Power grid log and message combined diagnosis method based on lpct cross-source correlation model

Abstract

The application discloses a power grid log and message combined diagnosis method based on an LPCT cross-source association model, and belongs to the technical field of power system automation operation and maintenance, and comprises the following steps: collecting logs and messages of an intelligent transformer substation, and performing combined diagnosis by using an LPCT cross-source association model; the LPCT cross-source association model comprises the following steps: a data access layer; an analysis layer, which respectively performs structural analysis on each log and message; an association layer, which generates a request response mask matrix and a bidirectional business relationship attention bias matrix; an inference layer, which performs bidirectional interaction and selective fusion guided by rules by using a cross-source feature fusion network, and generates a global diagnosis representation; and an output layer, which is used for multi-dimensional confidence evaluation, and determines a fault diagnosis report output or a rejection output according to a preset threshold value. The application realizes combined intelligent analysis of logs and messages, constructs a multi-source event association diagnosis mechanism, and thus realizes high-confidence automatic abnormal diagnosis.

Description

Technical Field

[0001] This invention belongs to the field of power system automation operation and maintenance technology, specifically involving a joint diagnosis method of power grid logs and messages based on the LPCT cross-source correlation model. Background Technology

[0002] With the advancement of smart substation construction and the renovation of old substations, a large number of remote control records, telemetry anomaly records, alarm records, and communication messages such as IEC61850, Network 103, and IEC104 are generated in the station control layer and process layer network. Although existing network distribution devices can collect and display some message parsing results, in field fault handling, maintenance personnel still need to manually review multiple types of logs, check messages frame by frame, and make comprehensive judgments in conjunction with protocol texts, point tables, and address mapping tables. This has problems such as being time-consuming, relying on expert experience, and having insufficient ability to correlate logs and messages.

[0003] Existing message parsing technologies mostly rely on fixed rules or protocol templates, which are adequate for standard protocols. However, in actual engineering projects, devices from different manufacturers contain a large number of proprietary fields, non-standard descriptions, and incomplete messages, leading to frequent parsing failures or errors and demonstrating insufficient adaptability. For example, patent application CN104579818A discloses a method for detecting abnormal messages in a smart substation network. This method relies on fixed rules and single-frame message matching, making it difficult to handle the joint diagnosis of logs, remote control processes, alarm statuses, and request-response relationships. Patent CN107037278A discloses a fault diagnosis method for smart substations under the IEC61850 standard. Although it incorporates deep learning, it mainly targets IEC61850 MMS messages and does not cover protocols such as Network 103 and IEC104. It also fails to address issues such as adaptive parsing of proprietary protocols, cross-source correlation, evidence location, and rejection due to low confidence.

[0004] In summary, existing technologies suffer from several shortcomings, including difficulty in forming a unified event chain through separate log and message analysis, insufficient adaptability of message parsing to private protocols, and a lack of cross-source correlation diagnostic models. Therefore, there is an urgent need to provide a method that enables joint structured parsing of logs and messages, cross-source feature fusion, and joint diagnosis. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a joint diagnostic method for power grid logs and messages based on the LPCT cross-source correlation model. This method enables joint intelligent parsing of logs and messages, constructs a multi-source event correlation diagnostic mechanism, and thus achieves high-confidence automated anomaly diagnosis.

[0006] This invention provides the following technical solution:

[0007] Firstly, a joint diagnostic method for power grid logs and messages based on the LPCT cross-source correlation model is provided, including: Logs and messages from the intelligent substation are collected within a target time window, and joint diagnosis is performed using the LPCT cross-source correlation model to output a fault diagnosis report. The LPCT cross-source correlation model includes: The data access layer is used to receive and preprocess the collected data; The parsing layer is used to perform structured parsing on each log and message, and uniformly encode them into log event vectors and message event vectors. The association layer is used to group all event vectors according to device, signal path, information body address, source and destination addresses and protocol type. For each group, all log event vectors are transformed into log event token sequences and all message event vectors are transformed into message event token sequences. At the same time, a request-response mask matrix and a bidirectional business relationship attention bias matrix are generated. The inference layer is used to input the log event token sequence, message event token sequence, business relationship attention bias matrix, request response mask matrix, and rule diagnosis feature vector generated based on preset diagnostic rules into the cross-source feature fusion network for bidirectional interaction and rule-guided selective fusion, generate a global diagnostic representation, and simultaneously extract the cross-source attention base matrix; The output layer is used to perform multi-dimensional confidence assessment based on the global diagnostic representation and cross-source attention matrix, and to output a deterministic or rejection report of the fault diagnosis report according to a preset threshold.

[0008] Optionally, each log entry is parsed in a structured manner and uniformly encoded into a log event vector, specifically as follows: For each log entry, its format is identified. If it is a fixed-format log entry, it is parsed using regular expressions and a field dictionary. If it is a non-fixed-format log entry, a large language model is invoked to extract instructional fields according to a preset prompt template, thus obtaining the log parsing result. The log event vector is then encoded according to a preset encoding format. If a log contains two conflicting parsing results, a decision will be made based on the confidence level or a preset rule. Each message is parsed in a structured manner and uniformly encoded into a message event vector, specifically as follows: The message is identified by protocol, and the corresponding field extractor is called to parse it based on the protocol type, thus obtaining the message parsing result. The results of comprehensive analysis using address mapping tables, point tables, and SCD or CID are used. parse the message results Compared with log parsing results After aligning the device and model, the data is encoded according to a preset encoding format to obtain the message event vector. .

[0009] Optionally, the generation of the request-response mask matrix and the bidirectional business relationship attention bias matrix specifically includes: All event vectors are grouped according to device, signal path, information body address, source and destination addresses, and protocol type to obtain diagnostic groups; In each diagnostic group, logs and messages are unordered and paired to obtain several log-message event pairs. The relationship vector of each event pair is calculated and linearly transformed to generate bidirectional attention bias values. The in-direction bias values ​​of all event pairs are then assembled to obtain a bidirectional business relationship attention bias matrix. This includes the log-to-message bias matrix. And the bias matrix from message to log ; Calculate the mask value for each event pair, and assemble the mask values ​​of all event pairs to obtain the request-response mask matrix. .

[0010] Optionally, the formula for calculating the relation vector of each event pair and generating the bidirectional attention bias value is as follows: ; ; in, For the first The log event vector and the first The relation vector of event pairs corresponding to each message event vector. For the time difference, , , , , and The first Each log event vector contains the event time, device identifier, signal path or message body address, source and destination addresses, quality bits or status bits, and protocol type. , , , , and The first Each message event vector contains the event time, device identifier, signal path or message body address, source and destination addresses, quality bits or status bits, and protocol type. For indicator functions, This is a protocol type matching function. For request-response relationship matching functions, and The first The first log event and the first One message event; This is the attention bias value from message to log. and These are the linear transformation weight matrix and linear transformation bias term from message to log, respectively. This is the attention bias value from log to message. and These are the linear transformation weight matrix and linear transformation bias term from log to message, respectively.

[0011] Optionally, the formula for calculating the mask value of each event pair is: ; in, For the first The log event vector and the first The mask value of the event pairs corresponding to each message event vector. OR operation, The time window threshold, This is a session matching function.

[0012] Optionally, the cross-source feature fusion network includes several cascaded stacked blocks, a rule diagnosis module, and a joint diagnosis module; the rule diagnosis module is used to perform rule diagnosis on each log event vector and message event vector based on a preset diagnosis library, calculate the trigger score for each fault type, and organize them into rule diagnosis feature vectors according to the rule index order. Each stack block is based on a log event token sequence, a message event token sequence, a business relationship attention bias matrix, a request-response mask matrix, and a rule diagnostic feature vector. Selective fusion of bidirectional interaction and rule-guided approaches is performed, and the output of the current stack block is passed layer by layer as the input of the next stack block, finally yielding the log-side fusion feature. Message-side fusion features The joint diagnostic module integrates log-side features. Message-side fusion features Perform aggregation and output a global diagnostic representation. And extract the cross-source attention base matrix from all stacked blocks.

[0013] Optionally, each stacked block includes: a log self-attention layer, a packet self-attention layer, a log-to-packet cross-attention layer, a packet-to-log cross-attention layer, a rule-gated fusion layer, a feedforward network, a residual connection, and layer-by-layer normalization; The log attention layer and message self-attention layer perform self-attention encoding on the log event token sequence and message event token sequence, respectively, to obtain log time-series context features. and message timing context features ; The log-to-message cross-attention layer and message-to-log cross-attention layer firstly perform bidirectional cross-attention calculations for log-to-message and message-to-log based on the request-response mask matrix and the corresponding business relationship attention bias matrix, respectively, to obtain the log-to-message cross-source attention. Cross-source attention from messages to logs Then, each is combined with the corresponding log time-series context features. and message timing context features Generate log-side cross-attention enhancement features and message side attention enhancement features ; The rule-gated fusion layer first converts the rule diagnostic feature vector... Perform linear transformation and broadcasting to generate prior bias features. Then, each is combined with log-side attention enhancement features. and message side attention enhancement features Calculate log-side gating weights and message-side gating weights And for cross-attention layer output and prior bias features Perform adaptive weighted fusion to obtain the current stack block. Output log-side rule gating fusion features Features of message-side rule gating After passing through a feedforward network, residual connections, and layer normalization, the output is sent to the next stack block.

[0014] Optionally, the step of performing multi-dimensional confidence assessment based on the global diagnostic representation and cross-source attention matrix, and outputting a deterministic or rejection report for the fault diagnosis report according to a preset threshold, specifically involves: Calculate the probability of fault categories based on global diagnostic representation. And extract the rule diagnosis score of the fault from the rule diagnosis feature vector. ; Based on cross-source attention benchmark matrix Combined with a two-way business relationship attention bias matrix and request / response mask matrix Generate a log-message evidence correlation matrix And calculate the log-message correlation strength. ; A comprehensive assessment of the completeness of logs, messages, and related pairs is used to calculate an evidence completeness score. ; The final diagnostic confidence of each candidate fault type is calculated according to the following formula. If the maximum confidence is greater than the confidence threshold and the difference between the maximum confidence and the second largest confidence is greater than the category distinction threshold, a deterministic diagnostic conclusion is output to form a diagnostic report; otherwise, a rejection conclusion is output to form a diagnostic report. ; in, Fault Category The final diagnostic confidence level, This represents a multilayer perceptron.

[0015] Optionally, the total loss function for training the LPCT cross-source association model is: ; ; ; ; in, For the total loss, Loss to the main task To supplement the loss, we include log structure parsing loss and message structure parsing loss. To balance the auxiliary loss, These represent the losses due to fault classification. Loss of evidence location And log-message alignment loss Weighting coefficients; This indicates the total number of log events within the current diagnostic group. This represents the total number of message events within the current diagnostic group; Indicates the first The log event and the first The true correlation labels between individual message events; Evidence correlation matrix The element value in the array represents the predicted first value. The log event and the first The probability of the correlation strength between individual message events; No. The log-side fused feature vector obtained by fusing log events through a feature fusion network For the first The message-side fused feature vector obtained by fusing individual message events through a feature fusion network; It is an exponential function. This refers to temperature hyperparameters.

[0016] In a second aspect, a computer-readable storage medium is provided for storing a computer program; when the computer program is executed by a processor, it implements the steps of the joint diagnostic method for power grid logs and messages based on the LPCT cross-source correlation model as described in any one of the first aspects.

[0017] Compared with the prior art, the beneficial effects of the present invention are: (1) This invention realizes unified event-based modeling of logs and messages, constructs remote control operation chains, telemetry change chains, alarm status chains, and message interaction chains according to devices, signals, addresses, and session relationships, restores the complete process before and after the fault, solves the problem of separate analysis of logs and messages, and improves cross-source correlation capabilities. This invention realizes bidirectional semantic interaction between logs and messages through cross-source feature fusion networks, and injects power prior knowledge by combining business relationship bias and request-response masking, effectively identifying contextual correlation anomalies such as no return for requests, abnormal responses, and incomplete messages. In addition, this invention designs an evidence location and confidence fusion mechanism, constructs an evidence correlation matrix to quantitatively characterize event contributions and output key evidence, and comprehensively evaluates confidence based on four factors. When the confidence is low, it outputs a rejection label and basis for review, avoiding forced diagnosis. Finally, this invention outputs a complete report containing fault type, device, time, key logs and messages, judgment basis, confidence, and handling suggestions. Maintenance personnel can directly obtain diagnostic basis without manually reviewing logs and messages, greatly reducing fault handling time and manual dependence.

[0018] (2) This invention provides a clear network structure, mathematical formula, and algorithm flow for the LPCT cross-source association model. Each stage, from parsing to fusion, localization, and confidence calculation, has a reproducible technical path, facilitating engineering deployment. This invention employs a message-log dual-mode heterogeneous parsing approach. Fixed formats are guaranteed deterministically by regular expressions and dictionaries, while non-fixed formats and proprietary specifications are dynamically completed by a large language model. Consistency checks and collaborative adjudication ensure both accuracy and generalization ability. This invention achieves deep coupling between rules and deep features through a rule-gated fusion layer, enabling the model to possess both rule determinism and neural network generalization ability. This invention employs multi-task joint training, incorporating front-end parsing and back-end diagnosis into a unified optimization objective, achieving end-to-end optimization from raw data to diagnostic conclusions. Attached Figure Description

[0019] Figure 1 This is a block diagram of the overall structure of the LPCT cross-source association model of the present invention; Figure 2 This is a schematic diagram illustrating the working principle of the dual-mode heterogeneous parsing of messages and logs in this invention; Figure 3 This is a schematic diagram of the cross-source feature fusion network of the present invention; Figure 4This is a flowchart illustrating the generation process of the business relationship attention bias and request-response mask in this invention. Figure 5 This is a schematic diagram illustrating the calculation principle of the rule-gated fusion layer of the present invention; Figure 6 This is a schematic diagram illustrating the generation of the log-message evidence correlation matrix and the selection of key evidence in this invention. Figure 7 This is a flowchart of the confidence fusion and adaptive output decision-making process of this invention; Figure 8 This is a flowchart illustrating the structured parsing of logs and communication messages in this invention. Figure 9 This is a flowchart illustrating the multi-source event correlation diagnosis of the present invention; Figure 10 This is a graph showing the loss curve of the training set in this invention; Figure 11 This is a loss curve diagram of the test set for this invention; Figure 12 This is a bar chart comparing the diagnostic performance of the present invention and the comparative method. Detailed Implementation

[0020] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be used to limit the scope of protection of the present invention. It should be noted that the term "comprising" and any variations thereof in the specification, claims and the above-mentioned drawings of the present invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or devices.

[0021] Example 1: like Figure 1 As shown, a method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model is provided, including: collecting logs and messages of a smart substation within a target time window, performing joint diagnosis using the LPCT cross-source correlation model, and outputting a fault diagnosis report.

[0022] The LPCT cross-source correlation model (Log-Packet Cross-source Transformer) can perform joint representation learning and interpretable reasoning on multi-source heterogeneous operation and maintenance data of power systems. It breaks through the traditional intelligent operation and maintenance system's processing paradigm of treating unstructured logs and semi-structured messages as independent data sources, and realizes deep fusion and joint diagnosis of the two types of heterogeneous data at three levels: event level, feature level, and evidence level.

[0023] The LPCT cross-source association model includes: data access layer, parsing layer, association layer, inference layer, and output layer.

[0024] I. Data Access Layer.

[0025] Responsible for the unified acquisition and preprocessing of multi-source data from the network distribution unit. The preprocessing methods refer to existing technologies, including timestamp alignment and redundancy removal.

[0026] II. Parsing Layer.

[0027] This is used to perform structured parsing of each log and message separately, and to uniformly encode them into log event vectors and message event vectors.

[0028] like Figure 2 As shown, this invention establishes a collaborative working mechanism of two parsing paths: rule-driven and large model-driven. This ensures both the determinism and high efficiency of parsing standard format data, while also providing generalization and adaptability to private specifications, non-standard descriptions, and incomplete messages.

[0029] For any log or message record, it is uniformly encoded as an event vector. ,in For the time of the event, For equipment identification, This refers to the signal path or information body address. For action or service type, This is a quality bit or a status bit. and Let them be the source and destination addresses, respectively. For event categories, To expand the fields, event categories must include at least remote control selection request, remote control selection response, remote control execution request, remote control execution response, telemetry change, alarm occurrence, alarm reset, message request, message response, and message exception. Event vectors include log event vectors. and message event vector Log event vectors and message event vector Add to structured event collection middle.

[0030] The parsing layer performs log structured parsing and message structured parsing in parallel.

[0031] Log structured parsing specifically includes: Identify the format of each log entry. For logs with a fixed format, use regular expressions and a field dictionary to parse them, obtaining the... Log parsing results : ,in, For a single raw log record; Rule sets and dictionaries used for regular expression matching and field extraction; This is a function for structuring and parsing logs.

[0032] For non-fixed format logs, the large language model is invoked to extract imperative fields according to a preset prompt template, resulting in the... Log parsing results : ,in, This is a template for log extraction prompts. For a small sample example, This is a parsing function for Large Language Model (LLM).

[0033] When the outputs of two paths conflict, the consistency check function is invoked, and the final output is determined based on the higher confidence parsing result or the field dictionary priority rule. ,in, These represent the parsing results of fixed and non-fixed format logs, respectively, and the results conflict. This represents a consistency check function. When the results of two paths conflict, the result with higher confidence or rule priority shall prevail.

[0034] Log parsing results The log event vector is obtained by encoding according to the preset encoding format. .

[0035] Message structured parsing, specifically including: The message is identified by protocol, and the corresponding field extractor is called to parse it based on the protocol type, thus obtaining the message parsing result. The protocol identification formula is: ,in, This is a protocol identification function used to determine the message. type Describe the message type, It contains parsing templates and private specification samples that include multiple specifications.

[0036] The corresponding field extractor is invoked based on the protocol type. When a message field is incomplete, fails verification, or belongs to an unknown private field, LLM is invoked to complete it, based on the context of the current message. Using frames as context, and combining them with a specification field sample library, a large language model is invoked to complete and correct fields. ;in, It is the original single message The completed and corrected message, This is a message parsing prompt template. For the current message before and after Frame context, This is a sample library of specification fields. This is a parsing function for Large Language Model (LLM).

[0037] To enable message events to be matched with log events in the device identifier and signal path For field alignment, this invention establishes a three-layer progressive mapping mechanism. Let the combined parsing result of the address mapping table, point table, and SCD or CID be... Then the mapping function is expressed as: ;in, This function represents a device-signal mapping function, and its output is the mapped device. ,Signal and mapping confidence After mapping, the parsing result of a single message is encoded according to a preset encoding format to obtain the message event vector. .

[0038] Mapping is performed according to the following priority: In IEC 61850 scenarios, devices and signals are determined by the IED, AccessPoint, LDevice, LN, and DO or DA paths in the SCD or CID file, along with the MMS object path; in IEC 104 and Network 103 scenarios, mapping is determined by the common address, function type, information body address, point table, and device address table; if unique determination is not possible, the source address is considered. Destination address The output candidate mappings and mapping confidence of the session relationship and specification sample library. .

[0039] like Figure 8 As shown, the specific process of log and communication message structured parsing is as follows: Input: Log collection Message set Field dictionary Agreement rules SCD or CID configuration, point table, address mapping table , prompt template and .

[0040] Output: A collection of structured events Log structured parsing results and message structure parsing results .

[0041] Step E1: Initialize the structured event set ; Step E2: For each log entry : Step E21: Perform format recognition to determine whether the log type is remote control record, telemetry record, alarm record, or other record.

[0042] Step E22: If If the fixed format is met, then execute. .

[0043] Step E23: If If the fixed format is not met, then execute. .

[0044] Step E24: If both paths have output, execute... .

[0045] Step E25: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] join in .

[0046] Step E3: For each message frame : Step E31: Execute Protocol Identification .

[0047] Step E32: If the protocol is a standard protocol, call the corresponding rule parser to extract the fields.

[0048] Step E33: If a field is missing or validation fails, execute... .

[0049] Step E34: Perform device and signal mapping .

[0050] Step E35: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] join in .

[0051] Step E4: For each parsed result, convert it into an event vector based on the common fields and extended fields. ,Will Add to structured event collection Output , and .

[0052] III. Related Layers.

[0053] This is used to group all event vectors by device, signal path, information body address, source and destination addresses, and protocol type. For each diagnostic group, all log event vectors are converted into log event token sequences, all message event vectors are converted into message event token sequences, and a request-response mask matrix and a bidirectional business relationship attention bias matrix are generated.

[0054] like Figure 4As shown, all parsed log event vectors are generated according to the same device, the same signal path, the same information body address, or the same session relationship. and message event vector It is divided into several diagnostic groups.

[0055] For any diagnostic group, construct a log event token vector. and message event token vector : ; ; in, and These are the event and message token embedding functions, respectively.

[0056] Within each diagnostic group, logs and messages are unordered and paired to obtain several log-message event pairs. The relationship vector for each event pair is calculated and linearly transformed to generate bidirectional attention bias values. The in-direction attention bias values ​​of all event pairs are then assembled to obtain a bidirectional business relationship attention bias matrix. This includes the log-to-message bias matrix. And the bias matrix from message to log .

[0057] The formulas for calculating the relation vector for each event pair and generating the attention bias value are as follows: ; ; in, For the first The log event vector and the first The relation vector of event pairs corresponding to each message event vector. For the time difference, , , , , and The first Each log event vector contains the event time, device identifier, signal path or message body address, source and destination addresses, quality bits or status bits, and protocol type. , , , , and The first Each message event vector contains the event time, device identifier, signal path or message body address, source and destination addresses, quality bits or status bits, and protocol type. and The first The first log event and the first One message event; This is an indicator function; 1 indicates the same value, and 0 indicates a different value. This is a protocol type matching function. A function for matching request-response relationships; The attention bias value for the message to log is generated by linearly transforming the relation vector. and These are the linear transformation weight matrix and linear transformation bias term from message to log, respectively. This is the attention bias value from log to message. and These are the linear transformation weight matrix and linear transformation bias term from log to message, respectively. , , and All of these are learnable parameters.

[0058] The pairing of log events and message events is not based on a single timestamp alignment, but rather achieves precise association by constructing a multi-dimensional business relationship vector. This business relationship vector encompasses features such as time difference, device and signal path consistency, address matching, protocol compatibility, and request-response logic matching. The vector generates an attention bias, guiding the model to focus on highly correlated event pairs. Simultaneously, request-response masks are used to suppress irrelevant pairings, and virtual events are automatically constructed for missing responses to maintain the integrity of the diagnostic chain. This achieves a traceable and structured association between logs and messages.

[0059] Request-response masks are used to reduce interference from irrelevant messages in diagnostics. The mask value for each event pair is calculated, and the mask values ​​of all event pairs are assembled to obtain the request-response mask matrix. .

[0060] The formula for calculating the mask value of each event pair is: ; in, For the first The log event vector and the first The mask value of the event pairs corresponding to each message event vector. OR operation, The time window threshold, This is a session matching function.

[0061] IV. Reasoning Layer.

[0062] This is used to input log event token sequences, message event token sequences, business relationship attention bias matrix, request-response mask matrix, and rule-based diagnostic feature vectors generated based on preset diagnostic rules into a cross-source feature fusion network for selective fusion through bidirectional interaction and rule guidance, generating a global diagnostic representation, and simultaneously extracting the cross-source attention base matrix.

[0063] like Figure 3 As shown, the cross-source feature fusion network includes several stacked blocks connected in series, a rule diagnosis module, and a joint diagnosis module.

[0064] The rule-based diagnostic module performs rule-based diagnostics on log event vectors and message event vectors based on a preset diagnostic library, calculates the trigger score for each fault type, and organizes them into rule-based diagnostic feature vectors according to the rule index order. .

[0065] Each stack block is based on the log event token sequence, message event token sequence, business relationship attention bias matrix, request-response mask matrix, and rule diagnostic feature vector. Selective fusion of bidirectional interaction and rule-guided approaches is performed, and the output of the current stack block is passed layer by layer as the input of the next stack block, finally yielding the log-side fusion feature. Message-side fusion features .

[0066] Each stack block includes: a log self-attention layer, a message self-attention layer, a log-to-message cross-attention layer, a message-to-log cross-attention layer, a rule-gated fusion layer, a feedforward network, residual connections, and layer-by-layer normalization.

[0067] The log attention layer and the message self-attention layer perform self-attention encoding on the log event token sequence and the message event token sequence, respectively, to obtain log time-series context features. and message timing context features ; ; ; in, and These are the token vector sequences of all log and message events within the group; and These represent log self-attention and message self-attention operations, respectively.

[0068] For log-to-message cross-attention layer and message-to-log cross-attention layer, firstly, based on the request-response mask matrix and the corresponding business relationship attention bias matrix, bidirectional cross-attention calculations are performed for log-to-message and message-to-log respectively, to obtain the log-to-message cross-source attention. Cross-source attention from messages to logs Then, each is combined with the corresponding log time-series context features. and message timing context features Generate log-side cross-attention enhancement features and message side attention enhancement features .

[0069] ; ; in, and This represents the cross-attention network output for both message-to-log and log-to-message. and These represent the offset from message to log and the offset from log to message, respectively. This is the request / response mask matrix. and These are the token vector sequences for all log and message events within the group. Log Query Message key Message value Message Query Log key Log value , , , , , and All are learnable projection matrices.

[0070] ; ; in, and This represents the cross-attention network output for both message-to-log and log-to-message. and These represent the log and message cross-attention and self-attention fusion normalized outputs, respectively.

[0071] The rule-gated fusion layer first combines the rule-based diagnostic feature vectors. Perform linear transformation and broadcasting to generate prior bias features. Then, it combines log-side attention enhancement features. and message side attention enhancement features Calculate log-side gating weights and message-side gating weights And for cross-attention layer output and prior bias features Perform adaptive weighted fusion to obtain the current stack block. Output log-side rule gating fusion features Features of message-side rule gating After passing through a feedforward network, residual connections, and layer normalization, the output is sent to the next stack block.

[0072] like Figure 5 As shown, the mapping relationship of the rule-gated fusion layer is as follows: ;in, These represent the rule gating fusion outputs from the log side and the message side, respectively. This indicates a rule-gated fusion network. This is the feature vector for rule-based diagnosis.

[0073] The specific calculation process of the rule-gated fusion layer is as follows: ; in This represents the linearization operation. Indicates a broadcast operation. This indicates the diagnostic features of the broadcast rules.

[0074] ; ; ; ; in, It is the Sigmoid activation function. This is element-wise multiplication.

[0075] The joint diagnostic module merges the log-side features output by the last stacked block. Message-side fusion features Perform aggregation (such as concatenation or average pooling) and output a global diagnostic representation. And extract the cross-source attention base matrix from all stacked blocks.

[0076] ; in, It is an aggregate function. This is a global diagnostic vector with dimension 512, used for subsequent fault classification and confidence assessment.

[0077] Within each LPCT block, the dot product of log query and message key, and the dot product of message query and log key, are respectively superimposed with the business relation bias. and request / response mask After Softmax normalization, the matrix is ​​weighted and summed with the corresponding value matrix. The dot product before Softmax normalization is the cross-source attention basis matrix. .

[0078] V. Output Layer.

[0079] It is used to perform multi-dimensional confidence assessment based on global diagnostic representation and cross-source attention matrix, and to output the deterministic or rejection output of fault diagnosis report according to preset threshold.

[0080] Global diagnostic representation based on cross-source feature fusion network output The fault classification probability vector is obtained through a fully connected layer and Softmax. : ; in, Each dimension corresponds to a different fault category. The predicted probability.

[0081] Rule Diagnostic Score The rules-based diagnostic module outputs results according to fault category.

[0082] like Figure 6 As shown, the cross-source attention fundamental matrix Each element characterizes the strength of the bidirectional semantic interaction between the corresponding log event and message event. The subsequent evidence localization module uses this as a basis to generate the final evidence association matrix by fusing bias and mask. .

[0083] ; in, To normalize by row, the contribution weight of each log event to all message events is summed to 1. This represents a multilayer perceptron used to map the fused matrix to a higher-quality relational representation.

[0084] Log-Message Evidence Correlation Matrix matrix elements Quantitatively characterize log events With message events Marginal contribution to the final diagnostic conclusion. Select the contribution with the highest intensity. Each log-message pair serves as key evidence output.

[0085] Calculate log-message correlation strength : . For a set of event pairs, The number of event pairs grouped for diagnosis.

[0086] A comprehensive assessment of the completeness of logs, messages, and related pairs is used to calculate an evidence completeness score. .

[0087] like Figure 7 As shown, the final diagnostic confidence score for each candidate fault type is calculated: ; in, Fault Category The final diagnostic confidence level, This represents a multilayer perceptron.

[0088] Pick Let represent the fault category corresponding to the highest confidence level. And let the category corresponding to the second highest confidence level be denoted as . If the highest confidence value and Output a definitive diagnostic conclusion; otherwise, output a rejection flag and candidate category, rule triggering result, and confidence difference. This represents the confidence threshold; values ​​below this threshold are considered unreliable. This represents the category discrimination threshold; values ​​below this threshold indicate category ambiguity.

[0089] like Figure 9 As shown, the specific steps for multi-source event correlation diagnosis are as follows: Input: a set of structured events Log structured parsing results Message structure parsing results Diagnostic rule base Confidence threshold Category differentiation threshold .

[0090] Output: Fault diagnosis conclusion .

[0091] Step S1: Sort the event set by device, signal path, data body address, source and destination addresses, and protocol type. Grouping is performed to obtain a diagnostic group set. .

[0092] Step S2: For each diagnostic group : a. Sort events within a group by time.

[0093] b. Construct the log event token sequence and the message event token sequence respectively. .

[0094] Step S3: According to , and Calculate the business relationship vector based on the time, device, signal, address, protocol, quality bits, and request / response relationships. Generate attention bias and request / response mask .

[0095] Step S4: Based on , , and Trigger rules such as remote control failure, telemetry anomaly, communication interruption, no response to request, abnormal response code, and verification failure to generate rule diagnostic feature vectors. .

[0096] Step S5: , , , and Inputting the LPCT cross-source feature fusion network yields... .

[0097] Step S6: Based on Output fault category probability ; Step S7: Based on , and Generate evidence association matrix The top-K log-message pairs were selected as key evidence.

[0098] Step S8: According to Calculate log-message correlation strength Calculate the evidence integrity score based on key logs, key message fields, and the integrity of the evidence chain. .

[0099] Step S9: According to the formula Calculate the final confidence level for each candidate fault category.

[0100] Step S10: Take Let the category corresponding to the second highest confidence level be . .

[0101] Step S11: If and : Output fault type Faulty equipment, time of failure, key evidence, basis for judgment, confidence level And treatment recommendations, and write the diagnostic conclusions into ; Otherwise: Output low confidence level indicator, candidate fault category list, rule triggering result, confidence level difference, and supporting evidence, and write the rejection information into the output. .

[0102] Let the original log record set be The original communication message set is The rule set and dictionary used for regular expression matching and field extraction are: It contains parsing templates for various specifications and samples of private specifications. The predefined set of fault triggering rules is The overall mapping relationship of the combined diagnostic process of this invention can be expressed as: ; ; ; ; ; ; ; ; ; in, and These are the structured parsing results of logs and messages, containing standardized fields such as time, device, signal, and action. It is a sequence of events that is structured and uniformly represented by logs and messages. and Embed the event token. Business relationship attention bias, This is the request / response mask. This is the feature vector for rule-based diagnosis. The LPCT network outputs the fused log-side features. Message side features Global diagnostic representation and cross-source attention base matrix . For log-message evidence correlation matrix, These represent the fault type, faulty device, fault time, diagnostic evidence, diagnostic confidence level, and treatment recommendations, respectively. This is a log structure parsing function that maps raw log records into a set of structured fields. This is a message structure parsing function that maps the original communication message into a set of structured fields; This is a structured fusion function for logs and messages, which converts the two types of parsing results into isomorphic event vectors using a unified event template. The event token embedding function maps structured event vectors into learnable dense vector representations. Functions are built for business relationships, which calculate relationship vectors and generate attention biases and masks based on time difference, device, signal, address, protocol, and request-response relationships. The feature extraction function for rule-based diagnosis is based on a predefined set of fault rules; This represents the feature fusion network mapping function, which internally includes bidirectional cross-source attention, rule-gated fusion, and residual connections; The evidence association matrix generation function is used to fuse cross-source attention matrix, business relationship bias and request-response mask to calculate the marginal contribution of each log-message event pair to the diagnostic conclusion. The confidence fusion and decision output function calculates the final confidence level by combining the fault classification probability, rule score, evidence completeness, and association strength, and makes a deterministic output or rejection based on the threshold.

[0103] The total loss function for training the LPCT cross-source association model is: ; in, For the total loss, Loss to the main task To mitigate losses, To balance the auxiliary loss, The balancing hyperparameters for auxiliary loss.

[0104] Auxiliary loss This is used to constrain the output quality of the front-end log structure parsing module and message structure parsing module, enabling the front-end parsing to obtain supervisory signals from the feedback of diagnostic tasks: ; in, Log structured parsing loss measures the error between each field (time, device, signal, action, quality bit, etc.) in the log parsing result and the manually labeled data. Mean squared error loss is used for numerical fields (such as timestamps), and cross-entropy loss is used for categorical fields (such as device, signal path). The message structure parsing loss measures the error between each field in the message parsing result (protocol type, source address, destination address, message body address, value, checksum, etc.) and the manually labeled data. The loss function type is the same as that for log parsing.

[0105] Main task loss Covering fault classification losses Loss of evidence location And log-message alignment loss Three terms, defined as the weighted sum of the three losses: ; in, These represent the weighting coefficients for fault classification loss, evidence location loss, and log-message alignment loss, respectively.

[0106] The fault classification loss uses the multi-class cross-entropy loss function: ; in, This refers to the number of training samples, i.e., the number of diagnostic groups. This represents the total number of fault categories, including categories such as remote control failure, telemetry anomaly, communication interruption, no response to requests, abnormal response, incomplete message, and private protocol parsing anomaly. Indicates the first The sample at the th The actual labels in each category are one-hot encoded. Indicates the first The sample at the th Predicted probabilities for each category. This represents the natural logarithm function.

[0107] The evidence localization loss uses a binary cross-entropy loss function on the evidence correlation matrix. Supervise each element in: ; in, This indicates the total number of log events within the current diagnostic group. This represents the total number of message events within the current diagnostic group. Indicates the first The log event and the first The true correlation label between message events. A value of 1 indicates that the log-message pair constitutes key diagnostic evidence; otherwise, a value of 0. Evidence correlation matrix The Middle Line 1 The element value of the column represents the prediction of the first [number]th ... The log event and the first The probability of the correlation strength between individual message events.

[0108] The log-message alignment loss uses a contrastive learning loss function to align the representations of log events and message events in the joint feature space. ; in, This indicates the total number of log events within the current diagnostic group. This represents the total number of message events within the current diagnostic group. No. Log-side feature vectors of each log event encoded by the LPCT network For the first The message-side feature vector obtained by encoding a message event through an LPCT network (feature fusion network). The similarity function uses cosine similarity to measure the semantic similarity between two feature vectors. It is an exponential function used to map similarity values ​​to positive numbers. For temperature hyperparameters, smaller The value makes the model pay more attention to hard negative samples (i.e. negative samples that are highly similar to the anchor point), thus enhancing its discriminative ability.

[0109] Example 2: A specific example of applying the present invention is provided.

[0110] A remote control execution failure occurred at a 220kV smart substation between 10:15:03 and 10:15:05 on May 12, 2021. The grid distribution unit collected the following data during this time window.

[0111] The remote control log L1 reads: "10:15:03.120, 10kV feeder-501 circuit breaker, remote control selection, result successful." The remote control log L2 reads: "10:15:04.410, 10kV feeder-501 circuit breaker, remote control execution, result failed, reason: execution confirmation timeout." The alarm log L3 reads: "10:15:04.650, bay layer gateway A, link status abnormal."

[0112] The content of IEC104 message P1 at the station control layer is "10:15:03.100, Master station → Interval layer gateway A, C_SC_NA_1, cause=act, IOA=0x012C, select". The content of message P2 is "10:15:03.180, Interval layer gateway A → Master station, C_SC_NA_1, cause=actcon, IOA=0x012C". The content of message P3 is "10:15:04.380, Master station → Interval layer gateway A, C_SC_NA_1, cause=act, IOA=0x012C, execute". No response message corresponding to P3 was detected before 10:15:04.900.

[0113] The point table and address mapping table give the "10kV feeder-501 circuit breaker closing command" corresponding to IOA=0x012C. The SCD file gives the IED association relationship between the bay layer gateway A and the 501 circuit breaker monitoring and control device.

[0114] like Figure 1 As shown, the overall structure of the system of the present invention consists of five layers: data access layer, parsing layer, association layer, inference layer, and output layer.

[0115] In this embodiment, the data access layer first accesses the log set exported by the network segmentation device. and message set Simultaneously access SCD files, point table files, and address mapping tables. The preprocessing module encodes all data into UTF-8 format, segments the records according to timestamps, identifies P1 to P3 as IEC104 protocol type, and aligns the timeline at the millisecond level. The redundancy cleaning module removes alarm entries with duplicate records.

[0116] The parsing layer includes a log structure parsing module and a message structure parsing module, which are responsible for converting raw logs and communication messages into structured events. and The association layer includes an event token building module and a business relationship building module, which are responsible for converting the parsed results into a unified token sequence. and It establishes cross-source associations. The inference layer uses the LPCT cross-source feature fusion network as its core, combining rule-based diagnosis and fault classification modules to complete joint inference. The output layer generates interpretable diagnostic reports through evidence localization and confidence fusion modules. .

[0117] Step 1: Dual-mode heterogeneous parsing of logs and messages.

[0118] like Figure 2 As shown, two parallel paths are adopted: rule-driven and large language model-driven. Figure 8 It demonstrates the complete parsing process from raw log and message input to structured event set output.

[0119] For log L1, the log structure parsing module first performs format recognition to determine if it is a fixed-format remote control record. The system uses regular expressions and a field dictionary. Perform deterministic analysis Time extracted from L1 ,equipment ,Signal ,action ,quality Event Category Extended fields .

[0120] For log L2, regular expression parsing is also used to obtain... , , , , , , For log L3, the format is identified as an alarm record, and regular expression parsing is used to obtain... , , , , , In this embodiment, the regular expression path successfully parsed all logs, and the large language model path was not triggered. Therefore, without conflicts, it is necessary to enter the consistency check function. ruling.

[0121] For message P1, the message structure parsing module first performs protocol identification. Based on the frame header and ASDU type, it was determined to be an IEC 104 protocol. The system invoked the IEC 104 rule parser to extract the relevant information. , , , , , , , .

[0122] For P2, the analysis yields... , , , , , , , .

[0123] Then device and signal mapping is performed. For P1, P2, and P3, according to the address mapping table... Map IOA=0x012C to , Mapping confidence The mapped message events are uniformly represented as event vectors containing complete fields and added to a unified event set. .

[0124] Step 2: Construct the event token and associate it with business relationships.

[0125] First, according to the equipment Signal path and source and destination addresses For event sets Grouping is performed. In this embodiment, L1, L2, L3, P1, P2, and P3 are all related to the 501 circuit breaker and bay-level gateway A, therefore they are grouped into the same diagnostic group. .

[0126] like Figure 4As shown, the business relationship building module Responsible for calculating the relationship vector between log events and message events. For the pair of events L1 and P1, the time difference... Seconds, device consistency Signal consistency Address consistency Protocol matching degree Quality bit consistency Request-response relationship matching degree Thus, a relation vector is constructed. The vector undergoes a linear transformation. Generate attention bias value .

[0127] Regarding the pair of events L2 and P3 Seconds, all consistency metrics are 1, request-response relationships match, and attention bias values ​​are generated. For L2 and missing response pairs, a virtual message event is automatically generated to represent the missing response. The request-response relationship matching term in its relation vector is 0, resulting in a lower attention bias value. .

[0128] Request / response mask The generation process is as follows: Set the time window threshold. Milliseconds. For L1 and P1, Furthermore, the device, signal, and address are all identical, and the mask value is the same. This allows for strong attention computation. For L2 and P3, mask value For L2 and irrelevant messages outside the time window, the mask value... This suppresses its attention weight.

[0129] like Figure 3 As shown, the event token building module Convert the parsed log events and message events into token vectors. Log event token vector. The dimension is 256. Message event token vector. It is also encoded as a 256-dimensional vector.

[0130] Step 3: Use a feature fusion network for feature fusion and global diagnosis.

[0131] like Figure 3 As shown, the LPCT cross-source feature fusion network receives log event token sequences. and message event token sequence As input, four LPCT blocks are stacked in this embodiment.

[0132] In the first LPCT Block, the log self-attention layer first... Self-attention encoding is performed. The log sequence length is 3. The self-attention mechanism captures the temporal dependencies between L1, L2, and L3. A temporal causal relationship exists between the remote control execution failure of L2 and the link state anomaly of L3. Higher self-attention weights are assigned between L2 and L3. The message self-attention layer simultaneously... Encoding is performed so that P1 and P2 constitute a complete request-response cycle. After P3 is sent, there is no corresponding response message. The self-attention mechanism generates a high self-attention activation value at the P3 position.

[0133] The bidirectional cross-source attention calculation then proceeds, and the calculation process is as follows: ; ; in , Log-to-message cross-attention enables log events to proactively query related message events. Taking L2 as an example, its query vector... The bond vector with P3 Calculate similarity, plus attention bias After masking and Softmax normalization, an attention weight of 0.76 is obtained, indicating that L2 primarily focuses on P3. The message-to-log cross-attention mechanism enables message events to actively associate with log events, and the query vector of P3... bond vector with L2 The similarity was calculated, and the attention weight was 0.71.

[0134] like Figure 5 As shown, the rule-gated fusion layer receives the rule-diagnostic feature vector output by the rule-diagnostic module. In this embodiment, the rule diagnosis module The rule score for remote control execution failure triggered by "result failed, reason: execution confirmation timeout" in L2 is 0.92. The rule score for "no response to request" triggered by no corresponding response within a 500ms window after P3 is sent is 0.88. The rule score for communication interruption triggered by "abnormal link status" in L3 is 0.75. The above rule scores are organized according to fault category. A vector with a dimension of 12.

[0135] The calculation process of the rule-gated fusion layer is as follows: ; ; ; ; ; in, It is the Sigmoid activation function. This is element-wise multiplication. For the log side, the gating weights... Token features account for 65%, rule features account for 35%, and the output after fusion is... For the message side, gating weights Output after fusion The output of the current stack block is passed layer by layer as the input of the next stack block, finally yielding the log-side fusion feature. Message-side fusion features Finally, the LPCT network outputs a global diagnostic representation. The dimension is 512, and the cross-source attention base matrix is ​​also included. , dimension . Figure 9 It demonstrates a complete associated diagnostic process from structured event set input to diagnostic conclusion output.

[0136] Step 4: Confidence fusion and diagnostic output.

[0137] like Figure 6 As shown, the evidence location module Based on cross-source attention fundamental matrix Business relationship bias and request / response mask Generate evidence association matrix .

[0138] ; In this embodiment, After the matrix is ​​calculated by the feature fusion network, the original attention weights for the L2 and P3 pair are 0.68, for the L1 and P1 pair 0.52, for the L2 and missing response pair 0.45, and for the L3 and P3 pair 0.38. After fusing the bias and mask, the evidence association matrix... The association strength between L2 and P3 increased to 0.85, L1 and P1 to 0.72, and L2 and missing response to 0.61. The system selected the top-3 log message pairs as key evidence, outputting an association strength of 0.85 for L2 and P3, 0.72 for L1 and P1, and 0.61 for L2 and missing response, thus forming traceable diagnostic evidence.

[0139] like Figure 7 As shown, the confidence fusion module calculates the final confidence score by integrating four factors. The fault classification module is based on a global diagnostic representation. Output the probability of each category: ; Among them, the probability of no response during the remote execution phase is 0.89, the probability of communication interruption is 0.67, and the probability of remote execution failure is 0.58.

[0140] Completeness of evidence score The matching rate is calculated based on three dimensions: log field integrity rate, message field integrity rate, and log message correlation. Log field integrity rate Message field integrity rate Log message association with matching rate Take weights , , The calculation yields: .

[0141] Log message correlation strength The maximum correlation strength is set to 0.85.

[0142] The final diagnostic confidence level is: ; After weighted fusion of the four factors, the final confidence level for no response during the remote control execution phase is 0.94, for communication interruption it is 0.72, and for remote control execution failure it is 0.68. The system takes... The request for remote execution did not return a response, and its confidence level of 0.94 is greater than the threshold. Furthermore, the difference between the second-highest confidence level and the second-highest confidence level (0.22) is greater than the discrimination threshold. It satisfies the deterministic output condition.

[0143] Output final diagnostic results The following are the fault types: The remote control execution phase request received no response and the target device did not respond, indicating a faulty device. For the communication link between the 10kV feeder-501 circuit breaker and the bay layer gateway A, the fault time is... From 10:15:04.380 to 10:15:04.900 on May 12, 2021. Key evidence. This includes log L2, alarm log L3, execution request message P3, and the message window showing a missing response after P3. The judgment is based on the LPCT cross-source attention network identifying a high correlation strength (0.85) between L2 and P3, and the abnormal pattern of no response messages after P3, combined with the remote control execution failure and request non-response rules triggered by the rule diagnosis module. Diagnostic confidence level. The value is 0.94. Recommended processing method. To check the link status from the bay layer gateway A to the 501 circuit breaker monitoring and control device, verify the IEC104 channel and device remote control execution authority, and review the link packet loss records and device refusal records after P3.

[0144] Comparison of experimental results: This invention was experimentally verified on a test dataset containing 2,000 labeled samples, which covered seven types of failure scenarios, including remote control failure, telemetry anomaly, communication interruption, no response to requests, abnormal response, incomplete message, and private protocol parsing anomaly.

[0145] Figure 10 and Figure 11 This shows the model's loss convergence on the training and test sets. The horizontal axis represents the number of training steps (0-600), and the vertical axis represents the loss value (0-2.5). Total loss in the training set... The initial value of 2.1 decreased rapidly, dropping to 0.6 after 200 steps, then leveling off after 400 steps, eventually stabilizing around 0.35. (Auxiliary loss) The loss decreased from an initial 1.8 to 0.25, indicating that the output quality of the front-end parsing module was continuously optimized during joint training. The trend of the test set loss was basically consistent with that of the training set, and the final total loss stabilized at 0.42, with no obvious overfitting, thus verifying the model's generalization ability.

[0146] Figure 12 The performance of the method of this invention is compared with that of six comparative methods. Table 1 shows the specific values ​​of each indicator.

[0147] Table 1. Comparison of diagnostic efficacy of different diagnostic methods

[0148] As shown in Table 1, the precision, recall, and F1 score of the joint diagnostic method of this invention reach 0.941, 0.927, and 0.934, respectively, while ROUGE-L and BLEU-4 reach 0.712 and 0.536, respectively, all higher than all the comparative methods. Compared with single-rule diagnostic methods, the method of this invention can not only use deterministic rules to identify anomalies such as remote control failure, verification failure, and no response to requests, but also capture the contextual relationship between log events and message events through cross-source attention, and generate a diagnostic report containing key logs, key messages, and processing suggestions. Compared with ordinary Transformer methods, the method of this invention introduces business relationship bias. Request / response mask By integrating with rule gating, the model can explicitly utilize device consistency, signal consistency, time window relationships, and request-response relationships, thus achieving more stable diagnostic results in scenarios such as no response to requests, abnormal responses, incomplete messages, and communication interruptions.

[0149] The average diagnostic time of the method in this invention is 52 milliseconds, which is higher than that of single-rule diagnostic methods and single-message parsing methods, but still within the acceptable range for offline analysis and near real-time assisted diagnosis in network segmentation devices. This result demonstrates that while increasing cross-source feature fusion and evidence localization capabilities, the system can still meet the response requirements for on-site anomaly analysis.

[0150] This embodiment verifies the effectiveness of the method of the present invention in actual substation fault scenarios. A unified structured parsing of logs and messages is achieved through a dual-mode heterogeneous parsing engine; deep semantic interaction between log events and message events is realized through the LPCT cross-source feature fusion network; and traceable and quantifiable diagnostic conclusions are output through evidence localization and confidence fusion mechanisms. The technical solution of the present invention solves prominent problems in existing technologies such as separate analysis of logs and messages, difficulties in adapting private protocols, insufficient cross-source correlation, and lack of evidence output for low-confidence diagnoses, demonstrating significant technological progress and practical value.

[0151] Example 3: The present invention provides a computer-readable storage medium for storing a computer program; when the computer program is executed by a processor, it implements the steps of the above-described method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model.

[0152] For more detailed information on the above methods, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0153] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Those skilled in the art will clearly understand that the technologies in the embodiments of this invention can be implemented using software and necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of this invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or certain parts of the embodiments of this invention.

[0154] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A joint diagnostic method for power grid logs and messages based on the LPCT cross-source correlation model, characterized in that, include: Collect logs and messages from the smart substation within the target time window, use the LPCT cross-source correlation model for joint diagnosis, and output a fault diagnosis report. The LPCT cross-source association model includes: The data access layer is used to receive and preprocess the collected data; The parsing layer is used to perform structured parsing on each log and message, and uniformly encode them into log event vectors and message event vectors. The association layer is used to group all event vectors according to device, signal path, information body address, source and destination addresses and protocol type. For each group, all log event vectors are transformed into log event token sequences and all message event vectors are transformed into message event token sequences. At the same time, a request-response mask matrix and a bidirectional business relationship attention bias matrix are generated. The inference layer is used to input the log event token sequence, message event token sequence, business relationship attention bias matrix, request response mask matrix, and rule diagnosis feature vector generated based on preset diagnostic rules into the cross-source feature fusion network for bidirectional interaction and rule-guided selective fusion, generate a global diagnostic representation, and simultaneously extract the cross-source attention base matrix; The output layer is used to perform multi-dimensional confidence evaluation based on the global diagnostic representation and cross-source attention matrix, and to output a deterministic or rejection report of the fault diagnosis report according to a preset threshold.

2. The method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model according to claim 1, characterized in that, Each log entry is parsed in a structured manner and uniformly encoded into a log event vector, specifically as follows: For each log entry, its format is identified. If it is a fixed-format log entry, it is parsed using regular expressions and a field dictionary. If it is a non-fixed-format log entry, a large language model is invoked to extract instructional fields according to a preset prompt template, thus obtaining the log parsing result. The log event vector is then encoded according to a preset encoding format. If a log contains two conflicting parsing results, a decision will be made based on the confidence level or a preset rule. Each message is parsed in a structured manner and uniformly encoded into a message event vector, specifically as follows: The message is identified by protocol, and the corresponding field extractor is called to parse it based on the protocol type, thus obtaining the message parsing result. The results of comprehensive analysis using address mapping tables, point tables, and SCD or CID are used. parse the message results Compared with log parsing results After aligning the device and model, the data is encoded according to a preset encoding format to obtain the message event vector. .

3. The method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model according to claim 1, characterized in that, The generated request-response mask matrix and bidirectional business relationship attention bias matrix are specifically as follows: All event vectors are grouped according to device, signal path, information body address, source and destination addresses, and protocol type to obtain diagnostic groups; In each diagnostic group, logs and messages are unordered and paired to obtain several log-message event pairs. The relationship vector of each event pair is calculated and linearly transformed to generate bidirectional attention bias values. The in-direction bias values ​​of all event pairs are then assembled to obtain a bidirectional business relationship attention bias matrix. This includes the log-to-message bias matrix. And the bias matrix from message to log ; Calculate the mask value for each event pair, and assemble the mask values ​​of all event pairs to obtain the request-response mask matrix. .

4. The method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model according to claim 3, characterized in that, The formulas for calculating the relationship vectors of each event pair and generating bidirectional attention bias values ​​are as follows: ； ； in, For the first The log event vector and the first The relation vector of event pairs corresponding to each message event vector. For the time difference, , , , , and The first Each log event vector contains the event time, device identifier, signal path or message body address, source and destination addresses, quality bits or status bits, and protocol type. , , , , and The first Each message event vector contains the event time, device identifier, signal path or message body address, source and destination addresses, quality bits or status bits, and protocol type. For indicator functions, This is a protocol type matching function. For request-response relationship matching functions, and The first The first log event and the first One message event; This is the attention bias value from message to log. and These are the linear transformation weight matrix and linear transformation bias term from message to log, respectively. This is the attention bias value from log to message. and These are the linear transformation weight matrix and linear transformation bias term from log to message, respectively.

5. The method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model according to claim 4, characterized in that, The formula for calculating the mask value of each event pair is: ； in, For the first The log event vector and the first The mask value of the event pairs corresponding to each message event vector. OR operation, The time window threshold, This is a session matching function.

6. The method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model according to claim 1, characterized in that, The cross-source feature fusion network comprises several cascaded stacked blocks, a rule-based diagnostic module, and a joint diagnostic module. The rule-based diagnostic module performs rule-based diagnostics on each log event vector and message event vector based on a preset diagnostic library, calculates the trigger score for each fault type, and organizes them into rule-based diagnostic feature vectors according to the rule index order. Each stack block is based on a log event token sequence, a message event token sequence, a business relationship attention bias matrix, a request-response mask matrix, and a rule diagnostic feature vector. Selective fusion of bidirectional interaction and rule-guided approaches is performed, and the output of the current stack block is passed layer by layer as the input of the next stack block, finally yielding the log-side fusion feature. Message-side fusion features The joint diagnostic module integrates log-side features. Message-side fusion features Perform aggregation and output a global diagnostic representation. And extract the cross-source attention base matrix from all stacked blocks.

7. The method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model according to claim 6, characterized in that, Each stack block includes: a log self-attention layer, a packet self-attention layer, a log-to-packet cross-attention layer, a packet-to-log cross-attention layer, a rule-gated fusion layer, a feedforward network, residual connections, and layer-by-layer normalization; The log attention layer and message self-attention layer perform self-attention encoding on the log event token sequence and message event token sequence, respectively, to obtain log time-series context features. and message timing context features ; The log-to-message cross-attention layer and message-to-log cross-attention layer first perform bidirectional cross-attention calculations on log-to-message and message-to-log based on the request-response mask matrix and the corresponding business relationship attention bias matrix, respectively, to obtain the log-to-message cross-source attention. Cross-source attention from messages to logs Then, each is combined with the corresponding log time-series context features. and message timing context features Generate log-side cross-attention enhancement features and message side attention enhancement features ; The rule-gated fusion layer first converts the rule diagnostic feature vector... Perform linear transformation and broadcasting to generate prior bias features. Then, each is combined with log-side attention enhancement features. and message side attention enhancement features Calculate log-side gating weights and message-side gating weights And for cross-attention layer output and prior bias features Perform adaptive weighted fusion to obtain the current stack block. Output log-side rule gating fusion features Features of message-side rule gating After passing through a feedforward network, residual connections, and layer normalization, the output is sent to the next stack block.

8. The method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model according to claim 1, characterized in that, The process involves multi-dimensional confidence evaluation based on global diagnostic representation and cross-source attention matrix, and determining whether to output a definitive fault diagnosis report or reject it based on a preset threshold. Calculate the probability of fault categories based on global diagnostic representation. And extract the rule diagnosis score of the fault from the rule diagnosis feature vector. ; Based on cross-source attention benchmark matrix Combined with a two-way business relationship attention bias matrix and request / response mask matrix Generate a log-message evidence correlation matrix And calculate the log-message correlation strength. ; A comprehensive assessment of the completeness of logs, messages, and related pairs is used to calculate an evidence completeness score. ; The final diagnostic confidence of each candidate fault type is calculated according to the following formula. If the maximum confidence is greater than the confidence threshold and the difference between the maximum confidence and the second largest confidence is greater than the category distinction threshold, a deterministic diagnostic conclusion is output to form a diagnostic report; otherwise, a rejection conclusion is output to form a diagnostic report. ； in, Fault Category The final diagnostic confidence level, This represents a multilayer perceptron.

9. The method for joint diagnosis of power grid logs and messages based on the LPCT cross-source correlation model according to claim 1, characterized in that, The total loss function for training the LPCT cross-source association model is: ； ； ； ； in, For the total loss, Loss to the main task To supplement the loss, we include log structure parsing loss and message structure parsing loss. To balance the auxiliary loss, These represent the losses due to fault classification. Loss of evidence location And log-message alignment loss Weighting coefficients; This indicates the total number of log events within the current diagnostic group. This represents the total number of message events within the current diagnostic group; Indicates the first The log event and the first The true correlation labels between individual message events; Evidence correlation matrix The element value in the array represents the predicted first value. The log event and the first The probability of the correlation strength between individual message events; No. The log-side fused feature vector obtained by fusing log events through a feature fusion network For the first The message-side fused feature vector obtained by fusing individual message events through a feature fusion network; It is an exponential function. This refers to temperature hyperparameters.

10. A computer-readable storage medium, characterized in that, Used to store computer programs; when the computer programs are executed by a processor, they implement the steps of the power grid log and message joint diagnosis method based on the LPCT cross-source correlation model as described in any one of claims 1-9.

Images