A knowledge graph anomaly detection and correction method and device based on causal reasoning

Abstract

The application discloses a kind of knowledge graph anomaly detection and correction method and device based on causal inference, it is related to coal mine intelligent technology field, the method includes the following steps: acquisition multi-source heterogeneous monitoring data, generates multidimensional observation data matrix by washing mapping;Causal effect quantification is carried out through causal structure learning algorithm, and causal diagram containing causal dependence relationship is constructed;With causal diagram as benchmark, combine path attenuation coefficient to calculate triad path correlation to quantify credibility, utilize credibility threshold and relationship direction to identify abnormal triad type;According to the type of anomaly, execute deletion or direction flip, and to the new triad, adopt causal score update strategy based on sliding time window to carry out graph local update.The application improves the model explainability, avoids false long-distance dependence, ensures the consistency of knowledge graph and safety mechanism, enhances the real-time performance and robustness of graph dynamic updating.

Description

Technical Field

[0001] This invention relates to the field of coal mine safety information management and knowledge graph technology, specifically to a method and apparatus for anomaly detection and correction of knowledge graphs based on causal reasoning. Background Technology

[0002] Coal mine safety production, as the cornerstone of the energy industry, operates in an environment characterized by extreme complexity and risk. With the advancement of smart mine construction, various sensing systems, including underground environmental monitoring, precise personnel positioning, and equipment condition monitoring, generate massive amounts of multi-source heterogeneous data. To effectively utilize this data for risk reasoning, accident evolution analysis, and emergency decision support, knowledge graph technology has been widely introduced into the field of coal mine safety. By transforming dispersed sensor time-series data, unstructured operating procedures, and accident cases into triples of entities, attributes, and relationships, the coal mine safety knowledge graph constructs a structured semantic network, providing crucial knowledge support for hazard identification and intelligent decision-making.

[0003] However, in actual underground coal mine production scenarios, data sources often face severe quality challenges. On the one hand, the harsh physical environment underground can easily lead to sensor drift, malfunction, or data transmission interruption, resulting in missing or abnormal monitoring data. On the other hand, manually entered inspection records and dispatch instructions are subject to subjective arbitrariness and lag. Most existing methods for constructing coal mine safety knowledge graphs rely on a purely data-driven model or static manual rule definitions, lacking a deep verification mechanism for the underlying physical logic of the data. When source data contains noise, conflicts, or is maliciously tampered with, this erroneous information is directly mapped into the graph structure, forming abnormal triples containing false relationships, redundant connections, and even logical inversions.

[0004] Existing knowledge graph maintenance techniques often focus on association mining based on statistical co-occurrence, primarily concerned with the probability of entities appearing simultaneously, while neglecting the objectively existing causal dependencies in the physical world. This method, relying solely on statistical correlation, easily misjudges accidental concurrent events as causal relationships, resulting in a large amount of erroneous knowledge in the knowledge graph that does not conform to the mechanisms of coal mine safety. Furthermore, the coal mine production system is a dynamically evolving, time-varying system; equipment aging, changes in geological conditions, or adjustments to process parameters can all alter the original association logic. Most existing knowledge graphs are updated using static or periodic full-scale reconstruction methods, making it difficult to accurately capture and adapt to such real-time changes, and lacking reliable auditing methods for the knowledge evolution process. Once reasoning is based on a flawed knowledge graph, it can easily lead to distorted safety risk assessments or misleading decisions, posing potentially serious hidden dangers to coal mine safety production. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and apparatus for anomaly detection and correction of knowledge graphs based on causal reasoning. Existing coal mine safety knowledge graphs suffer from problems such as the lack of physical causal logic verification, resulting in false relationships and logical conflicts, and are difficult to adapt to dynamic changes in underground working conditions.

[0006] To achieve the above objectives, the present invention provides the following technical solution: The first aspect of the present invention provides a method for anomaly detection and correction of knowledge graphs based on causal reasoning, comprising the following steps:

[0007] Data acquisition and matrixing steps: Collect multi-source heterogeneous monitoring data, clean and process it, map the multi-source heterogeneous monitoring data onto a unified time axis, and discretize it to generate a multi-dimensional standardized observation data matrix reflecting the joint state of various variables at the same time. Specifically, a global reference time axis is set and divided into continuous time slices of equal length. A sliding window mechanism is used to aggregate continuous numerical data and discrete event data with different sampling frequencies into the corresponding time slices, and then discretize and encode them to construct a matrix determined by the number of time slices and the total number of variables. Each row vector of the matrix represents the discretized joint observation state of all variables within a time slice.

[0008] The causal structure learning process involves: conducting statistical independence tests and quantifying causal effects based on a multidimensional standardized observation data matrix; calculating standardized causal correlation values ​​between entities through log-likelihood ratio statistics and normalization; and constructing a causal graph containing causal dependencies and weights. This process involves statistically analyzing the joint observation frequency of two entities appearing simultaneously in the observation data matrix, calculating the expected frequency of their simultaneous occurrence based on the independence assumption, and using the log-likelihood ratio statistic to calculate the degree of difference between the joint observation frequency and the expected frequency. Subsequently, normalization is performed based on the total sample size and the degrees of freedom of the discrete states of the entities to obtain standardized causal correlation values ​​characterizing the strength of the causal relationship between entities. In a real coal mine scenario, this step is configured to identify the causal relationship between the operating status of local ventilation fans and the gas concentration monitored by gas sensors, thereby eliminating the logical inversion error of local ventilation fans shutting down due to excessive gas levels at the data level.

[0009] Anomaly Detection Steps: The causal graph, containing causal dependencies and weights, serves as the benchmark for anomaly identification. Path retrieval is performed on triples in the domain knowledge graph. The credibility of the triples is quantified by aggregating the standardized causal correlation values ​​along the retrieved paths and combining this with a path decay coefficient. The credibility is then compared with a preset credibility threshold and relational direction features to identify anomalous triple types. Specifically, the causal graph searches for all valid connected paths linking the head and tail entities of the triples, limiting the maximum search depth. For each valid connected path, the standardized causal correlation values ​​along the path are aggregated. An exponential decay model based on path length is introduced as the path decay coefficient to calculate credibility. The exponential decay model is configured to decrease the credibility value as the path length increases, thus characterizing the loss of causal effects during transmission and avoiding the establishment of false long-distance dependencies. Based on the credibility, if there is no connected path in the causal graph or the maximum credibility is less than the preset credibility threshold, it is determined to be a false relation triple; if the direction of the triple recorded in the domain knowledge graph is opposite to the direction with significantly higher credibility in the causal graph, it is determined to be a direction conflict triple.

[0010] The triplet correction and local update steps are as follows: Based on the identified abnormal triplet types, deletion and direction reversal operations are performed on the domain knowledge graph. For newly added triples, a causal score update strategy based on a sliding time window is used to evaluate the quality of the triples and perform a local update on the domain knowledge graph. For false relation triples, deletion is performed; for directional conflict triples, the original directed edges are removed and new directed edges with semantic inverse relations are established; when multiple connected paths with the same order of magnitude of credibility exist in the causal graph, the direct causal relationship with the shortest path length is retained, and indirect relationships are removed. In the causal score update strategy based on a sliding time window, a sliding time window containing the most recent time slices is maintained. As new data flows in, the oldest data is removed and the latest single-point causal correlation value is moved in; a time decay weighted algorithm is used to calculate the local standardized causal correlation within the window, giving higher weight to data that is closer to the current time; subsequently, an exponential moving average algorithm is used, combining the global causal score of the previous time step with the current local standardized causal correlation, to calculate and update the global causal score of the triples, and adjust the activation or dormancy state of the triples in the knowledge graph accordingly.

[0011] To ensure the traceability of the correction process, the above method also includes a blockchain evidence storage step. When the domain knowledge graph structure changes, a transaction record is generated that includes a change timestamp, operation type code, affected triple content, standardized causal correlation value of the basis for the change, and hash value of the previous version state. Its digital digest is calculated using a cryptographic hash algorithm and sent to blockchain network nodes for consensus and on-chain storage.

[0012] The second aspect of the present invention provides a knowledge graph anomaly detection and correction device based on causal reasoning, applied to the method described in the first aspect above, comprising: a data acquisition and matrixing module, which is used to receive multi-source heterogeneous monitoring data and convert it into a multi-dimensional standardized observation data matrix after cleaning and mapping processing; The causal structure learning module is used to quantify causal effects, calculate standardized causal correlation values, and construct causal graphs based on a multidimensional standardized observation data matrix through log-likelihood ratio statistics and normalization. The anomaly detection module is used to use the causal graph as a benchmark to calculate the path correlation index to quantify credibility by aggregating standardized causal correlation values ​​on the path and combining them with the path decay coefficient. It also uses credibility thresholds and relationship directions to identify the types of abnormal triples in the domain knowledge graph. The triplet correction and local update module is used to perform deletion and direction reversal operations on the domain knowledge graph based on the anomaly detection results, and to perform local graph updates on newly added triplets using a causal score update strategy based on a sliding time window.

[0013] The technical solution provided by this invention introduces a causal reasoning mechanism to replace conventional embedding models or statistical correlation discrimination, thus achieving higher interpretability at the logical level. It employs an exponential decay model as the path decay coefficient, ensuring the detection range while preventing redundant dependencies on distant nodes, thereby guaranteeing the consistency between the knowledge graph structure and actual industrial safety mechanisms. Combined with a causal score local update strategy based on a sliding time window, it achieves rapid adaptation to real-time monitoring data streams, ensuring the real-time nature of knowledge updates and the robustness of the system in high-risk scenarios.

[0014] This invention provides a method and apparatus for anomaly detection and correction of knowledge graphs based on causal reasoning. It has the following beneficial effects: 1. This invention constructs a standardized observation data matrix and performs a log-likelihood ratio statistical test to calculate standardized causal correlation values ​​between entities to construct a causal graph. Compared with traditional correction methods that rely solely on co-occurrence statistics or black-box embedding models, this invention can reveal the inherent logic between entities from the perspective of causal dependence at the data level, effectively identify and eliminate spurious correlations caused by data noise, thereby improving the logical interpretability and credibility of the coal mine safety knowledge graph in assisting in the investigation of hidden dangers and decision-making processes.

[0015] 2. In the anomaly detection stage, this invention introduces an exponential decay model based on path length. By aggregating standardized causal correlation values ​​on connected paths, the path correlation index is calculated. This mechanism utilizes the decay characteristics configured in the model to reduce the weight of long-distance indirect propagation effects. While covering potential associations, it effectively filters redundant long-distance weak dependencies and false propagation paths, ensuring that the topological structure of the knowledge graph can accurately map the real safety mechanism between underground physical equipment and environmental parameters in coal mines, and avoiding logical redundancy.

[0016] 3. This invention establishes an incremental dynamic update mechanism based on sliding window and time decay weighting. It uses an exponential moving average algorithm combined with the latest local data and historical global consistency scores to maintain the knowledge graph. This data-driven evolution strategy enables the system to keenly capture the real-time time-varying characteristics of coal mine monitoring data. When facing high-risk scenarios such as equipment aging, sensor drift, or sudden changes in operating conditions, it can automatically adjust the activation or dormancy state of triples, thereby ensuring the timeliness of the knowledge graph and the robustness of system operation without frequent manual intervention. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a schematic diagram of the automatic correction and conflict resolution logic flow of the triplet in this invention. Detailed Implementation

[0018] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] This invention provides a knowledge graph anomaly detection and correction device based on causal reasoning. The device includes a data perception layer, a data transmission layer, a core processing layer, and a storage layer.

[0020] The data sensing layer is deployed in the underground coal mine operation site and related monitoring areas to collect environmental parameters and equipment status in real time. The data sensing layer includes a gas concentration sensor, a ventilation equipment monitoring unit, a power supply monitoring device, and a temperature and humidity acquisition module. The gas concentration sensor collects the volume percentage of methane gas at a preset frequency. The ventilation equipment monitoring unit monitors the operating status of the main ventilation fan and local ventilation fans, including their on / off status and speed parameters. The power supply monitoring device monitors the voltage, current, and on / off status of the power supply lines. The temperature and humidity acquisition module collects temperature and relative humidity data for the tunnel environment.

[0021] In addition, the data perception layer also includes a management information entry terminal. This terminal receives and stores personnel entry and exit records, equipment maintenance logs, work procedure texts, and accident handling reports. It converts the aforementioned text-based or structured data into timestamped electronic records.

[0022] The data transmission layer includes an MQTT transmission gateway and an industrial ring network switch. Gas concentration sensors, ventilation equipment monitoring units, power supply monitoring devices, and temperature and humidity acquisition modules are connected to the MQTT transmission gateway via wired or wireless communication interfaces. The MQTT transmission gateway encapsulates the collected multi-source heterogeneous data into data packets using the Message Queuing Telemetry Protocol (MQTT). The industrial ring network switch uploads data from the MQTT transmission gateway and management information entry terminals to the core processing layer via a fiber optic network.

[0023] The core processing layer includes a central server. The central server consists of a processor and memory. The memory stores computer program instructions, and the processor executes these instructions to perform anomaly detection and correction functions for the coal mine safety knowledge graph.

[0024] The storage layer comprises a graph database and blockchain network nodes. The graph database stores entity, attribute, and relation triplet data for the coal mine safety knowledge graph. It employs a graph-structured storage engine and supports attribute graph models. The blockchain network nodes maintain a distributed ledger, storing hash records and metadata for knowledge graph update operations.

[0025] The central server's logical architecture comprises multiple functional modules that interact with each other via a data bus or shared memory. These modules include a data acquisition and matrixing module, a causal structure learning module, an anomaly detection module, a triple correction module, a dynamic update module, and an evidence storage interface module.

[0026] The data acquisition and matrixing module connects to the data transmission layer to receive raw monitoring data and log data. This module performs data cleaning, removing outliers exceeding physical limits and filling in missing data. It also performs time alignment, using a sliding window mechanism to map sensor data and discrete event logs from different sampling frequencies onto a unified time axis. The module then converts the aligned data into a matrix, where each row corresponds to a time slice and each column corresponds to a monitoring variable or event type.

[0027] The causal structure learning module is connected to the data acquisition and matrixing module to calculate the strength of causal relationships between entities based on matrixed data. The causal structure learning module statistically analyzes the observed and expected frequencies of entity pairs in the sample set and calculates statistics using statistical independence testing algorithms. Based on these statistics, the causal structure learning module generates standardized causal correlation values ​​and constructs a causal graph containing causal dependencies and weights.

[0028] The anomaly detection module connects to the causal structure learning module and the graph database. The anomaly detection module reads existing triples from the graph database and retrieves paths between corresponding entity nodes in the causal graph. It calculates a path relevance index based on the causal relevance values ​​and path length. Based on a comparison of the path relevance index with a preset threshold, the anomaly detection module determines whether the triples contain spurious associations, redundant associations, or directional conflicts.

[0029] The triplet correction module is connected to the anomaly detection module. The triplet correction module performs write operations on the graph database based on the anomaly detection module's judgment results. The operations performed by the triplet correction module include deleting triples determined to be false, correcting the relational directions of triples determined to have directional conflicts, and adding new triples based on new high-strength associations discovered in the causal graph. The triplet correction module follows the principles of priority, directionality, and simplicity when performing corrections.

[0030] The dynamic update module is connected to the causal structure learning module. The dynamic update module maintains the global consistency scores of triples. It employs a time-decay weighted sliding window algorithm, periodically updating standardized causal correlation values ​​based on newly incoming monitoring data. The dynamic update module also utilizes a smoothing update algorithm to adjust the consistency scores of triples according to the latest correlation values ​​and writes the updated scores to the graph database.

[0031] The evidence storage interface module connects to the triple correction module and the blockchain network nodes. It generates transaction records when the triple correction module performs add, delete, or modify operations. Each transaction record includes a change timestamp, operation type, the content of the triples involved, the causal correlation value used as the basis, and the hash value of the previous version's state. The evidence storage interface module then sends these transaction records to the blockchain network nodes for consensus and on-chain storage.

[0032] The device also includes a visualization terminal. The visualization terminal is connected to the central server and is used to graphically display the knowledge graph structure of the graph database, highlight nodes or edges marked as abnormal by the anomaly detection module, and historical records corrected by the triplet correction module.

[0033] See attached document Figure 1 This invention provides a knowledge graph anomaly detection and correction method based on causal reasoning. Before constructing the causal graph, a rigorous data cleaning and formatting operation is first performed to transform the original monitoring records from multiple sources and heterogeneity into a structured matrix suitable for statistical inference.

[0034] The device first receives real-time data streams from the underground ring network via a message queue interface. These data streams consist of two main types: one is continuous numerical time-series data uploaded at a fixed frequency (e.g., once per second or once per minute) by sensors such as gas concentration, carbon monoxide concentration, temperature, and wind speed; the other is discrete event-type log data that is only triggered and reported when the state changes, such as ventilation fan start / stop, partial power outage, and personnel intrusion alarm. The device adds a uniform timestamp accurate to the millisecond to all received data packets to eliminate timing misalignments caused by differences in the local clocks of different acquisition devices.

[0035] Upon receiving the raw data, the device performs a data cleaning procedure to remove noise interference. For continuous numerical sensor data, the device employs a statistical anomaly detection algorithm to identify and filter physically impossible extreme values. Specifically, the device maintains a sliding calculation window and calculates the mean of the data within the window in real time. with standard deviation For newly arrived observations Calculate its standard score .

[0036] like If the value is greater than a preset threshold (e.g., 3.0), the data point is determined to be discrete noise caused by sensor failure or electromagnetic interference, and then filled in using the effective observations immediately before and after the missing point to ensure the continuity of the time series.

[0037] After cleaning, the device performs time alignment to resolve the issue of inconsistent sampling frequencies from multiple data sources. The device establishes a global reference time axis and divides this time axis into consecutive time slices of equal length. The time slice is set according to business needs (e.g., 1 minute or 5 minutes). For each time slice, the device aggregates all raw data falling within that time range. For high-frequency continuous variables (such as gas concentration), the device calculates the arithmetic mean or maximum value of all sampling points within that time slice as the representative value for that time slice; for low-frequency or triggered discrete events (such as equipment status), the device uses the final state or mode state within that time slice as the representative value. Through the above operations, data of different frequencies are mapped onto a fully synchronized discrete-time grid.

[0038] To accommodate subsequent causal inference algorithms based on frequency statistics, the device further discretizes continuous variables. The device predefines a set of interval thresholds or employs clustering algorithms (such as K-Means) to map continuous monitoring values ​​to a finite number of discrete state codes. For example, gas concentration values ​​are mapped to three state codes: normal, warning, and over-limit; equipment current values ​​are mapped to four state codes: shutdown, no-load, running, and overload. Discrete event-type data are directly mapped to their corresponding integer codes.

[0039] After the above processing, the device constructs an observation data matrix. The matrix The dimension is ,in This represents the total number of time slices and the sample size. This represents the total number of monitored variables and event types, and indicates the feature dimension. Elements in the matrix... Indicates the first In the first time slice, the first The discretized state values ​​of a variable or event. This matrix. It clearly depicts the global state snapshots of coal mine safety devices at different times, with each row vector... All data include joint observations of all sensor readings and device status at the same time, thus providing standardized input data for exploring temporal covariance and causal dependence among different variables.

[0040] After obtaining the standardized data matrix Subsequently, the device performs causal structure learning, aiming to quantify the dependencies between different monitoring variables and events from a statistical perspective, thereby constructing a data-driven causal graph reflecting the physical mechanisms of coal mines. This process mainly includes three stages: frequency statistics, conditional independence testing, and standardized correlation calculation.

[0041] First, the device traverses the matrix. Any two column vectors in the knowledge graph correspond to the head entities in the knowledge graph. Tail-end entity Let the entity be... The set of discrete state values ​​is ,entity The set of discrete state values ​​is .for any state in as well as any state in The device iterates through all rows of the matrix, i.e. all time slices, and counts the observed frequency and the expected frequency.

[0042] Observation frequency This indicates that in actual observation data, the entity In state And entity Simultaneously in a state The number of joint samples. The device calculates the observation frequency according to the following formula: ; in, Representation matrix The total number of rows, i.e., the total sample size. Indicates the first Entities on a Time Piece The observed values, Indicates the first Entities on a Time Piece The observed values, This is an indicator function that takes the value 1 when the condition is met, and 0 otherwise.

[0043] Expected frequency Indicates the hypothetical entity With entity Under the condition of mutual independence, the theoretically expected number of samples in which both are simultaneously in the corresponding state is: The device calculates the expected frequency according to the following formula: ; in, Representing entities Values The total number of samples, similarly, Representing entities Values The total number of samples. The expected frequency reflects the background probability distribution under the assumption of no causal association.

[0044] Secondly, the device performs a statistical independence test based on the difference between the observed frequency and the expected frequency. This embodiment uses... A statistic, also known as the log-likelihood ratio statistic, is used to measure the performance of an entity. With entity Statistical dependence between them. The statistic can capture more complex nonlinear dependencies than the traditional linear correlation coefficient. The device calculates based on the following formula. Statistic: ; in, express Belongs to set , express Belongs to set , For the frequency of observation, For the expected frequency, by Logarithm with base 0.

[0045] When the observation frequency Significant deviation from expected frequency hour, An increase in the value indicates that the entity and There is a strong statistical dependence between them, so we reject the independence hypothesis; conversely, if they are close, then... A value close to 0 indicates that the two are independent of each other.

[0046] Finally, in order to eliminate the total sample size The influence of the number of different entity states, i.e., degrees of freedom, on the statistical values ​​makes the causal strength between different entity pairs comparable. The device calculates a standardized causal correlation index. This indicator serves as the core basis for subsequently constructing the edge weights of the causal graph, and its calculation formula is as follows: ; in, Representing entities The total number of discrete states, Representing entities The total number of discrete states. The larger the value, the more significant the causal relationship between the two entities.

[0047] The device is based on the calculated Construct a cause-effect graph. The device sets a significance threshold. For any entity pair ,like Then establish connections in the cause-effect graph. and The edge, and The value is assigned as the weight of the edge. The directionality of the edge is determined through lag correlation analysis of the time series, i.e., if... exist The state change at any time has a significant impact Given the state distribution at the current moment, the direction is determined as follows. Alternatively, the direction can be determined based on pre-existing domain knowledge, such as physical connections. The resulting causal graph is a directed weighted graph, where nodes correspond to monitored variables or events, and edges correspond to strong causal dependencies validated by data.

[0048] After constructing a data-driven causal graph reflecting objective physical laws using statistical methods, the device uses this causal graph as a benchmark verification source to perform logical consistency audits on the domain knowledge graph stored in the graph database. This step aims to identify spurious triples lacking data support and conflicting triples that contradict physical facts in the knowledge graph.

[0049] The device first performs a traversal operation, sequentially reading the triples to be verified in the knowledge graph. ,in For the head entity, For tail entities, Define the semantic relationship between the two (e.g., cause, trigger, belong to). For each triple, the device initiates a path search task in the causal graph, retrieving the path from the node. To the node Does a connected path exist? To control computational complexity and eliminate interference from overly circuitous weak connections, the device employs either Bounded Depth-First Search (BFS) or Breadth-First Search (BFS) algorithms, and sets a maximum search depth limit. (For example =3). This means that the device only focuses on lengths not exceeding 3). The causal transmission path of the jump.

[0050] For each link retrieved arrive Valid path The device calculates its path correlation index. The design of this index is based on a physical assumption: causal effects experience losses during transmission; the longer the path, the weaker the original causal chain, meaning that direct causality has a stronger explanatory power than indirect causality. The device uses an exponential decay model to quantify this transmission loss, with the specific calculation formula as follows: ; in, Representing a path The aggregated result of the standardized causal correlation values ​​of all edges. In the simplest embodiment, if the path is a direct connection, then this value is the one calculated in step S2. If it is a multi-hop path, then take the minimum value of the weights of each edge on the path (shortest board effect) or their product. Representing a path The length of the path, i.e., the number of edges (hops) it contains. The preset distance attenuation coefficient ( This is used to regulate the rate at which causal strength decreases with distance. The higher the value, the greater the penalty for long-distance paths, and the more the device tends to trust direct connections. is the base of the natural logarithm.

[0051] Calculate the head entity With tail entity After determining the maximum path correlation index between them, the device compares it with a preset judgment threshold. A comparison is performed to execute the exception handling logic: First, determine if a relationship is false or redundant: if no relationship is found in the causal graph... arrive Any connected path, or the calculated path correlation index Less than the threshold If the triplet is falsely labeled as a spurious relationship or a weakly redundant relationship, it indicates that the relationship described by the triplet lacks statistical evidence in the actual monitoring data, or that the association is so weak as to be negligible. The device marks such triplets as spurious relationships or weakly redundant relationships and adds them to the queue of candidates to be deleted. This mechanism effectively eliminates invalid knowledge generated by human error or outdated rules.

[0052] Second, direction conflict determination: if the triplet The direction defined in a knowledge graph is and relationship It possesses asymmetric properties (e.g., causal relationships), but the strongly correlated path directions detected by the device in the causal graph are mainly... (i.e. from) Departure to The path correlation was significantly higher than that from arrive If the path correlation is not specified, the triple is determined to have a directional conflict. This situation usually corresponds to a logic inversion error, such as incorrectly modeling an alarm caused by an increase in gas concentration as an alarm causing an increase in gas concentration. The device marks such triples as directional anomalies and adds them to the queue of candidates to be corrected.

[0053] Third, optimal path marking: For cases with multiple connected paths, the device uses... The paths are sorted by their numerical values, and the path with the highest score is marked as the primary interpretation path. This primary interpretation path and its corresponding length are then defined. This will serve as the core basis for performing triplet correction and conflict resolution in the subsequent step S4, ensuring that the final retained knowledge structure conforms to the principle of simplicity, that is, when the causal strengths are similar, the explanation logic with the shortest path is selected first.

[0054] See attached document Figure 2 After the anomaly detection module completes the logical audit of the existing graph and outputs a set of anomaly candidates, this step aims to perform write operations on the graph database through an automated decision-making mechanism to achieve self-evolution and correction of the graph topology. This process strictly adheres to the principles of priority, directionality, and simplicity to ensure that the corrected knowledge structure conforms to both statistical data patterns and physical interpretability. The device first loads a list of anomaly triples to be processed, which includes those marked as spurious relations, directional conflicts, and potential new relations discovered during the causal structure learning phase but not yet included in the graph. For different types of anomalies, the device processes them according to the following logic: First, it performs filtering and addition / deletion operations based on the Priority Principle. This principle establishes the superiority of data evidence over prior knowledge.

[0055] For triples marked as spurious relationships, the device checks their corresponding path dependency metrics. If the metric remains below a preset deletion threshold (which is usually set more strictly than the anomaly detection threshold to prevent accidental deletion), the device will physically delete the edge from the graph database or mark its attributes as invalid, thereby preventing the propagation of erroneous logic in subsequent reasoning applications.

[0056] Simultaneously, the device scans for high-intensity edges in the causal graph. If connected entities exist in the causal graph... and The edges, and their standardized causal correlation. If the connection is significantly higher than any existing link in the graph, and the relationship does not yet exist in the graph database, the device will generate a new triple. And write it to the database. The relationship here... The initial default is a general causal relationship (such as related or causing), which can be further refined through the semantic analysis module.

[0057] Second, perform a logical reversal operation based on the Directionality Principle. This principle is used to solve the problem of causal inversion.

[0058] When the device processes triplets marked as having directional conflicts The device then compares the strength of bidirectional paths in the causal graph. Specifically, the device calculates the correlation of forward paths separately. Correlation with reverse path If the calculation result satisfies (in If the threshold for significant difference is used, then the true causal flow of the physical world is determined to be opposite to the current map record.

[0059] In this case, the device performs an atomic update operation on the graph database: first, it removes the existing directed edges. Then a new directed edge is established. and the relation type Synchronization is adjusted to the semantic inverse relationship (e.g., being triggered is adjusted to triggering, or remaining). .

[0060] Third, perform path optimization based on the Simplicity Principle. This principle aims to eliminate redundant indirect causality and restore the direct action mechanism of the physical device.

[0061] Fourth, in complex coal mine equipment, multiple parallel paths often exist between two entities. For example, a fan shutdown may directly lead to gas accumulation, or it may indirectly lead to gas accumulation through an intermediate node of reduced wind speed. If both direct connections and multi-hop connections exist in the graph, it may cause computational redundancy in the inference engine.

[0062] Fifth, the device connects the same pair of entities. All candidate paths are evaluated. If there exists a path of length... The shortest path and a path of length long path ( If the path correlation indices calculated by both paths are on the same order of magnitude (i.e., the difference is within a preset tolerance range), the device prioritizes retaining the direct causal relationship represented by the shorter path and marks the longer path as a derivative relationship or removes it. This logic is implemented algorithmically by comparing path length and correlation gain: the device only retains the longer path when the correlation improvement brought by the longer path significantly exceeds the interpretation cost caused by introducing additional hops.

[0063] Through the cascaded processing of the above three levels, the device completes the mapping correction from data statistical correlation to the logical structure of the graph, eliminating information deviations caused by the subjectivity of manual input or equipment aging, and providing an accurate baseline graph state for subsequent dynamic update steps.

[0064] See attached document Figure 1The production environment underground in coal mines is highly dynamic. As mining progresses, equipment ages and wears out, and geological conditions change, the causal dependencies between entities are not static. To avoid the enormous computational overhead of recalculating the entire historical dataset every time new data arrives, the device employs an incremental update mechanism based on sliding windows and exponential smoothing to maintain the global consistency score of triples in real time.

[0065] The device first maintains a pair of active entities in memory. A sliding time window. This window is used for a fixed length. (For example =60, representing the data time slice of the most recent hour. Whenever a new time slice of data... Processed and generates new single causality test scores Then, the device performs a first-in, first-out (FIFO) operation: it removes the leftmost (oldest) data point from the window and moves the latest data point to the leftmost (first-in, first-out) data point. Push it to the far right of the window.

[0066] At the current update time The device calculates the standardized causal correlation within a local window based on the valid data sequence within the window. To more accurately capture the latest trends in device status (e.g., a sudden decrease in the performance of a wind turbine leading to a weakening of correlation), this embodiment introduces a time decay factor. ( The data within the window is weighted. Data points closer to the current time have higher weights; the weight decreases exponentially as the data points become more distant. The calculation formula is as follows: ; in, Indicates the first Utilization of time slices The single-point causal correlation value calculated by the statistic. For the first Weighting coefficients for time-series data. When When the value is close to 1, the device has a long memory of historical data and strong noise resistance; when When the value is small (e.g., 0.8), the device is more sensitive to sudden changes, and the denominator term... As a normalization factor, ensure The numerical range remains consistent with the original correlation values.

[0067] The calculations reflect recent local trends. Then, the device needs to integrate this with historically accumulated knowledge to update the global consistency score stored in the graph database. The device employs an Exponential Moving Average (EMA) strategy to perform smooth updates, balancing historical priors with current evidence. The update formula is as follows: ; in, The updated global consistency score is used directly as the latest attribute value for the edge weights in the graph. This is the global consistency score from the previous update cycle. For triples initialized for the first time, Assuming the initial causal learning phase yielded , Step size coefficient ( The learning rate, also known as the knowledge graph update rate, determines the rate at which the knowledge graph is updated. In device implementation, this parameter can be used as an adaptive value: for newly connected devices or unstable monitoring areas, the device automatically increases the learning rate. The value is adjusted to accelerate convergence; for core devices that operate stably for a long time, the value is lowered. The value is set to prevent occasional sensor fluctuations from causing oscillations in the spectral structure.

[0068] Finish After the calculation, the device immediately triggers the threshold verification logic. If the updated threshold is... If the value falls below the failure threshold, the device marks the triplet as obsolete or dormant and temporarily disables its activation in the inference engine, rather than physically deleting it, so that it can be reused in subsequent operations. When it rebounds, it can recover quickly. Conversely, if a potential relationship that was originally dormant... If the value continues to rise and exceeds the activation threshold, the device will automatically activate the relationship. Through this mechanism, the device achieves adaptive evolution of the knowledge graph as the physical environment of the coal mine changes, maintaining the timeliness and accuracy of the knowledge base without human intervention.

[0069] To ensure the credibility of the coal mine safety knowledge graph during long-term operation and to address the potential black-box decision-making risks associated with automatic correction algorithms, this device integrates a storage layer based on distributed ledger technology. This layer is responsible for recording every change in the topology of the knowledge graph and the underlying causal statistical basis, thereby constructing an immutable and traceable full lifecycle audit chain.

[0070] The device first defines the evidence storage trigger events. The evidence storage interface module is activated whenever the triple correction module (step S4) performs operations such as deleting false relationships, reversing conflicting relationships, or adding potential relationships, or when the dynamic update module (step S5) updates the global consistency score of a relationship to a threshold, causing its state to reverse (e.g., from active to dormant). Considering the storage cost and throughput limitations of the blockchain network, this embodiment adopts a hybrid storage strategy: storing all data off-chain and storing fingerprints and metadata on-chain. The graph database continues to handle the query and retrieval of massive triple data, while the blockchain network only records core change credentials.

[0071] The device encapsulates each atomic write operation to the graph into a standardized set of transactions. This transaction set The data structure is strictly defined as follows: ; in, This indicates the precise timestamp (accurate to milliseconds) in which the operation occurred. This timestamp is synchronized by a trusted time server and is used to establish the chronological order of causal events. This indicates the operation type encoding. This indicates the specific triplet content affected by the operation, i.e. A unique identifier or serialized string, This indicates the mathematical basis for triggering the operation. This is a key field for achieving interpretability. If the operation is added during the causal learning phase, this value is [value missing]. If it's an anomaly correction, this value is path-dependent. If it is dynamically updated, this value is the global consistency score. Recording this value means that every change to knowledge is traceable, rather than being randomly altered. This represents a hash digest of the previous version's state. The device maintains an independent hash chain for each individual triple, or a global Merkle tree root hash. It points to the hash value of the last change transaction of the triple, thus logically linking the discrete change records into a strict chain structure.

[0072] After the transaction set is constructed Then, the device uses a cryptographic hash algorithm (such as SHA-256) to... Perform digest calculation to generate the current transaction hash. : ; in, SHA256 is a cryptographic hash function used to generate fixed-length (256-bit) hash values. The operator `||` represents a string concatenation operation, combining multiple data items into a single string or block of data. This indicates the mathematical basis for triggering the operation.

[0073] Subsequently, the device will contain plaintext metadata. The transaction request, along with the signature information, is broadcast to the consortium blockchain network or private blockchain network built by the coal mining company. PeerNodes in the network verify the transaction format and signing permissions. After reaching consensus through a consensus algorithm (such as PBFT using Byzantine Fault Tolerance or Raft consensus algorithm), the transaction is packaged into a new block and appended to the distributed ledger. The tail, that is .

[0074] Once the data is stored in the ledger, any attempt to tamper with historical records (such as maliciously modifying the associated weights of accident causes) will be detected by the device due to the break in the hash chain. When security managers need to audit the evolution history of a security rule (such as a wind turbine shutdown causing a gas overload), the device can retrieve the on-chain ledger and replay all instances of that triple in chronological order. Operation and Based on this, the entire process of the knowledge point from its initial discovery to causal confirmation and dynamic weight adjustment can be reproduced, thus achieving transparency and compliance in the knowledge graph maintenance process.

[0075] This embodiment selects a coal mine underground tunneling face as a specific application scenario to verify the device's ability to handle complex causal relationships between equipment status and environmental parameters. In this scenario, the core entities involved include the local ventilation fan (entity). ) and tunnel face return air gas sensor (physical) During the data acquisition and matrixing phase, the device receives on / off sensor signals from the local ventilation fan and analog signals from the gas sensor. The device is set to a time slice. The duration is 30 seconds. For local ventilation fans, the raw data is a Boolean switch value. The device discretizes and encodes its state as follows: : Shutdown, 1: Run .

[0076] For gas sensors, the raw data is a continuous floating-point number ranging from 0.00% to 4.00%. The device performs discretization mapping according to the alarm thresholds specified in the "Coal Mine Safety Regulations": when the concentration value... When, it is mapped to state 0 (normal); when When that time, it is mapped to state 1 (out of bounds).

[0077] Ultimately, the device constructed an observation data matrix. Each line records the combined status of whether the ventilator is stopped or running within a specific 30-second period, and whether the gas level exceeds the limit.

[0078] During the causal structure learning phase, the device computes entities. With entity The statistical dependence between them. Assuming within the observation window... Within a given time frame, the device collected the following key data: the local ventilation fan was in a stopped state ( The total number of times is 50.

[0079] After the ventilation fan stops Within the hysteresis window, the gas concentration becomes excessive. The number of observations was 48. In the entire sample, the probability of natural gas exceedance (ignoring fan status) is extremely low, assuming its expected frequency of independent occurrence is... The number of times is only 0.5. The device is substituted into the formula for calculation. Statistic: ; because The value is much larger than the critical value for the independence hypothesis, and the standardized causal correlation... Based on the high level of the data, the device confirmed that there is a very strong correlation between the shutdown of local ventilation fans and the excessive gas levels.

[0080] During the anomaly detection and map correction phase, the device reads existing historical knowledge triples from the map database. Assume there exists a rule in the existing map that was manually entered in the early stages: The gas level exceeded the limit, causing the ventilation fan to shut down. This rule may have been entered based on some kind of gas-electric interlock safety control logic (i.e., automatically cutting off the power supply after the gas level exceeds the limit), but at the level of physical causality, this creates a logical conflict with the physical fact that the fan shutdown leads to gas accumulation.

[0081] The device applies the directionality principle for verification. The device calculates the time lag mutual information in two directions: direction A... : Calculation found State changes (downtime) lead on average over time. The status change (over the limit) takes approximately 120 seconds.

[0082] Direction B : Calculation found The state change (out of bounds) does not significantly precede the The status change (shutdown), or as shown in the data. After the machine was shut down It has only just risen.

[0083] Based on the time-series characteristics derived from data statistics, the device determines... Therefore, the device identifies There is a directional error.

[0084] Subsequently, the device performs a triplet correction operation. The device first checks the graph database... The attribute is marked as a logic error (Logic_Error) and logically deleted. Then, the device generates and writes a new triplet. (Local ventilation fan shutdown caused excessive gas levels), and the calculated standardized correlation values ​​were used. This serves as the initial confidence weight for the relationship.

[0085] During the dynamic update phase, the device continuously processes newly incoming data streams. Assume the mine has installed a dual-fan, dual-power automatic switching device at the tunneling face. When the main fan stops, the standby fan automatically starts within 5 seconds, ensuring that gas levels no longer exceed limits after the main fan stops.

[0086] As time goes by, within the sliding window The frequency of [something] decreased significantly, leading to local correlation. A sharp decrease. The device utilizes a smooth update formula. Update the global consistency score of the triplet. When When the correlation drops below the preset weak correlation threshold, the device automatically downgrades the relationship type of the triple from strong to weak or conditional correlation, and notes in the attribute that it needs to be judged in conjunction with the status of the standby fan.

[0087] Through the above implementation process, the device realizes the real-time mapping of changes in the physical world's operating conditions to the knowledge graph in the digital space, correcting the problems of outdated and erroneous knowledge caused by human misunderstanding or equipment upgrades.

Claims

1. A knowledge graph anomaly detection and correction method based on causal reasoning, characterized in that, Includes the following steps: Data acquisition and matrixing steps: Collect multi-source heterogeneous monitoring data, clean and process the data, map the multi-source heterogeneous monitoring data onto a unified time axis and discretize it to generate a multi-dimensional standardized observation data matrix that reflects the joint state of each variable at the same time. Causal structure learning steps: Based on the multidimensional standardized observation data matrix, perform statistical independence tests and causal effect quantification; calculate standardized causal correlation values ​​between entities through log-likelihood ratio statistics and normalization processing; and construct a causal graph containing causal dependencies and weights based on the standardized causal correlation values. Anomaly detection steps: The causal graph containing causal dependencies and weights is used as the benchmark for verifying anomaly identification. Path retrieval is performed on triples in the domain knowledge graph. The credibility of the triples is increased by aggregating the standardized causal correlation values ​​on the retrieved paths and combining them with the path decay coefficient to calculate the path correlation index of the triples. The credibility is then compared with the preset credibility threshold and relational direction features to identify the type of abnormal triples. The triplet correction and local update steps are as follows: Based on the type of the identified abnormal triplet, the domain knowledge graph is deleted and its direction is reversed; for newly added triplets, the quality of the triplet is evaluated using a causal score update strategy based on a sliding time window, and the domain knowledge graph is locally updated to correct the knowledge graph structure.

2. The knowledge graph anomaly detection and correction method based on causal reasoning according to claim 1, characterized in that, In the data acquisition and matrixing steps, the process of generating the standardized observation data matrix includes: Set a global reference time axis and divide the global reference time axis into continuous time slices of equal length; A sliding window mechanism is used to aggregate continuous numerical data and discrete event data with different sampling frequencies into the corresponding time slices; The aggregated data is discretized and encoded to construct a matrix with a dimension equal to the number of time slices multiplied by the total number of variables. Each row vector of the matrix represents the discretized joint observation state of all variables within a given time slice.

3. The knowledge graph anomaly detection and correction method based on causal reasoning according to claim 1, characterized in that, In the causal structure learning step, the process of calculating the standardized causal correlation value includes: The joint observation frequency of two entities appearing simultaneously in the standardized observation data matrix is ​​counted, and the expected frequency of the two entities appearing simultaneously is calculated using the independence assumption formula. The degree of difference between the joint observation frequency and the expected frequency is calculated using the log-likelihood ratio statistic formula; By normalizing the statistical values ​​by combining the total sample size and the degrees of freedom of the discrete states of entities, the standardized causal correlation value used to characterize the strength of causal association between entities is obtained.

4. The knowledge graph anomaly detection and correction method based on causal reasoning according to claim 1, characterized in that, In the anomaly detection step, the process of calculating the confidence level includes: Search the causal graph for all valid connected paths that connect the head and tail entities of the triplet, and set a maximum search depth limit; For each of the effective connected paths, the standardized causal correlation values ​​of all edges on the path are aggregated. By introducing an exponential decay model based on path length as the path decay coefficient, the path correlation index of the effective connected path is calculated and converted into the credibility. The exponential decay model is used to reduce the confidence level as the path length increases, characterizing the loss of causal effects during transmission and avoiding spurious long-distance dependencies.

5. The knowledge graph anomaly detection and correction method based on causal reasoning according to claim 4, characterized in that, In the anomaly detection step, the logic for identifying the type of the abnormal triplet includes: If there is no connected path between the head entity and the tail entity in the causal graph, or if the maximum confidence calculated by the path search and decay model is less than the preset confidence threshold, then the triple is marked as a false relation triple. If the direction of the triple recorded in the domain knowledge graph is from the head entity to the tail entity, but the credibility of the triple from the tail entity to the head entity in the causal graph is significantly higher than that from the head entity to the tail entity, then the triple is marked as a direction conflict triple.

6. The knowledge graph anomaly detection and correction method based on causal reasoning according to claim 5, characterized in that, In the triplet correction step, the following operations are performed: When the triple is marked as a false relation triple, the triple is deleted from the domain knowledge graph; When the triple is marked as a directional conflict triple, the original directed edge is removed in the domain knowledge graph, a new directed edge is established pointing from the original tail entity to the original head entity, and the relation type is adjusted to a semantic inverse relation. When there are multiple connected paths in the causal graph with the same order of magnitude of path correlation index, the direct causal relationship corresponding to the shortest path is retained, and the indirect relationship corresponding to the longer path is eliminated.

7. The knowledge graph anomaly detection and correction method based on causal reasoning according to claim 1, characterized in that, In the triplet correction and local update steps, the causal score update strategy based on the sliding time window includes: Maintain a sliding time window containing the most recent time slices. As new data flows in, remove the oldest data in the sliding time window and move in the latest single-point causal correlation value calculated by the statistical formula. Local standardized causal correlation within the sliding time window is calculated using a time decay weighted algorithm, where data closer to the current time has a higher weight. The global causal score of the triple is calculated and updated by combining the global causal score of the previous time step with the current local standardized causal correlation using the exponential moving average algorithm. The activation or dormancy state of the triple in the domain knowledge graph is then adjusted based on the updated global causal score.

8. The knowledge graph anomaly detection and correction method based on causal reasoning according to claim 1, characterized in that, The knowledge graph anomaly detection and correction method further includes a blockchain evidence storage step, which includes: When the triplet correction step causes a change in the structure of the domain knowledge graph, a transaction record is generated that includes a change timestamp, operation type code, affected triplet content, standardized causal correlation value as the basis for the change, and the previous version state hash value. The digital digest of the transaction record is calculated using a cryptographic hash algorithm, and the digital digest is sent to blockchain network nodes for consensus and on-chain storage.

9. The knowledge graph anomaly detection and correction method based on causal reasoning according to claim 3, characterized in that, The entities include the operating status of local ventilation fans in underground coal mines and the concentration monitored by gas sensors; The causal structure learning step is used to identify and calculate a strong causal relationship between the local ventilation fan shutdown state and the gas sensor over-limit state through statistical methods, thereby eliminating the logical inversion error that the gas over-limit causes the local ventilation fan to shut down.

10. A knowledge graph anomaly detection and correction device based on causal reasoning, characterized in that, An anomaly detection and correction method for knowledge graphs based on causal reasoning, as described in any one of claims 1-9, includes: The data acquisition and matrixing module is used to receive multi-source heterogeneous monitoring data and transform it into a multi-dimensional standardized observation data matrix through cleaning and mapping processes. The causal structure learning module is used to quantify causal effects, calculate standardized causal correlation values, and construct causal graphs based on the multidimensional standardized observation data matrix through log-likelihood ratio statistics and normalization processing. An anomaly detection module is used to use the causal graph as a benchmark, calculate the path correlation index to quantify the credibility by aggregating the standardized causal correlation values ​​on the path and combining them with the path decay coefficient, and identify the types of abnormal triples in the domain knowledge graph by using the credibility threshold and the relationship direction. The triplet correction and local update module is used to perform deletion and direction reversal operations on the domain knowledge graph based on the anomaly detection results, and to perform local graph updates on newly added triplets using a causal score update strategy based on a sliding time window.

Images