirms before proceeding with the corresponding process. Simultaneously, cases of manual correction are recorded to optimize the intent classification model and gradually improve the accuracy of automatic recognition.

[0152] This mechanism, through clear intent-based traffic routing, avoids confusion between rule creation and data query processes, ensuring that user needs are met through the most direct path. For example, non-technical personnel do not need to distinguish technical processes; they can simply express their needs in natural language, and the system can automatically determine whether to generate rules or return data. This significantly lowers the barrier to entry and improves response efficiency, providing more flexible support for routine supervision through "big data + inspection."

[0153] In one embodiment, the semantic model in parsing module 20 is obtained through the following steps:

[0154] Obtain existing anomaly rules, transcribe them into natural language and annotate them. The annotation includes: annotation time, object, threshold business element, user demand type and business domain, to obtain a training dataset; wherein, the user demand type includes anomaly rule creation and data query.

[0155] Based on the training dataset, a supervised learning algorithm is used to train the preset initial semantic model to obtain the semantic model;

[0156] The initial semantic model is one of BERT, RoBERTa, or Chinese BERT-base.

[0157] In this implementation, building the training corpus requires collecting existing anomaly rules. These rules are derived from experience summaries from historical inspections and the standardized requirements of business systems. These rules are then transcribed into natural language expressions. For example, "temporary electricity use for more than 6 months without conversion to formal electricity use and monthly average electricity consumption exceeding 1000 kWh" is transcribed as "find users whose temporary electricity use for more than half a year has not been converted to formal electricity use and whose monthly electricity consumption exceeds 1000 kWh." The transcribed corpus needs to be annotated in multiple dimensions, including time elements such as "6 months" and "half a year," object elements such as "temporary electricity use" and "user," and threshold elements such as "1000 kWh." It also needs to be labeled with the user's request type (whether it's an anomaly rule creation or a data query) and the business domain (e.g., marketing, engineering construction), forming a structured training dataset.

[0158] Based on the constructed training dataset, a supervised learning algorithm is used to train the initial semantic model. The initial semantic model can be one of BERT, RoBERTa, or Chinese BERT-base, all of which have strong foundational capabilities in the field of natural language processing. During training, labeled corpora are input into the model, and by adjusting the model parameters, it learns the mapping relationship between business elements and labeled tags. For example, when the input contains corpora containing "generate...rules," the model learns to classify it as an abnormal rule creation; when the input contains corpora containing elements such as time, object, and threshold, the model can accurately identify and extract these business elements.

[0159] Through continuous iterative training, the model gradually optimizes its ability to understand business language, ultimately resulting in a semantic model suitable for specific fields such as power grid inspection. This well-trained semantic model can accurately parse the natural language requirements input by users, identify the business elements and intent types within them, and provide a reliable semantic foundation for subsequent rule generation or data querying.

[0160] Furthermore, this embodiment of the invention also provides a big data anomaly rule intelligent generation device, the device including a processor and a memory:

[0161] The memory is used to store program code and transmit the program code to the processor;

[0162] The processor is used to execute the steps of the intelligent generation method for big data anomaly rules as described in the above method embodiments, according to the instructions in the program code.

[0163] Furthermore, this embodiment of the invention also provides a computer-readable storage medium for storing program code, which is used to execute the intelligent generation method for big data anomaly rules described in the above method embodiments.

[0164] One or more technical solutions proposed in this invention have at least the following technical effects:

[0165] By acquiring corpora and semantic models, parsing the corpora using the semantic model to extract key business elements, and mapping these elements to preset business domains and data fields to generate anomaly detection rules, this method effectively solves the problems of low efficiency and insufficient accuracy in traditional manual rule formulation. Non-technical personnel do not need to master code or complex rule syntax; they can generate rules simply through natural language, significantly shortening the rule formulation cycle.

[0166] This invention primarily employs the following methods: constructing a semantic model trained on domain corpora to accurately analyze natural language requirements and extract key business elements such as time, object, and threshold; establishing an entity attribute-system field mapping table to achieve automated matching of business elements with business system data fields; pre-setting a rule template library covering multiple business scenarios to support the rapid assembly of anomaly judgment rules based on the analyzed elements; distinguishing between rule creation and data query requirements through intent recognition to achieve precise process diversion; and converting the generated rules into executable scripts for the rule engine and centrally storing them in the rule engine library for automated invocation and execution.

[0167] It overcomes the shortcomings of traditional exception rule formulation, which relies on manual conversion of natural language, resulting in low efficiency and inaccurate rules due to misunderstandings; non-technical personnel lack the technical background to participate in rule formulation; the matching of business elements and system data fields relies on human experience, which is prone to field correspondence errors; the confusion between rules and data query intent leads to process disorder; and the generated rules are difficult to directly integrate into the system for automated execution, affecting supervision efficiency.

[0168] The technical solution of this invention enables non-technical personnel to quickly generate effective anomaly judgment rules using only natural language, significantly lowering the technical threshold for rule formulation. The automation of semantic parsing and field mapping reduces errors caused by manual intervention, improving the accuracy and generation efficiency of rules. Intent recognition ensures precise process routing, avoiding confusion between rule creation and data querying. The automated conversion and storage of rule scripts achieves full-process automation from rule generation to execution, enabling timely and accurate identification of business anomalies in supervisory work. This significantly enhances the automation level and accuracy of supervisory work such as inspections, providing efficient support for enterprise compliance operations.

[0169] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the equipment and media described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0170] In the embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0171] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0172] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0173] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0174] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A big data anomaly rule intelligent generation method, characterized in that, include: Acquire corpus and semantic model; The semantic model is used to parse the corpus and extract key business elements; The key business elements are mapped to preset business domains and data fields to generate anomaly detection rules. 2.The method of claim 1, wherein, When the key business elements include: a first entity and its attributes, a first numerical condition, a first time condition, and a first logical relationship, the step of mapping the key business elements to preset business domains and data fields to generate anomaly judgment rules includes: Obtain a preset logic template, wherein the preset logic template includes at least two of the following: a first entity field, a first numerical condition field, a first time condition field, and a first logical relationship field; The second entity is obtained by matching the attributes of the first entity with the data fields of the corresponding business system; Select the corresponding logical template according to the semantic type, fill the second entity, the first numerical condition, the first time condition, and the first logical relationship into the corresponding first entity field, first numerical condition field, first time condition field, and first logical relationship field, and generate the anomaly judgment rule. 3.The method of claim 2, wherein, The step of matching the attributes of the first entity with the data fields of the corresponding business system to obtain the second entity includes: Retrieve the pre-built entity attribute-system field mapping table Based on the entity attribute-system field mapping table, the first entity and its attributes are matched with fields in the preset business domain, data dictionary, and rule template that have the same attributes to obtain the second entity. 4.The method of claim 1, wherein, The step of parsing the corpus using the semantic model to extract key business elements also includes: The semantic model is used to perform intent recognition on the corpus to obtain a corpus type, which includes anomaly rule creation and data query. When the corpus type is the abnormal rule creation, the step of mapping the key business elements to preset business domains and data fields to generate abnormal judgment rules is executed; When the corpus type is the data query, the preset steps of querying the database are executed. 5.The method of claim 4, wherein, The semantic model is obtained through the following steps: Obtain existing anomaly rules, transcribe them into natural language and annotate them. The annotation includes: annotation time, object, threshold business element, user demand type and business domain, to obtain a training dataset; wherein, the user demand type includes anomaly rule creation and data query. Based on the training dataset, a supervised learning algorithm is used to train the preset initial semantic model to obtain the semantic model. 6.The method of claim 5, wherein, The initial semantic model is one of BERT, RoBERTa, or Chinese BERT-base. 7.The method of claim 1, wherein, The generated anomaly determination rules then include: The anomaly detection rules are converted into executable scripts and stored in the rule engine library.

8. A big data anomaly rule intelligent generation system, characterized in that, include: Acquisition unit, used to acquire corpus and semantic model; The parsing unit is used to parse the corpus using the semantic model and extract key business elements; The generation unit is used to map the key business elements to preset business domains and data fields, and generate anomaly judgment rules.

9. A big data anomaly rule intelligent generation device, characterized in that, The device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the intelligent generation method for big data anomaly rules according to any one of claims 1-7, based on the instructions in the program code.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code, which is used to execute the intelligent generation method for big data anomaly rules according to any one of claims 1-7.

Images