An abnormal index root cause positioning method, system and device

Abstract

The application discloses a kind of root cause positioning method, system and equipment of abnormal index, belong to power grid monitoring technical field, the method is: to knowledge data is carried out entity analysis, obtains multiple entities and the causal influence relationship between any two index entities;For any two index entities that exist causal influence relationship, and based on the preset graph neural network, determine causal conduction coefficient, determine influence weight in combination with causal conduction coefficient and pearson correlation coefficient;Time series data and associated influence factor data are input into time series prediction model, to obtain predicted value;According to the deviation of predicted value and preset reference value, determine whether abnormal;If yes, then determine abnormal index, according to the influence weight of index entity that exists causal influence relationship with abnormal index, determine root cause node, therefore, by implementing the application, the efficiency and accuracy of root cause positioning can be improved.

Description

Technical Field

[0001] This invention relates to the field of power grid monitoring technology, and in particular to a method, system and device for root cause localization of abnormal indicators. Background Technology

[0002] Power grid operation monitoring (hereinafter referred to as "O&M") is a core component of power grid enterprises' strategic control, business management, and safe production. Key O&M indicators such as electricity sales, line loss rate, and electricity bill collection rate directly reflect the operating efficiency, service quality, and operational safety of power grid enterprises. With the continuous expansion of power grid construction, the high proportion of new energy grid connection, and the deepening of power market reform, power grid O&M data exhibits characteristics of multi-source heterogeneity, multi-dimensionality, high time series, and complex influencing factors. Therefore, early warning of anomalies in O&M indicators and accurate attribution of anomalies are highly complex.

[0003] Currently, existing technologies provide a method for root cause localization of abnormal power grid operation and monitoring indicators. This method extracts equipment entities, attribute entities, and relationships from multi-source power grid datasets to construct a time-series event knowledge graph. Structured knowledge graph information is extracted from the time-series event knowledge graph, combined with prompt word templates, and input into a large language model for causal reasoning, outputting a set of causal chains. The causal chains are then transformed into a causal directed graph, and further into a sequence constraint graph. The optimal causal path is searched within the search space defined by the sequence constraint graph to generate a causal model. Real-time data streams are acquired, and risk identification and root cause localization are performed based on the causal model.

[0004] However, existing technologies that generate causal chains through large language models can only reflect whether there is a causal relationship between entities. When abnormal indicators are associated with multiple factors at the same time, it is difficult for operation and monitoring personnel to determine which of the multiple possible associated factors is the main root cause of the anomaly, resulting in low efficiency and poor accuracy in root cause localization. Summary of the Invention

[0005] This invention provides a method, system, and device for root cause localization of abnormal indicators, which can solve the problems of low efficiency and poor accuracy of root cause localization of knowledge graphs in multi-factor scenarios in the prior art.

[0006] This invention provides a root cause localization method for abnormal indicators, comprising: Acquire knowledge data, time series data, and related influencing factor data in the field of power grid operation and monitoring; perform entity analysis on the knowledge data to obtain multiple indicator entities and the causal relationship between any two indicator entities; wherein the related influencing factor data is used to characterize the data corresponding to the external environmental factors that affect the changes in power grid operation and monitoring indicators. For any two indicator entities that have a causal relationship, a child indicator entity and a parent indicator entity are determined. Based on a preset graph neural network, the causal transmission coefficient between the child indicator entity and the parent indicator entity is determined. Combining the causal transmission coefficient and the Pearson correlation coefficient, the influence weight of the child indicator entity on the parent indicator entity is determined. The time series data and the related influencing factor data are input into a preset time series prediction model to obtain the predicted values ​​of each indicator entity. Based on the deviation between the predicted value and the preset benchmark value of the corresponding indicator entity, it is determined whether it is abnormal; if so, the abnormal indicator is identified, and the root cause node is determined based on the influence weight of at least one indicator entity that has a causal relationship with the abnormal indicator.

[0007] This invention combines the causal transmission coefficient mined by graph neural networks with the Pearson correlation coefficient to transform the qualitative causal relationship in traditional knowledge graphs into quantifiable influence weights. This enables the objective differentiation of the influence of each factor on abnormal indicators in multi-factor scenarios based on the weight values, thereby accurately locating the root cause of the anomaly and effectively improving the accuracy and efficiency of root cause localization.

[0008] Furthermore, the determination of the influence weight of the sub-index entity on the parent index entity by combining the causal transmission coefficient and the Pearson correlation coefficient specifically involves: The business logic verification coefficient is determined by judging whether the causal relationship between the sub-index entity and the parent index entity conforms to the preset business logic. The influence weight is determined by multiplying the causal transmission coefficient, the Pearson correlation coefficient, and the business logic verification coefficient.

[0009] This approach introduces a business logic verification coefficient to verify the product of the causal transmission coefficient and the Pearson correlation coefficient. When the causal relationship between two indicator entities does not conform to the preset business logic, the business logic verification coefficient takes the second value (such as 0), making the influence weight zero. This eliminates the interference of correlation that is statistically relevant but not logically valid, ensuring that the calculated influence weight conforms to both mathematical statistics and the actual situation of power grid operation and monitoring, further improving the accuracy of root cause location.

[0010] Furthermore, after determining the root cause node, the process also includes: Get the preset attribution analysis prompt word template; Based on the root cause node, retrieve related reference information from the preset knowledge base; The root cause node and the associated reference information are processed according to the preset attribution analysis prompt word template to obtain the target attribution prompt word; The target attribution prompts are input into a preset large language model to obtain attribution analysis results.

[0011] In this way, after locating the root cause node, reference information associated with the root cause node is retrieved from the knowledge base as factual basis, and the root cause node and reference information are jointly input into the large language model to generate attribution analysis results. This ensures that the output of the large language model is based on traceable reference information rather than being freely generated, thus avoiding attribution bias caused by model illusion.

[0012] Furthermore, before inputting the time series data and the related influencing factor data into the preset time series prediction model, the method further includes: According to a preset period, a predicted trigger signal is obtained periodically; In response to the prediction trigger signal, the time series data and the related influencing factor data are input into a preset time series prediction model.

[0013] By automatically triggering periodic predictions and anomaly detection of power grid operation and monitoring indicators through preset cycles, batch scanning of all indicators can be completed without manual intervention, realizing automated and routine monitoring of operation and monitoring indicators and improving the timeliness and comprehensiveness of operation and monitoring work.

[0014] Furthermore, before inputting the time series data and the related influencing factor data into the preset time series prediction model, the specific steps are as follows: Obtain the user's natural language query commands and preset intent analysis prompt word templates; The natural language query command is processed according to the preset intent analysis prompt word template to obtain the target query prompt word; Input the target query prompts into a preset large language model to obtain the intent type and the target indicator entities involved in the query instruction; When the intent type is a prediction intent, a prediction trigger signal is obtained for the target indicator entity; In response to the prediction trigger signal, the time series data corresponding to the target indicator entity and the related influencing factor data are input into the time series prediction model.

[0015] By using pre-defined intent analysis prompt word templates to constrain the large language model's parsing of user natural language query commands, even non-professional users can initiate on-demand alert queries for specific indicators, units, or time periods through natural language interaction, thus lowering the barrier to entry. At the same time, the format constraints of the prompt word templates effectively prevent fabrication behavior that may occur when the large language model extracts key information, ensuring that the extracted target indicator entity information is accurate and reliable, and providing precise input parameters for subsequent prediction and root cause localization.

[0016] Furthermore, before inputting the time series data and the related influencing factor data into the preset time series prediction model, the method further includes: The time series data is subjected to missing value imputation, anomaly removal and normalization respectively to obtain preprocessed time series data; The structured data in the data of the related influencing factors is subjected to missing value filling, anomaly removal and normalization. The unstructured text data in the data of the related influencing factors is subjected to cleaning, block processing and vectorization to obtain the preprocessed data of the related influencing factors. The preprocessed time series data and the preprocessed data of related influencing factors are input into a preset time series prediction model.

[0017] This approach, involving missing value imputation, anomaly removal, and normalization of time-series data, eliminates missing values, noise, and dimensional differences generated during data collection, enabling the prediction model to accurately capture historical patterns of indicator changes. Furthermore, addressing the differences between structured and unstructured text data in the data on related influencing factors, corresponding preprocessing is performed: structured data undergoes missing value imputation, anomaly removal, and normalization to form standardized numerical features, while unstructured text data is cleaned, segmented, and vectorized to form computable semantic features. This allows the prediction model to effectively utilize multi-source, heterogeneous data on related influencing factors, improving the accuracy and reliability of predicted values.

[0018] Furthermore, after determining the root cause node, the process also includes: Retrieve warning records within a preset time period; Based on the warning records, determine the first number of anomalies used to characterize correct warnings, the second number of anomalies used to characterize incorrect warnings, and the third number of anomalies used to characterize missed warnings within the preset time period. The accuracy rate is calculated based on the first number of anomalies and the second number of anomalies. The recall rate is calculated based on the first number of anomalies and the third number of anomalies. The target evaluation score is calculated based on the accuracy and recall. When the target evaluation score is less than the preset evaluation threshold, the time series prediction model is updated.

[0019] By statistically analyzing the warning records within a preset time period, the model's performance is quantitatively evaluated from multiple dimensions using accuracy, recall, and F1 score. When the overall evaluation score falls below a preset standard, the model is automatically updated, allowing the predictive capability to be continuously optimized as actual operational data accumulates. This avoids the problem of the model gradually becoming ineffective due to changes in the business environment, ensuring the stability and reliability of long-term operation.

[0020] Another embodiment of the present invention provides a root cause localization system for anomaly indicators, including: a data processing module, a weight calculation module, a time series prediction module, and a root cause localization module; The data processing module is used to acquire knowledge data, time series data and related influencing factor data in the field of power grid operation and monitoring, perform entity analysis on the knowledge data to obtain multiple indicator entities and the causal relationship between any two indicator entities, wherein the related influencing factor data is used to characterize the data corresponding to the external environmental factors that affect the changes in power grid operation and monitoring indicators. The weight calculation module is used to determine the child indicator entity and the parent indicator entity for any two indicator entities that have a causal relationship, and to determine the causal transmission coefficient between the child indicator entity and the parent indicator entity based on a preset graph neural network. Combining the causal transmission coefficient and the Pearson correlation coefficient, the module determines the influence weight of the child indicator entity on the parent indicator entity. The time series prediction module is used to input the time series data and the related influencing factor data into a preset time series prediction model to obtain the predicted value of each indicator entity. The root cause localization module is used to determine whether there is an anomaly based on the deviation between the predicted value and the preset benchmark value of the corresponding indicator entity; if so, it determines the abnormal indicator and determines the root cause node based on the influence weight of at least one indicator entity that has a causal relationship with the abnormal indicator.

[0021] Another embodiment of the present invention provides a terminal device, including: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the steps of the root cause localization method for abnormal indicators as described in the present invention.

[0022] Another embodiment of the present invention also provides a computer-readable storage medium item, including: a stored computer program, which, when the computer program is running, controls the device where the computer-readable storage medium is located to perform the steps of the root cause localization method of the abnormal indicators of the present invention. Attached Figure Description

[0023] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating a root cause localization method for anomaly indicators provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of a root cause localization system for anomaly indicators provided in an embodiment of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0027] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0028] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0029] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0030] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0031] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0032] See Figure 1 To address the issues of low efficiency and poor accuracy in root cause localization of knowledge graphs in multi-factor scenarios in existing technologies, an embodiment of the present invention provides a root cause localization method for anomaly indicators, comprising: Step 101: Obtain knowledge data, time series data, and related influencing factor data in the field of power grid operation and monitoring. Perform entity analysis on the knowledge data to obtain multiple indicator entities and the causal relationship between any two indicator entities. The related influencing factor data is used to characterize the data corresponding to the external environmental factors that affect the changes in power grid operation and monitoring indicators.

[0033] In this step, taking the application of this method on a server as an example, the server collects the following three types of multi-source data through the power grid strategic operation and control platform, various business systems, and document management system: time series data of operation and monitoring indicators, knowledge data in the operation and monitoring field, and data on related influencing factors. ① Operation and monitoring indicator time series data: including full historical time series data of operation and monitoring indicators at all levels such as electricity sales, line loss rate, electricity bill collection rate, and 12398 responsible complaint and reporting rate. Data dimensions include indicator name, statistical period, indicator value, affiliated unit (provincial / municipal / district power supply unit), timestamp, and statistical caliber explanation; ② Knowledge data in the field of power grid operation and supervision: including unstructured / semi-structured document data such as power grid operation and supervision management system, indicator definition specifications, historical anomaly analysis reports, monthly operation and supervision reports, emergency response plans, industry standards, and technical documents; ③ Related influencing factors data: including meteorological data, regional economic data, new energy grid connection data, electricity market transaction data, major power supply guarantee events, power grid maintenance plans, and other internal and external data that are strongly correlated with indicator anomalies.

[0034] After data collection is completed, the server associates and binds all data by timestamp, indicator ID, and unit ID, and stores it in the power grid operation and monitoring database. The database also stores the power grid organizational structure and historical detection and handling records to provide a reference for subsequent result verification.

[0035] Step 102: For any two indicator entities that have a causal relationship, determine the sub-indicator entity and the parent indicator entity, and based on a preset graph neural network, determine the causal transmission coefficient between the sub-indicator entity and the parent indicator entity. Combine the causal transmission coefficient and the Pearson correlation coefficient to determine the influence weight of the sub-indicator entity on the parent indicator entity.

[0036] In this step, the server constructs a dedicated knowledge graph for power grid operation and monitoring. First, the ontology architecture of the knowledge graph is defined. The core entities include five types of entities: indicator entities (operation and monitoring indicators at all levels, including indicator ID, name, definition, statistical scope, threshold range, and level), organizational entities (provincial / municipal / county power supply units), abnormal event entities (historical abnormality records, abnormality level, occurrence time, and scope of impact), influencing factor entities (related factors such as meteorology, economy, and new energy), and handling measure entities (historical handling plans, emergency plans, and implementation effects). The core relationships between entities include hierarchical affiliation, causal influence, related abnormality, and corresponding handling.

[0037] Based on the Qwen2.5-72B large language model, entity and relation extraction is performed on knowledge data in the operation and monitoring field. Combining the business logic and mathematical statistical correlation between indicators, the causal influence transmission path between indicators is constructed. The PGO-KG graph neural network algorithm is used to deeply mine and optimize the influence weights between multi-level indicators, and determine the causal transmission coefficient of sub-indicator entities to parent indicator entities.

[0038] Finally, the completed knowledge graph is stored in a graph database for subsequent causal inference, correlation anomaly retrieval, and influence path visualization.

[0039] As an example of an embodiment of the present invention, the step of determining the influence weight of the sub-index entity on the parent index entity by combining the causal transmission coefficient and the Pearson correlation coefficient specifically involves: The business logic verification coefficient is determined by judging whether the causal relationship between the sub-index entity and the parent index entity conforms to the preset business logic. The influence weight is determined by multiplying the causal transmission coefficient, the Pearson correlation coefficient, and the business logic verification coefficient.

[0040] In this embodiment, the server obtains a preset business logic verification coefficient ρ. If the causal relationship between the sub-indicator entity and the parent indicator entity conforms to the preset business logic, then ρ is set to 1; otherwise, ρ is set to 0. For example, in the power grid operation monitoring business, "industrial electricity consumption" as a sub-indicator affects "electricity sales" as a parent indicator, which conforms to the business logic of power grid electricity sales, so ρ is set to 1; while there is no direct business logic relationship between "temperature" and "line loss rate", so ρ is set to 0.

[0041] The server calculates the Pearson correlation coefficient Corr(X) between the child indicator entity and the parent indicator entity. i , X j ), and the causal transmission coefficient γ obtained by mining through graph neural networks. ij Corr(X) i , X j γ is obtained by calculating the linear correlation between the historical time-series data of two indicators, reflecting the mathematical and statistical correlation between the two indicators. ij The PGO-KG graph neural network algorithm is used to deeply mine the causal influence paths between indicator nodes in the knowledge graph, reflecting the influence transmission strength of the sub-indicator on the parent indicator in the causal transmission path.

[0042] Finally, the server will verify the business logic coefficient ρ and the Pearson correlation coefficient Corr(X). i , X j ) and causal transmission coefficient γ ij Multiplying these three factors together yields the influence weight W of the child indicator entity on the parent indicator entity. ij The calculation formula can be expressed as: ; in, The weight of the influence of sub-indicator j on parent indicator i. This is the business logic verification coefficient (1 for compliance with power grid operation and monitoring business logic, 0 for non-compliance). Let Pearson correlation coefficient be the correlation coefficient between indicators i and j. This represents the causal transmission coefficient mined based on graph neural networks.

[0043] The server iterates through all parent-child indicator pairs with causal relationships in the knowledge graph in the manner described above, calculates the influence weight of each child indicator entity on its corresponding parent indicator entity, and stores the calculated influence weights as edge attributes of each causal relationship edge in the knowledge graph.

[0044] Step 103: Input the time series data and the related influencing factor data into a preset time series prediction model to obtain the predicted values ​​of each indicator entity.

[0045] In this embodiment, the server uses time-series data, along with influencing factor data, as input features to the prediction model, generating predicted values ​​for each indicator entity within the target period. The server iterates through all indicator entities in the manner described above to obtain the predicted values ​​for each indicator entity.

[0046] As a preferred implementation, the server provides a unified abstraction and encapsulation of the time-series forecasting and anomaly warning capabilities. It is compatible with classic time-series forecasting models (such as Prophet and LSTM) and large language model time-series forecasting capabilities, shielding the implementation details of the underlying models and providing a unified calling interface. This interface supports flexible invocation of different indicators, different organizational units, and different forecasting periods, and also supports flexible replacement and upgrading of the underlying model without affecting upper-layer business calls.

[0047] As an example of an embodiment of the present invention, before inputting the time series data and the related influencing factor data into a preset time series prediction model, the method further includes: The time series data is subjected to missing value imputation, anomaly removal and normalization respectively to obtain preprocessed time series data; The structured data in the data of the related influencing factors is subjected to missing value filling, anomaly removal and normalization. The unstructured text data in the data of the related influencing factors is subjected to cleaning, block processing and vectorization to obtain the preprocessed data of the related influencing factors. The preprocessed time series data and the preprocessed data of related influencing factors are input into a preset time series prediction model.

[0048] In this embodiment, the server performs differentiated preprocessing for different types of data, as follows: For the time-series data, missing value imputation, outlier removal, and normalization are performed sequentially. Specifically, missing values ​​are imputed using a combination of the historical mean of the same period and linear interpolation; outliers are removed using the 3σ criterion to eliminate data acquisition errors and invalid values; and the min-max normalization method is used to standardize the data, with the normalization formula expressed as: ; in, These are the original indicator values. , These are the maximum and minimum values ​​of the historical time series data for this indicator. This is the normalized value.

[0049] For structured data in the data on related influencing factors, missing value imputation, outlier removal, and normalization are also performed. For unstructured text data in the data on related influencing factors, cleaning, segmentation, and vectorization are performed sequentially: cleaning includes removing redundant symbols, garbled characters, consecutive spaces, newlines, invalid identifiers, and email addresses; segmentation adopts a parent-child segmentation mode, using segment identifiers (such as \n\n) as the segmentation basis, and setting the maximum segment length (such as 1024 characters) and the segment overlap length (such as 50 characters); vectorization uses the BGE-M3 multi-instance embedding model to vectorize the segmented text blocks, generating text embedding vectors, which are then uploaded to the DIFY platform to build a dedicated knowledge base for power grid operation and monitoring based on RAG (Retrieval Enhanced Generation).

[0050] Step 104: Determine whether the predicted value is abnormal based on the deviation between the predicted value and the preset benchmark value of the corresponding indicator entity; if so, determine the abnormal indicator and determine the root cause node based on the influence weight of at least one indicator entity that has a causal relationship with the abnormal indicator.

[0051] In this step, the server obtains a preset benchmark value for each indicator entity. This preset benchmark value is at least one of the indicator's target value, historical average for the same period, or reasonable fluctuation range. For each indicator, the server calculates the predicted value Y based on the model output. pred Compared with the preset reference value Y base Calculate the probability of abnormal deviation P anomaly The formula is expressed as follows: ; in, This represents the probability of indicator anomalies. This is the predicted value of the indicator. The benchmark value is set as the indicator, and the preset threshold is determined based on the statistical results of related reference information, the value set by business experts, or the dynamic adaptive adjustment strategy.

[0052] For each indicator entity, the server determines whether its anomaly deviation probability exceeds a preset threshold. If it does, the indicator entity is deemed abnormal, triggering an anomaly warning. When an anomaly warning is triggered, the server identifies the abnormal indicator and marks the following information for the abnormal indicator: indicator name, predicted value, baseline value, anomaly deviation probability, anomaly level, anomaly time period, and affiliated unit.

[0053] The server determines the root cause node based on the influence weight of at least one indicator entity that has a causal relationship with the abnormal indicator. Specifically, the server obtains the influence weight of each sub-indicator entity in the knowledge graph that has a causal relationship with the abnormal indicator, and determines the sub-indicator entity with the highest influence weight as the root cause node.

[0054] As an example of an embodiment of the present invention, after determining the root cause node, the method further includes: Get the preset attribution analysis prompt word template; Based on the root cause node, retrieve related reference information from the preset knowledge base; The root cause node and the associated reference information are processed according to the preset attribution analysis prompt word template to obtain the target attribution prompt word; The target attribution prompts are input into a preset large language model to obtain attribution analysis results.

[0055] In this embodiment, the server generates attribution analysis results after determining the root cause node.

[0056] First, based on the root cause node, the server retrieves reference information associated with the root cause node from a preset knowledge base. Specifically, the server retrieves at least one of the following from the preset knowledge base: historical anomaly cases, similar analysis reports, business specifications, or contingency plans that match the root cause node, as reference information to provide traceable factual basis for subsequent attribution analysis.

[0057] Next, the server obtains a preset attribution analysis prompt word template, and processes the root cause node and the reference information according to the attribution analysis prompt word template to generate target attribution prompt words. Specifically, the server writes the root cause node and the reference information into the corresponding positions of the attribution analysis prompt word template to form target attribution prompt words containing the root cause node and reference information.

[0058] Finally, the server inputs the target attribution prompts into a preset large language model to obtain the attribution analysis results. Specifically, the server inputs the target attribution prompts into the large language model, and constrains the large language model to output the attribution analysis results in a preset format through the attribution analysis prompt template. The attribution analysis results include a summary of the causes of the anomalies and handling recommendations; the summary of the causes of the anomalies is categorized by influencing factors, semantically similar causes are merged, and each category of causes includes corresponding reference information; the handling recommendations are generated by combining historical handling plans and business specifications.

[0059] As an example of an embodiment of the present invention, before inputting the time series data and the related influencing factor data into a preset time series prediction model, the method further includes: According to a preset period, a predicted trigger signal is obtained periodically; In response to the prediction trigger signal, the time series data and the related influencing factor data are input into a preset time series prediction model.

[0060] In this embodiment, the server is configured with a scheduled task that is automatically triggered at a preset period (such as daily or weekly) to traverse all indicator entities, obtain the corresponding time series data and related influencing factor data for each indicator entity, input them in batches into the time series prediction model, and perform prediction and anomaly detection.

[0061] As an example of an embodiment of the present invention, before inputting the time series data and the related influencing factor data into a preset time series prediction model, the specific steps are as follows: Obtain the user's natural language query commands and preset intent analysis prompt word templates; The natural language query command is processed according to the preset intent analysis prompt word template to obtain the target query prompt word; Input the target query prompts into a preset large language model to obtain the intent type and the target indicator entities involved in the query instruction; When the intent type is a prediction intent, a prediction trigger signal is obtained for the target indicator entity; In response to the prediction trigger signal, the time series data corresponding to the target indicator entity and the related influencing factor data are input into the time series prediction model.

[0062] In this embodiment, the server obtains the user's input natural language query command and a preset intent analysis prompt word template. This template is a set of prompt words written in a template format, adapted for dynamic parameter injection, and used to constrain the large language model to output intent parsing results according to a preset format. The server processes the natural language query command according to the intent analysis prompt word template, writing the natural language query command into the corresponding position of the template to generate a target query prompt word. The server inputs the target query prompt word into the Qwen2.5-72B large language model to obtain the intent type and the target indicator entity involved in the query command. The intent type includes prediction intent, attribution intent, and information query intent; the target indicator entity is the power grid operation monitoring indicator involved in the query command.

[0063] When the intent type is a prediction intent (e.g., a user queries "Will electricity sales in Guangdong decrease next month?"), the server generates a prediction trigger signal for the target indicator entity, and in response to the prediction trigger signal, inputs the time series data and related influencing factor data corresponding to the target indicator entity into the time series prediction model.

[0064] When the intent type is an attribution intent (e.g., when a user queries "Why has electricity sales in Guangdong decreased?"), the server passes the target indicator entity involved in the query instruction to the attribution analysis process.

[0065] When the intent type is an information query intent (e.g., a user queries "what does the indicator 'electricity sales' mean"), the server retrieves and returns information matching the query instruction from a preset knowledge base without triggering the time-series prediction model.

[0066] In addition, after an anomaly is generated through timed automatic alerts, if the user enters a follow-up question about the anomaly (such as "Why is this indicator changing?"), the server recognizes the follow-up question as an attribution intent and reuses the attribution analysis process to generate attribution analysis results.

[0067] As an example of an embodiment of the present invention, after determining the root cause node, the method further includes: Retrieve warning records within a preset time period; Based on the warning records, determine the first number of anomalies used to characterize correct warnings, the second number of anomalies used to characterize incorrect warnings, and the third number of anomalies used to characterize missed warnings within the preset time period. The accuracy rate is calculated based on the first number of anomalies and the second number of anomalies. The recall rate is calculated based on the first number of anomalies and the third number of anomalies. The target evaluation score is calculated based on the accuracy and recall. When the target evaluation score is less than the preset evaluation threshold, the time series prediction model is updated.

[0068] In this embodiment, the server verifies the reliability of the early warning results, generates a standardized operation monitoring early warning report, and completes result push and data closed-loop iteration. The server obtains early warning records within a preset time period and determines the number of correct early warnings P, the number of incorrect early warnings FP, and the number of missed early warnings FN based on the early warning records. The number of correct early warnings is the number of times an anomaly actually occurred and was correctly warned; the number of incorrect early warnings is the number of times an anomaly did not actually occur but was warned; and the number of missed early warnings is the number of times an anomaly actually occurred but was not warned.

[0069] The server calculates accuracy and recall based on the number of correct and incorrect alerts to quantitatively evaluate the performance of the alert model. The calculation formulas are as follows: ; ; The server calculates the target evaluation score F1 based on the precision and the recall, using the following formula: ; Wherein, TP represents the number of correctly predicted anomalies, FP represents the number of false alarms, and FN represents the number of missed alarms. The target evaluation score is the harmonic mean of the accuracy and recall, used to comprehensively evaluate the performance of the warning model.

[0070] When the target evaluation score is less than the preset evaluation threshold, the server updates the time series prediction model.

[0071] When the F1 score is lower than the preset standard, the model optimization and knowledge base update process is automatically triggered.

[0072] Preferably, the server will also cross-validate the current warning result with historical data from the same period and / or data from the same level of units, mark the results with deviations exceeding a preset threshold as suspicious data and prompt manual review, so as to ensure the accuracy of the warning result. Preferably, the server also obtains a preset report template, fills in the warning information, the time period of the abnormality, the theme classification summary of the cause of the abnormality, the risk warning of related indicators, the suggestions for solving the abnormality, and the reference data of the monthly operation and monitoring report into the report template, and generates a warning report; the output format of the warning report includes a visual abnormality trend chart and indicator correlation impact path chart, an indicator parameter and abnormality statistics table in Excel format, and a complete detection report in PDF format. The report content covers the basic information of the power grid unit, detection time, details of indicator abnormality, root cause analysis, and handling suggestions.

[0073] Preferably, the server also pushes the early warning results and reports to the power grid strategic operation and control platform through a standardized API interface, supporting managers to view, handle, and manage in real time. At the same time, the entire process data of this early warning, attribution, and handling is stored in the power grid operation and monitoring database, and the RAG knowledge base and knowledge graph are updated synchronously to achieve continuous iteration and optimization of the model and knowledge base, and continuously improve the accuracy of early warning and attribution.

[0074] As a preferred real-time approach of this invention, the server also encapsulates the entire process capabilities into standardized interfaces and deploys them in a containerized manner. Specifically, the server encapsulates the entire process capabilities of indicator alerts, intent recognition, attribution analysis, and report generation into unified interfaces, shielding the implementation details of the underlying models and algorithms, and providing a standardized call entry point. The interfaces adopt the RESTful HTTP protocol, supporting flexible cross-platform and cross-system calls. Preferably, the server also packages each service module involved in the entire process into container images, enabling each service module to run in the same container environment through containerized deployment, achieving consistency between local testing and production environments. The technology selection is shown in the table below: Table 1 As shown above, Docker containerization packages all service modules of the early warning system (large model service, RAG knowledge base service, early warning service, and interface service) into Docker images. Using the same image and container startup command, it achieves consistency between local testing and production environments, supports rapid deployment and elastic scaling, and is compatible with domestically produced hardware environments. One-click startup of the large model service is achieved through Docker commands, ensuring high availability of the service.

[0075] like Figure 2 As shown, based on the above method embodiments, an embodiment of the present invention provides a root cause localization system 200 for anomaly indicators, including: a data processing module 201, a weight calculation module 202, a time series prediction module 203, and a root cause localization module 204. The data processing module 201 is used to acquire knowledge data, time series data and related influencing factor data in the field of power grid operation and monitoring, perform entity analysis on the knowledge data to obtain multiple indicator entities and the causal relationship between any two indicator entities, wherein the related influencing factor data is used to characterize the data corresponding to the external environmental factors that affect the changes in power grid operation and monitoring indicators. The weight calculation module 202 is used to determine the sub-indicator and the parent indicator for any two indicator entities that have a causal relationship, and to determine the causal transmission coefficient between the sub-indicator and the parent indicator based on a preset graph neural network. Combining the causal transmission coefficient and the Pearson correlation coefficient, the influence weight of the sub-indicator on the parent indicator is determined. The time series prediction module 203 is used to input the time series data and the related influencing factor data into a preset time series prediction model to obtain the predicted value of each indicator entity. The root cause localization module 204 is used to determine whether there is an anomaly based on the deviation between the predicted value and the preset benchmark value of the corresponding indicator entity; if so, it determines the abnormal indicator and determines the root cause node based on the influence weight of at least one indicator entity that has a causal relationship with the abnormal indicator.

[0076] Furthermore, the weight calculation module 202 is also used for: The business logic verification coefficient is determined by judging whether the causal relationship between the sub-index entity and the parent index entity conforms to the preset business logic. The influence weight is determined by multiplying the causal transmission coefficient, the Pearson correlation coefficient, and the business logic verification coefficient.

[0077] Furthermore, the root cause localization system 200 for the abnormal indicators is also used to: obtain a preset attribution analysis prompt word template; Based on the root cause node, retrieve related reference information from the preset knowledge base; The root cause node and the associated reference information are processed according to the preset attribution analysis prompt word template to obtain the target attribution prompt word; The target attribution prompts are input into a preset large language model to obtain attribution analysis results.

[0078] Furthermore, the root cause localization system 200 for the abnormal indicator is also used to: periodically obtain a predictive trigger signal according to a preset period; In response to the prediction trigger signal, the time series data and the related influencing factor data are input into a preset time series prediction model.

[0079] Furthermore, the root cause localization system 200 for the abnormal indicators is also used to: obtain the user's natural language query instructions and preset intent analysis prompt word templates; The natural language query command is processed according to the preset intent analysis prompt word template to obtain the target query prompt word; Input the target query prompts into a preset large language model to obtain the intent type and the target indicator entities involved in the query instruction; When the intent type is a prediction intent, a prediction trigger signal is obtained for the target indicator entity; In response to the prediction trigger signal, the time series data corresponding to the target indicator entity and the related influencing factor data are input into the time series prediction model.

[0080] Furthermore, the root cause localization system 200 for the abnormal indicator is also used to: perform missing value filling, abnormality removal and normalization processing on the time series data to obtain preprocessed time series data. The structured data in the data of the related influencing factors is subjected to missing value filling, anomaly removal and normalization. The unstructured text data in the data of the related influencing factors is subjected to cleaning, block processing and vectorization to obtain the preprocessed data of the related influencing factors. The preprocessed time series data and the preprocessed data of related influencing factors are input into a preset time series prediction model.

[0081] Furthermore, the root cause localization system 200 for this abnormal indicator is also used for: Retrieve warning records within a preset time period; Based on the warning records, determine the first number of anomalies used to characterize correct warnings, the second number of anomalies used to characterize incorrect warnings, and the third number of anomalies used to characterize missed warnings within the preset time period. The accuracy rate is calculated based on the first number of anomalies and the second number of anomalies. The recall rate is calculated based on the first number of anomalies and the third number of anomalies. The target evaluation score is calculated based on the accuracy and recall. When the target evaluation score is less than the preset evaluation threshold, the time series prediction model is updated.

[0082] It is understood that the above system embodiments correspond to the method embodiments of the present invention, and can implement all the implementation methods of any of the above method embodiments of the present invention, which will not be repeated here.

[0083] It should be noted that the system embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0084] Based on the embodiments of the above-described root cause localization method for abnormal indicators, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the root cause localization method for abnormal indicators of any of the above embodiments of the present invention, the steps of which include: For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.

[0085] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0086] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0087] Based on the above-described method embodiments, another embodiment of the present invention provides a computer-readable storage medium, including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the root cause localization method for abnormal indicators as described in any of the above-described method embodiments of the present invention, the steps of which include: Acquire knowledge data, time series data, and related influencing factor data in the field of power grid operation and monitoring; perform entity analysis on the knowledge data to obtain multiple indicator entities and the causal relationship between any two indicator entities; wherein the related influencing factor data is used to characterize the data corresponding to the external environmental factors that affect the changes in power grid operation and monitoring indicators. For any two indicator entities that have a causal relationship, a child indicator entity and a parent indicator entity are determined. Based on a preset graph neural network, the causal transmission coefficient between the child indicator entity and the parent indicator entity is determined. Combining the causal transmission coefficient and the Pearson correlation coefficient, the influence weight of the child indicator entity on the parent indicator entity is determined. The time series data and the related influencing factor data are input into a preset time series prediction model to obtain the predicted values ​​of each indicator entity. Based on the deviation between the predicted value and the preset benchmark value of the corresponding indicator entity, it is determined whether it is abnormal; if so, the abnormal indicator is identified, and the root cause node is determined based on the influence weight of at least one indicator entity that has a causal relationship with the abnormal indicator.

[0088] Furthermore, the determination of the influence weight of the sub-index entity on the parent index entity by combining the causal transmission coefficient and the Pearson correlation coefficient specifically involves: The business logic verification coefficient is determined by judging whether the causal relationship between the sub-index entity and the parent index entity conforms to the preset business logic. The influence weight is determined by multiplying the causal transmission coefficient, the Pearson correlation coefficient, and the business logic verification coefficient.

[0089] Furthermore, after determining the root cause node, the process also includes: Get the preset attribution analysis prompt word template; Based on the root cause node, retrieve related reference information from the preset knowledge base; The root cause node and the associated reference information are processed according to the preset attribution analysis prompt word template to obtain the target attribution prompt word; The target attribution prompts are input into a preset large language model to obtain attribution analysis results.

[0090] Furthermore, before inputting the time series data and the related influencing factor data into the preset time series prediction model, the method further includes: According to a preset period, a predicted trigger signal is obtained periodically; In response to the prediction trigger signal, the time series data and the related influencing factor data are input into a preset time series prediction model.

[0091] Furthermore, before inputting the time series data and the related influencing factor data into the preset time series prediction model, the specific steps are as follows: Obtain the user's natural language query commands and preset intent analysis prompt word templates; The natural language query command is processed according to the preset intent analysis prompt word template to obtain the target query prompt word; Input the target query prompts into a preset large language model to obtain the intent type and the target indicator entities involved in the query instruction; When the intent type is a prediction intent, a prediction trigger signal is obtained for the target indicator entity; In response to the prediction trigger signal, the time series data corresponding to the target indicator entity and the related influencing factor data are input into the time series prediction model.

[0092] Furthermore, before inputting the time series data and the related influencing factor data into the preset time series prediction model, the method further includes: The time series data is subjected to missing value imputation, anomaly removal and normalization respectively to obtain preprocessed time series data; The structured data in the data of the related influencing factors is subjected to missing value filling, anomaly removal and normalization. The unstructured text data in the data of the related influencing factors is subjected to cleaning, block processing and vectorization to obtain the preprocessed data of the related influencing factors. The preprocessed time series data and the preprocessed data of related influencing factors are input into a preset time series prediction model.

[0093] Furthermore, after determining the root cause node, the process also includes: Retrieve warning records within a preset time period; Based on the warning records, determine the first number of anomalies used to characterize correct warnings, the second number of anomalies used to characterize incorrect warnings, and the third number of anomalies used to characterize missed warnings within the preset time period. The accuracy rate is calculated based on the first number of anomalies and the second number of anomalies. The recall rate is calculated based on the first number of anomalies and the third number of anomalies. The target evaluation score is calculated based on the accuracy and recall. When the target evaluation score is less than the preset evaluation threshold, the time series prediction model is updated.

[0094] Based on the above-described method embodiments, this invention further provides a computer program / program product, which is stored in a storage medium and executed by at least one processor to implement the root cause localization method for abnormal indicators as described in any of the above-described method embodiments, the steps of which include: Acquire knowledge data, time series data, and related influencing factor data in the field of power grid operation and monitoring; perform entity analysis on the knowledge data to obtain multiple indicator entities and the causal relationship between any two indicator entities; wherein the related influencing factor data is used to characterize the data corresponding to the external environmental factors that affect the changes in power grid operation and monitoring indicators. For any two indicator entities that have a causal relationship, a child indicator entity and a parent indicator entity are determined. Based on a preset graph neural network, the causal transmission coefficient between the child indicator entity and the parent indicator entity is determined. Combining the causal transmission coefficient and the Pearson correlation coefficient, the influence weight of the child indicator entity on the parent indicator entity is determined. The time series data and the related influencing factor data are input into a preset time series prediction model to obtain the predicted values ​​of each indicator entity. Based on the deviation between the predicted value and the preset benchmark value of the corresponding indicator entity, it is determined whether it is abnormal; if so, the abnormal indicator is identified, and the root cause node is determined based on the influence weight of at least one indicator entity that has a causal relationship with the abnormal indicator.

[0095] Furthermore, the determination of the influence weight of the sub-index entity on the parent index entity by combining the causal transmission coefficient and the Pearson correlation coefficient specifically involves: The business logic verification coefficient is determined by judging whether the causal relationship between the sub-index entity and the parent index entity conforms to the preset business logic. The influence weight is determined by multiplying the causal transmission coefficient, the Pearson correlation coefficient, and the business logic verification coefficient.

[0096] Furthermore, after determining the root cause node, the process also includes: Get the preset attribution analysis prompt word template; Based on the root cause node, retrieve related reference information from the preset knowledge base; The root cause node and the associated reference information are processed according to the preset attribution analysis prompt word template to obtain the target attribution prompt word; The target attribution prompts are input into a preset large language model to obtain attribution analysis results.

[0097] Furthermore, before inputting the time series data and the related influencing factor data into the preset time series prediction model, the method further includes: According to a preset period, a predicted trigger signal is obtained periodically; In response to the prediction trigger signal, the time series data and the related influencing factor data are input into a preset time series prediction model.

[0098] Furthermore, before inputting the time series data and the related influencing factor data into the preset time series prediction model, the specific steps are as follows: Obtain the user's natural language query commands and preset intent analysis prompt word templates; The natural language query command is processed according to the preset intent analysis prompt word template to obtain the target query prompt word; Input the target query prompts into a preset large language model to obtain the intent type and the target indicator entities involved in the query instruction; When the intent type is a prediction intent, a prediction trigger signal is obtained for the target indicator entity; In response to the prediction trigger signal, the time series data corresponding to the target indicator entity and the related influencing factor data are input into the time series prediction model.

[0099] Furthermore, before inputting the time series data and the related influencing factor data into the preset time series prediction model, the method further includes: The time series data is subjected to missing value imputation, anomaly removal and normalization respectively to obtain preprocessed time series data; The structured data in the data of the related influencing factors is subjected to missing value filling, anomaly removal and normalization. The unstructured text data in the data of the related influencing factors is subjected to cleaning, block processing and vectorization to obtain the preprocessed data of the related influencing factors. The preprocessed time series data and the preprocessed data of related influencing factors are input into a preset time series prediction model.

[0100] Furthermore, after determining the root cause node, the process also includes: Retrieve warning records within a preset time period; Based on the warning records, determine the first number of anomalies used to characterize correct warnings, the second number of anomalies used to characterize incorrect warnings, and the third number of anomalies used to characterize missed warnings within the preset time period. The accuracy rate is calculated based on the first number of anomalies and the second number of anomalies. The recall rate is calculated based on the first number of anomalies and the third number of anomalies. The target evaluation score is calculated based on the accuracy and recall. When the target evaluation score is less than the preset evaluation threshold, the time series prediction model is updated.

[0101] The modules / units integrated in the device / terminal equipment, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0102] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A root cause localization method for anomaly indicators, characterized in that, include: Acquire knowledge data, time series data, and related influencing factor data in the field of power grid operation and monitoring; perform entity analysis on the knowledge data to obtain multiple indicator entities and the causal relationship between any two indicator entities; wherein the related influencing factor data is used to characterize the data corresponding to the external environmental factors that affect the changes in power grid operation and monitoring indicators. For any two indicator entities that have a causal relationship, a child indicator entity and a parent indicator entity are determined. Based on a preset graph neural network, the causal transmission coefficient between the child indicator entity and the parent indicator entity is determined. Combining the causal transmission coefficient and the Pearson correlation coefficient, the influence weight of the child indicator entity on the parent indicator entity is determined. The time series data and the related influencing factor data are input into a preset time series prediction model to obtain the predicted values ​​of each indicator entity. Based on the deviation between the predicted value and the preset benchmark value of the corresponding indicator entity, it is determined whether there is an anomaly; If so, then identify the abnormal indicator and determine the root cause node based on the influence weight of at least one indicator entity that has a causal relationship with the abnormal indicator.

2. The root cause localization method for abnormal indicators as described in claim 1, characterized in that, The method of determining the influence weight of the sub-index entity on the parent index entity by combining the causal transmission coefficient and the Pearson correlation coefficient is as follows: The business logic verification coefficient is determined by judging whether the causal relationship between the sub-index entity and the parent index entity conforms to the preset business logic. The influence weight is determined by multiplying the causal transmission coefficient, the Pearson correlation coefficient, and the business logic verification coefficient.

3. The root cause localization method for abnormal indicators as described in claim 1, characterized in that, Following the determination of the root cause node, the following is also included: Get the preset attribution analysis prompt word template; Based on the root cause node, retrieve related reference information from the preset knowledge base; The root cause node and the associated reference information are processed according to the preset attribution analysis prompt word template to obtain the target attribution prompt word; The target attribution prompts are input into a preset large language model to obtain attribution analysis results.

4. The root cause localization method for abnormal indicators as described in claim 1, characterized in that, Before inputting the time series data and the associated influencing factor data into the preset time series prediction model, the method further includes: According to a preset period, a predicted trigger signal is obtained periodically; In response to the prediction trigger signal, the time series data and the related influencing factor data are input into a preset time series prediction model.

5. The root cause localization method for abnormal indicators as described in claim 1, characterized in that, Before inputting the time series data and the associated influencing factor data into the preset time series prediction model, the specific steps are as follows: Obtain the user's natural language query commands and preset intent analysis prompt word templates; The natural language query command is processed according to the preset intent analysis prompt word template to obtain the target query prompt word; Input the target query prompts into a preset large language model to obtain the intent type and the target indicator entities involved in the query instruction; When the intent type is a prediction intent, a prediction trigger signal is obtained for the target indicator entity; In response to the prediction trigger signal, the time series data corresponding to the target indicator entity and the related influencing factor data are input into the time series prediction model.

6. The root cause localization method for abnormal indicators as described in any one of claims 1-3, characterized in that, Before inputting the time series data and the associated influencing factor data into the preset time series prediction model, the method further includes: The time series data is subjected to missing value imputation, anomaly removal and normalization respectively to obtain preprocessed time series data; The structured data in the data of the related influencing factors is subjected to missing value filling, anomaly removal and normalization. The unstructured text data in the data of the related influencing factors is subjected to cleaning, block processing and vectorization to obtain the preprocessed data of the related influencing factors. The preprocessed time series data and the preprocessed data of related influencing factors are input into a preset time series prediction model.

7. The root cause localization method for abnormal indicators as described in any one of claims 1-3, characterized in that, Following the determination of the root cause node, the following is also included: Retrieve warning records within a preset time period; Based on the warning records, determine the first number of anomalies used to characterize correct warnings, the second number of anomalies used to characterize incorrect warnings, and the third number of anomalies used to characterize missed warnings within the preset time period. The accuracy rate is calculated based on the first number of anomalies and the second number of anomalies. The recall rate is calculated based on the first number of anomalies and the third number of anomalies. The target evaluation score is calculated based on the accuracy and recall. When the target evaluation score is less than the preset evaluation threshold, the time series prediction model is updated.

8. A root cause localization system for anomaly indicators, characterized in that, include: Data processing module, weight calculation module, time series prediction module, and root cause localization module; The data processing module is used to acquire knowledge data, time series data and related influencing factor data in the field of power grid operation and monitoring, perform entity analysis on the knowledge data to obtain multiple indicator entities and the causal relationship between any two indicator entities, wherein the related influencing factor data is used to characterize the data corresponding to the external environmental factors that affect the changes in power grid operation and monitoring indicators. The weight calculation module is used to determine the child indicator entity and the parent indicator entity for any two indicator entities that have a causal relationship, and to determine the causal transmission coefficient between the child indicator entity and the parent indicator entity based on a preset graph neural network. Combining the causal transmission coefficient and the Pearson correlation coefficient, the module determines the influence weight of the child indicator entity on the parent indicator entity. The time series prediction module is used to input the time series data and the related influencing factor data into a preset time series prediction model to obtain the predicted value of each indicator entity. The root cause localization module is used to determine whether there is an anomaly based on the deviation between the predicted value and the preset benchmark value of the corresponding indicator entity; if so, it determines the abnormal indicator and determines the root cause node based on the influence weight of at least one indicator entity that has a causal relationship with the abnormal indicator.

9. A terminal device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the root cause localization method for abnormal indicators as described in claim 1.

10. A computer-readable storage medium, characterized in that, include: A stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the root cause localization method for the abnormal indicator as described in claim 1.

Images