A multi-modal fusion causal graph-based power link root cause localization method

Abstract

This invention provides a power link root cause localization method based on a multimodal fusion causal graph, relating to the power system field. The method includes: stripping the GTP-U protocol based on deep packet inspection and constructing a dynamic mapping table; aligning terminal-side sensing data, end-to-end probe data, and network signaling data in time sequence to generate a fused feature vector; constructing a three-layer full-link knowledge graph based on this vector, establishing entity nodes and time-series association edges; using a graph neural network to aggregate heterogeneous features across layers to generate hidden layer representation vectors for nodes; using the fused feature vector as observed data and the hidden layer representation vector as topological prior, inferring the causal direction and eliminating spurious correlations using the FRITL algorithm, and outputting the root cause probability distribution. This invention improves upon the problem of spurious correlations caused by the black-box nature of operator networks and the fusion of multi-source heterogeneous data, which prevents accurate end-to-end delimitation across network elements.

Description

Technical Field

[0001] This invention relates to the field of power systems, and more particularly to a method for power link root cause localization using a multimodal fusion causal graph. Background Technology

[0002] With the comprehensive advancement of the construction of new power systems, a massive number of power Internet of Things (IoT) terminals (such as smart meters, distribution automation terminals, and distributed photovoltaic monitoring units) are being widely deployed at the end of the power grid. These terminals typically operate in scenarios with geographically dispersed locations, complex electromagnetic environments, and heterogeneous communication standards (such as 5G / 4G, NB-IoT, and private wireless networks), and their data interaction relies on the wide-area communication network provided by operators. In the 5G core network architecture, the user plane interface between the NG-RAN base station (gNB) and the User Plane Function (UPF) is called the N3 interface, through which terminal service data packets are encapsulated in GTP-U and transmitted. The control plane interface between the Session Management Function (SMF) and the User Plane Function (UPF) is called the N4 interface, used for the exchange of commands for session establishment, modification, and release. In each link of "generation, transmission, transformation, distribution, and consumption," the stability of the communication link and the end-to-end latency are directly related to the continuity of power services and the absolute security of power grid operation.

[0003] Currently, there are several main technical approaches for locating and monitoring faults in power Internet of Things (IoT) links: First, network-side signaling monitoring methods. These methods perform GTP protocol parsing and session-level mapping at the operator's core network interface. However, their monitoring scope is limited to a single point in the core network, failing to delineate terminal faults from network faults. Second, intelligent operation and maintenance solutions that integrate multi-source data. These methods introduce multi-source environmental or equipment data for fusion analysis, or employ knowledge graphs for communication network fault handling. However, the knowledge graphs in these solutions cannot achieve end-to-end fault delineation across network elements. Third, fault diagnosis solutions based on graph neural networks or causal inference. These methods use graph neural networks to aggregate features from topology data, or employ causal inference models for root cause analysis. However, these methods have insufficient accuracy in root cause location in cascading fault scenarios. Therefore, there is an urgent need to develop a solution to address these issues. Summary of the Invention

[0004] The purpose of this invention is to provide a power link root cause localization method based on multimodal fusion causal graphs, which improves the problem of spurious correlations caused by the black-box nature of operator networks and the fusion of multi-source heterogeneous data, making it impossible to accurately delineate the network elements end-to-end.

[0005] The power link root cause localization method based on multimodal fusion causality graphs provided by this invention adopts the following technical solution:

[0006] A multimodal fusion causal graph-based power link root cause localization method, specifically including:

[0007] Based on deep packet inspection technology, the GTP-U tunnel protocol header and GTP-C control plane signaling are identified and stripped from network traffic. The tunnel endpoint identifier, quality of service level and network signaling data are parsed from the stripped GTP-C control plane signaling. Cross-validation is performed by verifying the consistency of the tunnel endpoint identifier in two or more consecutive GTP-C control plane signaling messages to construct a dynamic mapping table. The dynamic mapping table is maintained by a dual timer lease mechanism.

[0008] End-to-end detection data is obtained by stripping the GTP-U tunnel protocol header. Based on a unified time reference, a transmission delay compensation mechanism is used to reverse the timestamp of the terminal-side sensing data. The alignment time window granularity is adaptively selected according to the power service type. The terminal-side sensing data, end-to-end detection data, service quality level and network signaling data are time-series aligned and spliced ​​to generate a fused feature vector.

[0009] Based on the dynamic mapping table, GTP tunnel instances in the bearer network layer are bound to the International Mobile Subscriber Identity (IMSI) of the physical link layer. Cross-layer mapping is established based on the dependency relationship between the session identifier of the application service layer and the GTP tunnel in the bearer network layer, forming an end-to-end association chain. Entity nodes are established in each layer, and time-series association edges are established according to the timestamp alignment relationship. Version sequence numbers are assigned to the time-series association edges through the timestamp version marking mechanism, thus constructing a full-link knowledge graph.

[0010] A graph neural network model is used to aggregate and update the heterogeneous features of cross-layer nodes in the full-link knowledge graph, generating hidden layer representation vectors for the nodes.

[0011] Using the fused feature vector as observation data and the node hidden layer representation vector as topological prior constraints, the FRITL algorithm is used to infer local causal directions and eliminate spurious correlation variables in the fused feature vector, outputting the probability distribution of fault root causes. The FRITL algorithm introduces the topological similarity of the node hidden layer representation vector in the conditional independence test, introduces causal prior constraints in the power field in the direction inference, and introduces time-series consistency verification in the latent variable detection.

[0012] This invention provides a power link root cause localization method based on a multimodal fusion causal graph. It uses deep packet inspection (DPI) technology to strip the GTP protocol and parse tunnel endpoint identifiers, quality of service (QoS) levels, and signaling error codes to construct a dynamic mapping table, enabling transparent extraction of the operator's core network bearer status. Through transmission delay compensation and a multi-granularity adaptive time window mechanism, it performs time-series alignment and fusion of terminal-side sensing data, end-to-end detection data, and network signaling data to generate a fused feature vector. The dynamic mapping table enables cross-layer binding between the bearer layer and the physical layer, constructing a full-link knowledge graph to achieve end-to-end structured associations from the terminal to the bearer to the service. A graph neural network aggregates heterogeneous features of cross-layer nodes to generate hidden layer representation vectors, which are then used as topological prior constraints in the FRITL algorithm to eliminate spurious correlation variables and output the probability distribution of fault root causes. Through the synergistic effect of the above mechanisms, this invention improves the problem of spurious correlations caused by the black-box nature of operator networks and the fusion of multi-source heterogeneous data, which prevents accurate end-to-end delineation across network elements.

[0013] Optionally, the terminal-side sensing data includes the terminal device's CPU utilization, memory usage, wireless signal reception strength indication, bit error rate, and communication module operation log; the end-to-end detection data includes end-to-end latency, packet loss rate, available bandwidth, and jitter parameters; and the network signaling data includes bearer resource allocation failure error codes.

[0014] Optionally, when constructing a dynamic mapping table by cross-validating the consistency of tunnel endpoint identifiers in two or more consecutive GTP-C control plane signaling messages, and maintaining the dynamic mapping table through a dual-timer lease mechanism, the following steps are included:

[0015] Extract the International Mobile Subscriber Identity (IMSI) from the GTP-C session creation request message, extract the tunnel endpoint identifier from the session creation response message of the same session process, and establish a mapping record with the tunnel endpoint identifier as the key and the IMSI as the value.

[0016] Listen to subsequent GTP-C signaling after the session creation response message. If the tunnel endpoint identifier in two or more consecutive GTP-C signaling messages is consistent with the mapping record, then confirm that the mapping record is effective; otherwise, trigger the mapping reconstruction process.

[0017] Set a lifetime timer and a lease renewal timer for each mapping record in the dynamic mapping table. The lifetime timer is used to limit the effective lifespan of the mapping record, and the lease renewal timer is used to periodically initiate renewal verification during the existence of the mapping record.

[0018] When the time-to-live timer expires and the lease renewal timer fails to trigger renewal, the mapping record is marked as pending verification.

[0019] If no renewal is triggered within two consecutive lifetimes, the mapping record is deleted.

[0020] Optionally, when generating the fused feature vector, the following steps are included:

[0021] End-to-end probe data is obtained through flow detection, and the packet parsing of the flow detection includes checking the inner IPv6 header length and the ICMPv6 header length.

[0022] The asymmetric transmission delay of each link segment is estimated by using the bidirectional timestamp difference between the sending timestamp embedded in the sending end and the receiving timestamp on the core network side in the flow detection probe message, and the asymmetric transmission delay is used to perform reverse compensation correction on the timestamp of the terminal side sensing data.

[0023] The granularity of the alignment time window is determined according to the type of power service: a first granularity time window is used for distribution automation services, a second granularity time window is used for power consumption acquisition services, and a third granularity time window is used for power equipment status monitoring services. The second granularity time window is larger than the first granularity time window, and the third granularity time window is larger than the second granularity time window.

[0024] Within the same time window, terminal-side sensing data, end-to-end detection data, service quality level, and network signaling data are horizontally spliced ​​according to feature dimensions to generate a fused feature vector.

[0025] Optionally, the entities of the physical link layer include IoT terminals, base station equipment, transmission fiber optic links, and edge computing nodes; the entities of the bearer network layer include GTP tunnel instances, virtual private network instances, and quality of service policy configuration entities, and the dynamic mapping table binds the GTP tunnel to the International Mobile Subscriber Identity (IMSI) corresponding to the terminal; the entities of the application service layer include power service process entities and MQTT session connection entities.

[0026] Optionally, it also includes:

[0027] Based on the newly added end-to-end probe data, the missing relation edges in the full-link knowledge graph are dynamically filled and reconstructed using the knowledge graph link prediction algorithm.

[0028] The dynamic completion and reconstruction includes: setting an effective time interval for each relation edge in the full-link knowledge graph; when the terminal's access base station is switched, retaining historical relation edges and marking them as invalid through a timestamp version marking mechanism, while establishing new wireless access relation edges; for cases where GTP tunnels are deleted due to session release, using the dynamic mapping table as an index, cascading deletion of associated edges in the bearer network layer and application service layer that depend on the GTP tunnel; when the feature smoothness of the full-link knowledge graph exceeds the dynamic adaptive threshold, determining the link prediction window based on the power service time series period; within the link prediction window, using the feature vectors of entity nodes in the current full-link knowledge graph and existing relation edges as input, calculating the possible relation edge types and their confidence scores between each node to be verified; confirming candidate relation edges with confidence scores greater than the dynamic confidence threshold as valid relation edges and adding them to the graph; and deleting existing relation edges with confidence scores less than the dynamic confidence threshold from the graph.

[0029] The dynamic confidence threshold is adaptively determined based on the criticality of the power business carried by the target node and its historical stability. The average confidence of similar business relationship edges within the historical normal period is used as the benchmark, and the offset is corrected according to the business criticality adjustment coefficient.

[0030] Optionally, the graph neural network model is selected from at least one of the GraphSAGE model and the graph attention network model;

[0031] The GraphSAGE model concatenates the node's own features with the mean features of its first-order neighboring nodes, and then outputs the node's hidden layer representation vector through linear transformation and nonlinear activation. The graph attention network model calculates the normalized attention coefficients of neighboring nodes to the target node, performs a weighted summation of the neighboring node features, and then outputs the node's hidden layer representation vector through linear transformation and nonlinear activation.

[0032] Optionally, when using the fused feature vector as observation data and the node hidden layer representation vector as topological prior constraints, and employing the FRITL algorithm to infer local causal directions and eliminate spurious correlation variables in the fused feature vector, the process includes:

[0033] A partial ancestor graph is constructed based on the conditional independence test. The conditional independence test targets the observed variables in the fused feature vector and uses a topology enhancement test statistic. The topology enhancement test statistic is obtained by adding the standard conditional independence test statistic and the product of the topology feature weight coefficient and the cosine similarity of the hidden layer representation vectors of the two nodes. The standard conditional independence test statistic is the dependency statistic obtained from the standard conditional independence test, and the topology feature weight coefficient is a pre-configured hyperparameter.

[0034] When the topology enhancement test statistic is greater than the preset independence determination threshold, it is determined that the two observed variables participating in the conditional independence test are not independent under the given condition set; otherwise, they are determined to be conditionally independent.

[0035] For undirected edges with uncertain directions in the partial ancestor graph, a two-way fitting test is performed using an independent noise conditional model. In the two-way fitting test, a causal prior constraint from the power field is introduced as a penalty term to infer the local causal direction.

[0036] When a conflict violating the Markov equivalence class constraint is detected, it is determined that there are unobserved latent variables.

[0037] The latent variables are detected using the three-part constraint, and the temporal consistency verification is introduced to complete the structural merging. The undetermined local causal structure is estimated by combining independent component analysis, and the complete causal structure graph is reconstructed.

[0038] Optionally, when outputting the probability distribution of root causes of faults, the process includes: normalizing the causal path weights from the target fault node to each candidate root cause node in the reconstructed causal structure graph to obtain the probability distribution of each candidate root cause; when the probability of root cause at the network bearer layer is greater than the dynamic warning threshold and the probability of root cause at the terminal device is less than the dynamic safety threshold, intercepting the restart command sent to the power terminal and pushing a self-healing scheduling request for the bearer network to the operator's network management system; wherein, the dynamic warning threshold is adaptively determined based on the criticality of the power service carried by the target terminal and the mean and standard deviation of the probability sequence of root causes at the network bearer layer within a historical normal period, and the dynamic safety threshold is adaptively determined based on the historical erroneous restart cost of the terminal device and the mean and standard deviation of the probability sequence of root causes at the terminal device within a historical normal period. Attached Figure Description

[0039] Figure 1 This is a flowchart of a power link root cause localization method based on a multimodal fusion causal graph provided in an embodiment of the present invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0041] See Figure 1 This invention provides a power link root cause localization method based on multimodal fusion causality graphs, comprising the following steps:

[0042] S1. Based on deep packet inspection technology, identify and strip the GTP-U tunnel protocol header and GTP-C control plane signaling from network traffic. Parse the tunnel endpoint identifier, quality of service level and network signaling data from the stripped GTP-C control plane signaling. Cross-validate the consistency of the tunnel endpoint identifier in two or more consecutive GTP-C control plane signaling messages, construct a dynamic mapping table, and maintain the dynamic mapping table through a dual timer lease mechanism.

[0043] S2. Obtain end-to-end detection data through the stripped GTP-U tunnel protocol header. Based on a unified time reference, use a transmission delay compensation mechanism to reverse the timestamp of the terminal-side sensing data. Adaptively select the alignment time window granularity according to the power service type. Perform time-series alignment and splicing of terminal-side sensing data, end-to-end detection data, service quality level and network signaling data to generate a fused feature vector.

[0044] S3. Based on the dynamic mapping table, bind the GTP tunnel instances of the bearer network layer with the International Mobile Subscriber Identity (IMSI) of the physical link layer, establish cross-layer mapping based on the session identifier of the application service layer and the dependency relationship between the GTP tunnels of the bearer network layer, and form an end-to-end association chain; establish entity nodes in each layer, establish time-series association edges based on timestamp alignment relationship, and assign version sequence numbers to the time-series association edges through the timestamp version marking mechanism to construct a full-link knowledge graph;

[0045] S4. Use a graph neural network model to aggregate and update the heterogeneous features of cross-layer nodes in the full-link knowledge graph, and generate node hidden layer representation vectors.

[0046] S5. Using the fused feature vector as the observation data and the node hidden layer representation vector as the topological prior constraint, the FRITL algorithm is used to infer the local causal direction and eliminate the spurious correlation variables in the fused feature vector, and output the probability distribution of the root cause of the fault. The FRITL algorithm introduces the topological similarity of the node hidden layer representation vector in the conditional independence test, introduces the causal prior constraint of the power field in the direction inference, and introduces the temporal consistency verification in the latent variable detection.

[0047] In some embodiments, in step S1, based on deep packet inspection technology, the GTP-U tunnel protocol header and GTP-C control plane signaling are identified and stripped from network traffic. The tunnel endpoint identifier, quality of service level, and network signaling data are parsed from the stripped GTP-C control plane signaling. Cross-validation is performed by checking the consistency of the tunnel endpoint identifier in two or more consecutive GTP-C control plane signaling messages to construct a dynamic mapping table. When maintaining the dynamic mapping table using a dual-timer lease mechanism, firstly, the deep packet inspection engine bypasses the N3 / N4 interface deployed at the operator's core network boundary egress point. It identifies GTP protocol packets based on UDP port numbers, where the standard port number for GTP-C signaling is 2123, and the standard port number for GTP-U user plane data is 2152. The deep packet inspection engine performs header stripping on the identified GTP packets. For GTP-U, an 8-byte GTP header is read from the start of the IP payload, with the tunnel endpoint identifier located in bytes 4 to 7 of this header. For GTP-C, the GTP-C message header and subsequent signaling message body are read from the start of the IP payload. After confirming the GTP protocol version number, the deep packet inspection engine strips the protocol header to expose the internal payload. For the stripped GTP-C control plane signaling message body, the deep packet inspection engine performs deep field parsing: the tunnel endpoint identifier is read from a fixed offset position in the GTP-C message header; this field is a 4-byte integer value. The Quality of Service (QoS) level is extracted from the bearer context information element of the GTP-C signaling. The network signaling data is extracted from the Cause information element in the GTP-C response message, including the signaling error code and the reason value for bearer resource allocation failure.

[0048] Power IoT terminals are widely distributed, and frequent base station handovers occur due to geographical movement or changes in wireless channel quality. Each handover triggers the GTP tunnel reconstruction process, generating a large number of GTP-C signaling messages in a short period. In this scenario, a single GTP-C signaling message may generate an incorrect tunnel endpoint identifier due to out-of-order signaling during network transmission or parsing anomalies in the deep packet inspection engine under signaling surges. If mapping records are directly established or updated based on a single signaling message, an incorrect tunnel endpoint identifier may be bound to the International Mobile Subscriber Identity (IMSI), leading to subsequent end-to-end probe data being associated with the wrong terminal identity.

[0049] To address the aforementioned technical challenges, this embodiment employs a multi-source cross-validation process. After the deep packet inspection engine extracts the International Mobile Subscriber Identity (IMSI) from the GTP-C session creation request message and the tunnel endpoint identifier from the session creation response message within the same session flow, the system treats the correspondence between the tunnel endpoint identifier and the IMSI as a pending confirmation mapping record, which does not take effect immediately. The system continuously monitors the bearer modification request message corresponding to the terminal within subsequent time windows, parsing the tunnel endpoint identifier and comparing it with the tunnel endpoint identifier in the pending confirmation mapping record. If the tunnel endpoint identifier in two or more consecutive subsequent signaling messages matches the pending confirmation mapping record, the mapping record is confirmed as valid, and its status is switched from pending confirmation to valid. If the tunnel endpoint identifier in any signaling message within the time window is inconsistent with the pending confirmation mapping record, the current mapping record is deemed abnormal, triggering a mapping reconstruction process: clearing the pending confirmation mapping record, re-extracting the tunnel endpoint identifier from the most recent GTP-C session creation response message, and re-executing the aforementioned cross-validation process. After two consecutive reconstruction failures, the system reports an alarm, and maintenance personnel intervene to investigate. This cross-validation mechanism effectively avoids errors in binding tunnel endpoint identifiers and International Mobile Subscriber Identity (IMSI) due to parsing anomalies in a single GTP-C signaling message or out-of-order signaling, thus improving the reliability of the mapping table in high-frequency mobile scenarios for power terminals.

[0050] In the dual-timer lease mechanism, the system sets a lifetime timer and a lease renewal timer for each valid mapping record in the dynamic mapping table. Once a mapping record is established and confirmed valid through cross-validation, the lifetime timer starts counting. The initial value of the lifetime timer is not fixed but determined based on the type of power service carried by the terminal: for real-time control terminals requiring millisecond-level responses, such as distribution automation, with high communication frequencies and frequent signaling interactions, the initial lifetime timer is set to a first preset duration; for near real-time services such as electricity consumption information collection, with lower communication frequencies, the initial lifetime timer is set to a second preset duration, where the second preset duration is longer than the first preset duration, to ensure that mapping records for low-frequency terminals do not prematurely expire due to excessively long normal communication intervals.

[0051] During the lifetime timer period, if the system successfully parses the corresponding terminal's signaling message from subsequent GTP-C signaling, it triggers the lease renewal timer operation: the lease renewal timer resets the lifetime timer to its initial value, and the mapping record remains valid. If the lifetime timer expires but the lease renewal timer is not triggered, the system does not immediately delete the mapping record, but instead marks it as pending verification and starts a verification window of a preset duration (e.g., one lifetime cycle). Within the verification window, the system continues to listen for the terminal's GTP-C signaling. If the terminal's signaling message is detected within the verification window, the lease renewal timer operation is triggered, and the mapping record returns to a valid state. If the lease renewal timer operation is not triggered for two consecutive lifetime cycles, it is determined that the terminal has detached or the tunnel has been released, and the mapping record is deleted. This dual-timer lease mechanism enables the dynamic mapping table to have adaptive maintenance capabilities in scenarios with high-frequency terminal movement and frequent tunnel reconstruction. While ensuring the timeliness of mapping records, it avoids accidental deletion of mappings due to short-term communication interruptions or network fluctuations, thereby providing a reliable identity bridging foundation for the terminal identity association of subsequent end-to-end probe data and the construction of network layer entity nodes in the full-link knowledge graph.

[0052] In some embodiments, in step S2, end-to-end probe data is obtained through the stripped GTP-U tunnel protocol header. Based on a unified time reference, a transmission delay compensation mechanism is used to reverse-compensate and correct the timestamp of the terminal-side sensing data. The alignment time window granularity is adaptively selected according to the power service type. When the terminal-side sensing data, end-to-end probe data, service quality level, and network signaling data are time-series aligned and spliced ​​to generate a fused feature vector, the end-to-end probe data is first obtained through flow-following detection technology. The flow-following detection probes deployed on the terminal side generate colored probe messages, which are encapsulated in the GTP-U tunnel along with the service data messages and transmitted. The probe messages contain a sending timestamp and a flow identifier sequence number. After the deep packet inspection engine strips the GTP-U tunnel protocol header, it extracts probe data packets from the exposed internal payload and reads the sending timestamp and sequence number from these packets. The end-to-end one-way latency is calculated based on the difference between the sending timestamp embedded at the sender and the receiving timestamp of the deep packet inspection engine; jitter parameters are calculated based on the latency variation of multiple consecutive probe packets in the same service flow; packet loss rate is calculated based on the difference between the total number of probe packets sent by the sender and the total number of probe packets actually received; and available bandwidth is estimated based on the receiving rate of probe packets. During the extraction of probe packets, the deep packet inspection engine verifies the fixed length of the inner IPv6 header (40 bytes) and the fixed length of the ICMPv6 header (8 bytes) to eliminate timestamp extraction errors caused by protocol distortion.

[0053] Terminal-side sensing data is collected by lightweight sensing agents deployed on the terminal side. These sensing agents run on the power IoT terminals, and their collection cycle is adaptively configured based on the type of power service carried by the terminal and its current operating status: a high-frequency collection cycle is configured for millisecond-level real-time control services such as distribution automation; a low-frequency collection cycle is configured for second-level near real-time services such as electricity consumption information collection. Furthermore, when the sensing agent detects an abnormal terminal operating status, it automatically shortens the collection cycle to increase the monitoring frequency. The sensing agent reads the terminal device's CPU utilization, memory usage, wireless signal reception strength indication, bit error rate, and communication module operation logs according to the current collection cycle, and packages and reports the collected results.

[0054] Network signaling data originates from the quality of service level and signaling error codes parsed from the GTP-C control plane signaling, including the priority of bearer resources allocated by the core network to terminal services and the session failure reason value.

[0055] Then, terminal-side sensing data, end-to-end detection data, and network signaling data, which have different sampling frequencies and generation mechanisms, are aligned based on a unified high-precision time base. This unified time base is achieved through a network time protocol or a precision time protocol, ensuring that the system clocks of all nodes on the terminal, edge, and cloud sides remain synchronized. The length of the time window is adaptively determined based on the type of power service being analyzed. The time axis is then divided using this determined time window length, and each data point is assigned to its corresponding time window according to its timestamp. When multiple data points exist within the same time window, they are merged using mean aggregation or median aggregation; when no data points exist, linear interpolation or Lagrange interpolation is used to fill the gap.

[0056] To address the timestamp discrepancy issue caused by the terminal-side sensing agent, network-side deep packet inspection engine, and flow-following detection probe belonging to different device domains, having varying sampling frequencies, and exhibiting asymmetrical data transmission paths in power IoT scenarios, this embodiment designs an asymmetric calibration mechanism for transmission delay compensation. Specifically, the flow-following detection probe message embeds a sending timestamp at the sending end, the deep packet inspection engine records the receiving timestamp after receiving the data on the core network side, and the terminal-side sensing agent carries the terminal's local timestamp when reporting data. The system uses the difference between the sending and receiving timestamps of multiple probe messages and employs a minimum delay estimation algorithm to estimate the uplink and downlink delays, where the uplink delay is the transmission delay from the terminal to the core network, and the downlink delay is the transmission delay from the core network to the terminal. Subsequently, the system applies reverse compensation to the timestamp of the terminal-side sensing data: adding the terminal's local timestamp to the uplink delay eliminates the timing discrepancy introduced by the asymmetric transmission delay between the terminal and the core network.

[0057] Furthermore, this embodiment adopts a multi-granularity adaptive time window alignment strategy based on the differentiated real-time requirements of power services. The system pre-defines a table mapping power service types to time window granularities: for real-time control services requiring millisecond-level response, such as distribution automation, a first-granularity time window with a length of 10 milliseconds is used; for near-real-time services at the second level, such as electricity consumption information collection, a second-granularity time window with a length of 5 seconds is used; for non-real-time services at the minute level, such as power equipment status monitoring, a third-granularity time window with a length of 1 minute is used. The length of the second-granularity time window is greater than that of the first-granularity time window, and the length of the third-granularity time window is greater than that of the second-granularity time window. During time alignment, the system automatically selects the corresponding time window granularity for data alignment based on the currently analyzed power service type. This ensures time alignment accuracy while also considering the differentiated real-time requirements of different power services, avoiding insufficient time accuracy for real-time services due to overly coarse uniform time window granularity, or excessively sparse data for non-real-time services due to overly fine granularity.

[0058] After time-series alignment, the terminal-side sensing data sequence, end-to-end detection data sequence, and network signaling data sequence are horizontally concatenated according to feature dimensions within the same time window to generate a high-dimensional fusion feature vector. This fusion feature vector is arranged in time window order to form a fusion feature vector sequence, which serves as the underlying data input for the construction of the end-to-end knowledge graph and as the source of observation data for the FRITL causal inference algorithm.

[0059] In some embodiments, when constructing the full-link knowledge graph in step S3, the knowledge graph first represents entities and their relationships in a graph structure. The full-link knowledge graph constructed in this step adopts a bottom-up three-layer architecture, with each layer corresponding to a different protocol level of the power Internet of Things communication link. The three layers achieve a structured association between terminal service status and network bearer status through cross-layer mapping relationships. The fused feature vector generated in step S2 provides attribute data for each entity node, and the dynamic mapping table provides a basis for the association between the bearer network layer and the terminal identity.

[0060] The physical link layer is constructed in the following order: IoT terminal nodes, base station equipment nodes, transmission fiber optic link nodes, and edge computing nodes are established as physical nodes. The attribute data of these nodes comes from the device type, device identifier, geographical location, and real-time operating status contained in the terminal-side sensing data in step S2. IoT terminal nodes and base station equipment nodes are connected via a wireless access relationship edge; base station equipment nodes and transmission fiber optic link nodes are connected via a fiber optic bearer relationship edge; and transmission fiber optic link nodes and edge computing nodes are connected via an uplink relationship edge.

[0061] The construction sequence of the bearer network layer is as follows: GTP tunnel instance nodes and QoS policy configuration entity nodes are established as entity nodes. The attribute data of the GTP tunnel instance nodes comes from the tunnel endpoint identifier, tunnel type, and tunnel status parsed from the GTP-C control plane signaling in step S1; the attribute data of the QoS policy configuration entity nodes comes from the QoS level and policy identifier parsed in step S1. The GTP tunnel instance nodes are connected to the base station equipment nodes of the physical link layer through tunnel bearer relationship edges, and the GTP tunnel instance nodes are connected to the QoS policy configuration entity nodes through policy association relationship edges.

[0062] The construction order of the application service layer is as follows: Power service process entity nodes and MQTT session connection entity nodes are established as entity nodes. The attribute data of the power service process entity nodes comes from the process identifier, service type, and running status contained in the terminal-side perceived data in step S2; the attribute data of the MQTT session connection entity nodes comes from the session identifier, publish and subscribe topics, heartbeat keep-alive interval, and session status contained in the terminal-side perceived data in step S2. The power service process entity nodes are connected to the IoT terminal nodes of the physical link layer through running relationship edges, and the MQTT session connection entity nodes are connected to the GTP tunnel instance nodes of the bearer network layer through dependency relationship edges.

[0063] In the communication links of the power Internet of Things (IoT), the physical link layer uses the International Mobile Subscriber Identity (IMSI) as the terminal identification, the bearer network layer uses the tunnel endpoint identifier as the GTP tunnel instance identifier, and the application service layer uses the process identifier and MQTT session identifier as the service entity identifier. These three identification systems are independent of each other, with no direct cross-layer mapping relationship. If these three identification layers cannot be associated into a unified graph structure, the state of the network bearer layer and the state of the terminal service layer will be disconnected, making end-to-end fault delimitation across network elements impossible.

[0064] To address the aforementioned technical challenges, this embodiment employs a cascaded cross-layer binding mechanism based on a dynamic mapping table to achieve end-to-end association of three-layer entities. Specifically, the system establishes a binding relationship between tunnel endpoint identifiers and International Mobile Subscriber Identity (IMSI) codes through the dynamic mapping table constructed in step S1, realizing cross-layer mapping from the GTP tunnel instance node in the bearer network layer to the IoT terminal node in the physical link layer. After completing the binding from the bearer layer to the physical layer, the system further establishes a cross-layer mapping from the application service layer to the bearer network layer by combining the association information between the power service process and the MQTT session reported by the terminal-side sensing agent and the dependency relationship between the MQTT session and the GTP tunnel: the MQTT session connection depends on the transmission channel provided by the underlying GTP tunnel, so the system associates the MQTT session identifier with the GTP tunnel endpoint identifier it depends on, and then traces back to the corresponding IMSI code through the dynamic mapping table, thereby completing the complete association from the application service layer to the physical link layer. Through the above two-level cascading mapping, a complete cross-layer association link is formed from "power business process entity to MQTT session connection entity to GTP tunnel instance to IoT terminal", so that any entity in any layer of the full-link knowledge graph can be traced back to the corresponding entity in other layers through cascading mapping.

[0065] After establishing the three layers of entity nodes and connecting the internal relationship edges of each layer, the system establishes temporal association edges based on the timestamp alignment relationship between entities. Step S2 has already completed the temporal alignment of terminal-side sensing data, end-to-end detection data, and network signaling data on the same time base, with each data point carrying a precise timestamp. When two entity nodes have data interaction or state association within the same time window, the system establishes a temporal association edge between the two entity nodes. The attributes of the temporal association edge include the start timestamp, end timestamp, and interaction duration. The temporal association edge connects the originally isolated entity nodes in the three-layer graph according to the time dimension, enabling the graph to simultaneously express the static topological relationships and dynamic temporal interaction relationships between entities.

[0066] In constructing temporally related edges, this embodiment further introduces a timestamp version marking mechanism. Specifically, each temporally related edge, in addition to carrying a start timestamp, an end timestamp, and the duration of the interaction, is also assigned a version sequence number, which increments with each update of the relationship edge. When a terminal experiences a base station switch that causes a change in the wireless access relationship edge, the system does not directly delete the old relationship edge, but instead marks it as a historical version and retains its record in the graph. At the same time, it creates a new relationship edge and assigns it a new version sequence number. This mechanism enables the end-to-end knowledge graph to retain the temporal traceability of historical relationships during dynamic evolution, providing a graph structure input containing historical information of temporal evolution for the causal inference based on temporal consistency in step S5, and avoiding the loss of temporal information caused by directly deleting old relationship edges in traditional graph update methods.

[0067] Through the above construction process, the full-link knowledge graph integrates the terminal service layer status, operator bearer layer status, and physical link layer status into a unified graph structure representation, providing a data foundation with complete structure, clear temporal correlation, and historical traceability for the cross-layer feature aggregation of the graph neural network model in step S4.

[0068] In some embodiments, step S3 further includes dynamically completing and reconstructing missing relation edges in the full-link knowledge graph using a knowledge graph link prediction algorithm based on newly added end-to-end probe data. After the full-link knowledge graph is constructed, the entity nodes and their associated edges in the graph reflect the network topology at the time of graph construction. Over time, the geographical location of the terminal may change, the terminal's serving base station may switch, and the quality of the wireless channel may fluctuate. These changes all cause the associations represented by the existing relation edges in the graph to no longer reflect the current network state. If the graph is not updated for a long time, the features generated by the graph neural network model based on the graph in step S4 will not be able to accurately represent the current network state, thus affecting the accuracy of fault root cause localization in step S5. Therefore, the system evaluates the graph quality based on the newly added end-to-end probe data and triggers dynamic updates of the graph based on the evaluation results.

[0069] All feature subsets of entity nodes are mapped to the same unified feature encoding. The smoothness is calculated after defining the feature space. The system calculates the overall feature smoothness of the entire knowledge graph using the following formula. :

[0070] ,

[0071] in, This represents the set of all legally valid association edges in the full-link knowledge graph; Indicates the number of associated edges; and Representing entity nodes respectively and entity nodes The corresponding feature subset in the fused feature vector; Represents a set An associated edge in the data, which connects entity nodes. and entity nodes ; Represents entity nodes and entity nodes The square of the L2 norm of the difference vectors between feature subsets; This represents the dimension of the entity node feature vector, meaning all entity nodes are mapped to the same d-dimensional feature space after unified feature encoding. d is a pre-configured hyperparameter, specifically representing the output dimension of the entity node feature encoding layer, exemplarily 64, 128, or 256, but not limited to these. Feature smoothness. The feature difference between adjacent nodes in the graph is quantified: when the feature smoothness Maintaining a low level indicates that the features are smoothly distributed across the topological structure of the graph, that the features of adjacent nodes have high consistency, and that the graph structure is reliable; when the feature smoothness is low... When the dynamic adaptive threshold is exceeded, it indicates that the feature differences between the nodes connected by certain relational edges in the graph are large, indicating that there are abnormal or missing relational edges in the graph, which requires triggering the dynamic completion and reconstruction process. The dynamic adaptive threshold is determined based on the feature smoothness baseline of the historical time window. The specific calculation method is as follows: extract the feature smoothness sequence within multiple normal power business cycles in the past, calculate its mean μ and standard deviation σ, and set the dynamic adaptive threshold as μ+kσ, where k is the sensitivity coefficient. k is adaptively determined based on the type of power service carried by the target terminal: For real-time control services such as distribution automation that require millisecond-level response, the timeliness of graph updates is critical and the tolerance for missed fault detection is low, so k is chosen to be a smaller value. In this embodiment, k is chosen to be 2 to reduce the dynamic adaptive threshold and improve the trigger sensitivity to graph anomalies; for minute-level non-real-time services such as power equipment status monitoring, the timeliness of graph updates is less critical and the smoothness fluctuations caused by the periodic fluctuations of the service need to be tolerated, so k is chosen to be a larger value. In this embodiment, k is chosen to be 3 to suppress erroneous graph updates caused by normal fluctuations; for second-level near real-time services such as electricity consumption information collection, k takes a value between a smaller and a larger value. In this embodiment, k is chosen to be 2.5. This dynamic threshold mechanism can adapt to the normal fluctuation baseline of the power network at different time periods, avoiding erroneous graph updates caused by periodic fluctuations in power load.

[0072] When feature smoothness When the dynamic adaptive threshold is exceeded, the system uses newly added end-to-end probe data as a trigger signal to detect the following two types of spectral changes:

[0073] The first category is changes caused by terminal movement. When the system detects a step change in the latency and jitter parameters in the end-to-end probe data of a terminal, where a step change refers to a change in the latency parameter exceeding the fluctuation threshold dynamically calculated from the historical baseline, and this change occurs within the transmission time span of M consecutive flow-following detection probe messages (M is a positive integer, and its value is adaptively determined according to the type of power service carried by the terminal: for millisecond-level real-time services such as distribution automation, M takes a smaller value to ensure high sensitivity; for second-level near real-time services such as electricity consumption information collection, M takes a larger value to tolerate normal network fluctuations), it is determined that the terminal has undergone base station handover, and the "wireless access" relationship edge between the terminal node and the current base station node is marked as pending verification.

[0074] The second category is changes caused by network status fluctuations. When the system detects that the packet loss rate in the end-to-end probe data corresponding to a certain GTP tunnel is continuously increasing or the available bandwidth is continuously decreasing, it determines that the carrying status of the tunnel has deteriorated and updates the congestion status attribute of the GTP tunnel instance node.

[0075] After completing the above detection and labeling, the system uses a knowledge graph link prediction algorithm to complete and reconstruct the relation edges marked as pending verification. The knowledge graph link prediction algorithm takes the feature vectors of entity nodes in the current graph and existing relation edges as input, and uses a link prediction model to calculate the possible relation edge types and their confidence scores between each node to be verified. For candidate relation edges with confidence scores greater than the dynamic confidence threshold, the system confirms them as valid relation edges and adds them to the graph; for existing relation edges with confidence scores less than the dynamic confidence threshold, the system deletes them from the graph. The dynamic confidence threshold is adaptively determined based on the criticality of the power business carried by the target node and its historical stability: for millisecond-level control businesses with high reliability requirements such as distribution automation, a higher first confidence threshold is used to strictly suppress fault propagation caused by pseudo-related edges; for non-real-time monitoring businesses such as electricity consumption information collection, a lower second confidence threshold is used to ensure graph connectivity. Specifically, the average confidence level μ of similar business relationship edges within a historical normal period is used as the benchmark, and offset correction is performed according to the business criticality adjustment coefficient β. The dynamic confidence threshold is calculated as μ + β, where β is a pre-configured hyperparameter with dimensions consistent with the confidence score, ranging from 0.05 to 0.2. β is adaptively determined based on the criticality of the power business carried by the target node: for millisecond-level control businesses with high reliability requirements such as distribution automation, it is necessary to strictly suppress fault mispropagation caused by pseudo-related edges, so β ​​takes a larger value. In this embodiment, β is 0.2, making the dynamic confidence threshold significantly higher than the historical average confidence level, retaining only relationship edges with extremely high confidence; for non-real-time monitoring businesses such as power equipment status monitoring, ensuring graph connectivity is prioritized, so β ​​takes a smaller value. In this embodiment, β is 0.05, avoiding excessive deletion of relationship edges due to an overly strict threshold, which would damage the integrity of the graph structure; for second-level near real-time businesses such as electricity consumption information collection, β takes a value between the two, and in this embodiment, β is 0.1. The value of β must also satisfy the constraint μ+β≤1 to ensure that the dynamic confidence threshold does not exceed the upper limit of the confidence score range. Through the above dynamic completion and reconstruction, the entity nodes and their associated edges in the full-link knowledge graph are updated to be consistent with the current network state, so that the graph always provides the graph structure input that accurately reflects the current network topology state for the graph neural network model in step S3.

[0076] Knowledge graph link prediction algorithms are mature technologies in this field, and this invention does not limit the specific type of link prediction model. In this embodiment, the knowledge graph link prediction algorithm adopts a representation learning-based link prediction model, exemplarily using the TransE model. Entity nodes and relation edges are embedded into a low-dimensional vector space. Through training, the sum of the head entity vector and the relation vector approximates the tail entity vector, and the negative value of the distance between them is used as the confidence score for candidate relation edges. In other embodiments, representation learning-based link prediction models such as the DistMult model, ComplEx model, or RotatE model can also be used. The contribution of this invention lies not in the link prediction model itself, but in the specific application method of combining link prediction with power business time-series cycles and dynamic confidence thresholds.

[0077] In the link prediction process, this invention addresses the significant business periodicity of power IoT data by designing a prediction window optimization strategy based on the power business time series cycle. Specifically, power consumption data collection in the power system has a data collection characteristic with a fixed cycle of 15 or 30 minutes, while distribution automation data has a status reporting characteristic associated with the grid dispatch cycle. The system utilizes the aforementioned prior power business time series cycle information to determine the time window range for link prediction: link confidence assessment is performed only within the data range of the current power business cycle, avoiding misjudgments caused by mixing data from different business cycles into the same prediction window. Simultaneously, for temporary data loss due to periodic sleep cycles of power terminals (such as some power consumption data collection terminals entering a low-power sleep state during non-collection periods), the system identifies this loss as normal sleep rather than relationship edge failure based on the power business cycle table, and does not trigger the deletion operation of relationship edges, thereby avoiding erroneous graph updates caused by periodic sleep cycles of power terminals.

[0078] In some embodiments, when the graph neural network model is used in step S4 to aggregate and update the heterogeneous features of cross-layer nodes in the full-link knowledge graph and generate the hidden layer representation vector of the nodes, the full-link knowledge graph includes entity nodes and the associated edges between entity nodes. Before the graph is input into the graph neural network, the system extracts the adjacency matrix W based on the associated edges. W is an N×N dimensional matrix, where N is the total number of nodes. When there is an associated edge between node i and node j, W... ij =1, otherwise W ij =0. The system calculates the degree matrix D based on the adjacency matrix W, where D is a diagonal matrix with diagonal elements D ii This is equal to the number of neighboring nodes that have an edge associated with node i. The system further calculates the graph Laplacian matrix L = D − W, which provides topological constraints for feature propagation in the graph neural network model.

[0079] The graph neural network model can be either the GraphSAGE model or the graph attention network model, with one model chosen for specific implementation. Both models take the adjacency matrix of the full-link knowledge graph and the initial feature vectors of entity nodes as input, and the updated hidden layer representation vectors of the nodes as output. The initial feature vectors of entity nodes are derived from the feature subsets corresponding to the node in the fused feature vectors generated in step S1: the initial feature vectors of physical link layer nodes include device type, device identifier, geographical location, and real-time operating status; the initial feature vectors of bearer network layer nodes include tunnel endpoint identifier, quality of service level, and signaling error code; and the initial feature vectors of application service layer nodes include process identifier, service type, session state, and heartbeat keep-alive interval.

[0080] When using the GraphSAGE model, the hidden layer features of nodes are updated iteratively layer by layer. Let the hidden layer representation vector of node v in the k-th layer be... N(v) is the set of first-order neighboring nodes that have edges associated with node v. Let be the feature vector of node v at layer (k-1). At layer k, the model performs mean aggregation on the feature vectors of all first-order neighboring nodes of node v at layer (k-1) to obtain the neighborhood aggregated feature. The neighborhood aggregated feature is then concatenated with the feature vector of node v itself at layer (k-1), and after linear transformation and nonlinear activation, the output is... The above process is executed synchronously on all nodes in the full-link knowledge graph. After multiple iterations, the hidden layer representation vector of each node encodes the node's own features and the feature information of its multi-level neighboring nodes.

[0081] When using the graph attention network model, the initial feature vector of node i is mapped to the latent space through the feature transformation matrix. For each neighbor node j, the unnormalized attention coefficient is calculated, which reflects the importance of neighbor node j to node i. After normalization by the softmax function, the normalized attention coefficient is obtained. The transformed feature vectors of all neighbor nodes are weighted and summed with the normalized attention coefficient as the weight. After nonlinear activation, the hidden layer representation vector of node i is output.

[0082] The graph neural network model is trained offline using historical fault samples as the training dataset. Each training sample contains the state of the entire knowledge graph within a time window before the fault occurred and the corresponding real fault category label. The model takes the state of the entire knowledge graph of the training samples as input, and after aggregation and updating, outputs the probability distribution of each node belonging to each type of fault. The multi-class cross-entropy loss function calculates the error between the output probability distribution and the real fault category label, and the total loss is obtained by accumulating the errors of all training samples. The system uses the gradient descent algorithm to iteratively optimize the learnable parameters of the model and minimize the total loss value.

[0083] In the specific implementation, the training parameters of the graph neural network model are configured as follows: the initial learning rate is set to 0.001, the Adam optimizer is used for parameter updates, and the weight decay coefficient is set to 0.0005 to prevent overfitting; the training batch size is set to 64 graph samples; the maximum number of training epochs is set to 200 epochs, and an early stopping mechanism is triggered when the loss value on the validation set no longer decreases for 10 consecutive epochs; the number of aggregation layers in the GraphSAGE model is set to 2, and the hidden layer dimension of each layer is set to 128 dimensions; the multi-head attention mechanism of the graph attention network model uses 4 attention heads, and the hidden layer dimension of each head is set to 64 dimensions; the non-linear activation function is the ReLU function; the training dataset is divided into training, validation, and test sets in an 8:1:1 ratio. During training, the input features are standardized so that the mean of each feature dimension is 0 and the variance is 1.

[0084] After aggregation and updating by the graph neural network model, each entity node in the full-link knowledge graph is mapped to a hidden layer representation vector of fixed dimension. This hidden layer representation vector contains the node's own initial feature information, the feature information of multi-order neighboring nodes, and the topological structure information of the entire graph, which serves as the input to the FRITL causal inference algorithm in step S5.

[0085] In some embodiments, in step S5, the fused feature vector is used as the observed data, and the node hidden layer representation vector is used as the topological prior constraint. The FRITL algorithm is used to infer the local causal direction and eliminate spurious correlation variables in the fused feature vector. When outputting the root cause probability distribution, the FRITL algorithm (Factorized Regression-based Inference for Temporal causal discovery with Latent variables) uses the fused feature vector generated in step S2 as the source of observed data and the node hidden layer representation vector generated in step S4 as the prior constraint. The algorithm execution process is divided into three stages: The first stage uses a fast causal inference procedure to construct a partial ancestor graph containing all observed variables based on the conditional independence test. This procedure allows for the existence of unobserved latent variables and can generate the correct causal structure in an asymptotic sense. The second stage uses an independent noise conditional model to infer unconfused local causal directions for undirected edges with uncertain directions in the partial ancestor graph. The third stage uses a three-part constraint to detect unobserved latent variables and their causal relationships with other variables, completing the merging and reconstruction of the causal structure.

[0086] The standard FRITL algorithm's conditional independence test relies solely on the statistical distribution of observed variables, neglecting spatial topological relationships. In the context of the power Internet of Things (IoT), massive terminals are widely distributed, and nodes that are physically far apart but share similar statistical data characteristics are easily misjudged as having a causal relationship. To address this issue, this embodiment incorporates the topological features corresponding to the set of variables in the hidden layer representation vector of the nodes generated in step S4 as additional conditional variables during the conditional independence test. This ensures that the conditional independence test considers both the node's own observed value characteristics and its topological location characteristics in the end-to-end knowledge graph when determining the conditional independence relationship between variables. Specifically, for any two observed variables... and Construct a topology-enhanced test statistic when performing conditional independence tests on a given condition set S. ,in, Indicates that in a given set of conditions Lower observation variables and The topological enhancement test statistic between them; Indicates that in a given set of conditions Lower observation variables and The larger the value of the dependency statistic obtained from the standard conditional independence test, the more it indicates... and The stronger the dependency between them; Representing the observed variables respectively and The hidden layer representation vectors of the corresponding nodes i and j after aggregation by the graph neural network; Represents a node and nodes The cosine similarity of the hidden layer representation vectors in the topological space represents the degree of similarity between the topological positions of node i and node j in the full-link knowledge graph. When it is positive, it strengthens the determination of the dependency relationship between the two nodes, and when it is negative, it weakens the determination of the dependency relationship. This represents the topological feature weight coefficient, a pre-configured hyperparameter with a value range of [0.01, 0.1], preferably 0.05. The criticality of the power services carried by the target node is adaptively determined: For millisecond-level control services with high reliability requirements, such as distribution automation, the topological association between nodes has a significant impact on the determination of fault propagation paths. Take the larger value (in this embodiment) Set the value to 0.1 to strengthen the determination of dependencies between topologically similar nodes; for non-real-time monitoring services such as electricity consumption information collection, Take the smaller value (in this embodiment) The value is set to 0.01 to avoid interference from topological features on the statistical regularity of the observed data, but it is not limited to this. It should be noted that the condition set S is a subset of the features of the observed variables other than the two nodes to be tested. In the power IoT scenario, it specifically represents the features of other nodes that may act as intermediate transmission paths or potential confounding factors. For example, when testing the conditional independence of terminal-side bit error rate and end-to-end delay, the condition set S may include base station load features, GTP tunnel packet loss rate features, and service quality level features. The algorithm evaluates the conditional independence relationship between the remaining variables given some network context features by traversing different condition sets S. When the value exceeds the preset independence threshold, a determination is made. and They are not independent under the condition set S, meaning there is a potential causal relationship between them; otherwise, they are judged as independent. and Conditional independence is achieved under condition set S, thereby combining the physical and logical topological distances of nodes in the full-link knowledge graph for comprehensive adjudication. This improvement enables the causal discovery process to utilize the topological structure information of the power link graph, avoiding misjudging physically non-adjacent or cross-layer unrelated variables as causal relationships, and improving the accuracy of the causal graph.

[0087] The standard FRITL algorithm detects latent variables through a tripartite constraint, but it does not consider the temporal characteristics of power data. Power IoT data exhibits multi-scale temporal characteristics, with different power services displaying different periodic fluctuation patterns. For example, electricity consumption data collection has a 15-minute or 30-minute load collection cycle, and distributed photovoltaic power generation exhibits output fluctuations related to the solar radiation cycle. These periodic fluctuations can easily lead the standard algorithm to misjudge synchronous oscillations as being driven by latent variables. To address this issue, this embodiment introduces a temporal consistency constraint in the latent variable detection stage. When the tripartite constraint determines that three observed variables are affected by the same unobserved latent variable, the system extracts the time series of the three observed variables at an adaptive time scale and performs a Granger causality test based on a vector autoregression model. By comparing whether the sum of squared residuals of the variables significantly decreases after introducing lagged terms, it determines whether a Granger causal relationship exists between any two variables and its direction. If the test results indicate that a significant unidirectional causal transmission path or a causal loop still exists among the three, then the Granger causality test result is determined to contradict the latent variable structure hypothesis. This indicates that the correlation is actually a spurious correlation caused by data synchronization oscillations due to periodic fluctuations in power load, rather than being driven by true latent variables. When a contradiction is determined and the latent variable hypothesis is rejected, the system re-searches using the following mechanism: Variable pairs with direct Granger causal relationships are removed from the current three-part candidate set, reducing the dependency priority of these pairs in the three-part constraint test. The three-part constraint algorithm is then re-called in the remaining observation variable subspace to search for new latent variable combinations. If, after an exhaustive search, no latent variable satisfying temporal consistency is found, the correlation between the variable sets is determined to be a spurious correlation, and the causal edge is directly pruned and removed from the causal structure graph, without generating any more latent variable nodes. This improved mechanism effectively filters out false latent variable misjudgments caused by periodic fluctuations in power load.

[0088] The standard FRITL algorithm, when performing bidirectional fitting tests on the Independent Noise Conditional Model (IRCM), determines the causal direction solely based on the independence metric between the regression residuals and the causal variable. The IRICM is a causal direction inference method based on a structural causal model. Its core principle is as follows: for adjacent variable pairs with unknown causal directions, two possible causal directions are assumed, bidirectional nonlinear regression fitting is performed, and the independence metric between the regression residuals and the assumed causal variable under the two assumptions is calculated. According to the basic assumption of this model, the regression residuals and the causal variable should be independent in the true causal direction, i.e., the corresponding independence metric is smaller. The system selects the direction with the smaller metric as the inferred causal direction. However, in power communication networks, there is a clear physical causal logic between the bearer network layer indicators, physical link environment indicators, and terminal-side indicators. The standard algorithm relies entirely on statistical metrics and may arrive at causal directions that violate the laws of power physics. For example, it might infer terminal anomalies as the cause of network overload, or service timeouts as the cause of increased packet loss in GTP tunnels. These reverse causal relationships do not hold true in the physical transmission logic of power communication links. To address the aforementioned issues, this embodiment pre-defines a causal prior rule base for the power sector. This rule base is constructed based on the physical transmission logic and protocol layer dependencies of power communication links, specifically including the following rules: Network indicators at the bearer network layer point to application service layer indicators; that is, an increase in GTP tunnel packet loss rate or service quality degradation will inevitably lead to MQTT session disconnection or service response timeout, and vice versa. Physical link environment indicators point to terminal-side perception indicators; that is, a decrease in wireless signal reception strength or base station overload will inevitably lead to an increase in terminal bit error rate or communication module reset, and vice versa. Terminal-side hardware resource indicators point to terminal service processing indicators; that is, overloaded terminal CPU utilization or excessive memory usage will lead to increased latency in service process data reporting, and vice versa. In the bidirectional fitting test, when the system calculates the independence metric of a bidirectional independent noise conditional model for a certain undirected edge, the system queries the aforementioned causal prior rule base for the power sector. If a certain hypothetical direction violates the above rules, the system adds a penalty term to the independence metric of that hypothetical direction. The penalty term ranges from [0.1, 0.5], preferably 0.2. Since the system ultimately selects the direction with the smaller independence metric value as the inferred local causal direction, this penalty mechanism artificially amplifies the metric value of directions that violate the laws of electrical physics, causing them to lose in the bidirectional comparison. This effectively prevents the generation of reverse causal edges that violate knowledge in the field of electricity, ensuring that the final reconstructed causal structure graph conforms to the absolute safety logic and real physical mechanism of power grid operation.

[0089] After the partial ancestor graph is constructed, the system uses an independent noise conditional model to infer local causal directions for undirected edges with uncertain directions. For each pair of adjacent variables representing the direction to be inferred, the system assumes two possible causal directions, fits a regression model to each direction, calculates the independence metric between the regression residuals and the causal variables, and selects the direction with the smaller independence metric as the inferred local causal direction.

[0090] After completing the local causal direction inference, the system uses the three-part constraint to detect unobserved latent variables. When the system detects a conflict violating the Markov equivalence class constraint in the partial ancestor graph, it determines that there are unobserved latent variables in the network environment. For three observed variables, if two of them are correlated and each is correlated with the third variable, but the latter two variables are independent given the first variable, then it is determined that there is an unobserved latent variable that simultaneously affects all three observed variables. The system merges this latent variable as a new node into the causal structure graph and uses independent component analysis to estimate the local causal structure whose direction is still uncertain after merging, thus reconstructing the complete causal structure graph.

[0091] After reconstructing the complete causal structure graph, the system starts from the target fault node and traces backward along the causal edges to all candidate root cause nodes. It calculates the weight product of all causal edges on each causal path to obtain the causal strength value of each candidate root cause node. After normalizing the causal strength values ​​of all candidate root cause nodes, it outputs the fault root cause probability distribution. When the root cause probability at the network bearer layer is greater than the dynamic warning threshold and the root cause probability at the terminal device is less than the dynamic safety threshold, the system intercepts the restart command sent to the power terminal and pushes a bearer network self-healing scheduling request to the operator's network management system; otherwise, it allows the issuance of restart or recovery commands to the terminal. The dynamic warning threshold is adaptively determined based on the criticality of the power service carried by the target terminal and the baseline of the network root cause probability within historical normal cycles: the mean of the root cause probability sequence of the network bearer layer over the past K normal cycles is calculated. with standard deviation Set the dynamic early warning threshold to Where K is a preset positive integer, This is a sensitivity coefficient, ranging from 1.5 to 2.5. A smaller value is used when the business type is high-risk control operations such as power distribution automation. The value is used to improve sensitivity to network anomalies; the dynamic security threshold is adaptively determined based on the historical cost of erroneous restarts of terminal devices: the root cause probability sequence of the terminal side over the past K normal cycles is extracted and the mean is calculated. Set the dynamic security threshold to ,in This is a tolerance coefficient, ranging from 0.05 to 0.15, for distribution terminals bearing important loads. The smaller value is selected to strictly limit unnecessary terminal restart actions. This dynamic threshold mechanism enables accurate determination of cross-layer root causes, effectively avoiding the risk of secondary failures caused by the accidental restart of high-value power terminals due to network fluctuations.

[0092] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as defined in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A method for power link root cause localization based on multimodal fusion causal graphs, characterized in that, include: Based on deep packet inspection technology, the GTP-U tunnel protocol header and GTP-C control plane signaling are identified and stripped from network traffic. The tunnel endpoint identifier, quality of service level and network signaling data are parsed from the stripped GTP-C control plane signaling. Cross-validation is performed by verifying the consistency of the tunnel endpoint identifier in two or more consecutive GTP-C control plane signaling messages to construct a dynamic mapping table. The dynamic mapping table is maintained by a dual timer lease mechanism. End-to-end detection data is obtained by stripping the GTP-U tunnel protocol header. Based on a unified time reference, a transmission delay compensation mechanism is used to reverse the timestamp of the terminal-side sensing data. The alignment time window granularity is adaptively selected according to the power service type. The terminal-side sensing data, end-to-end detection data, service quality level and network signaling data are time-series aligned and spliced ​​to generate a fused feature vector. Based on the dynamic mapping table, GTP tunnel instances in the bearer network layer are bound to the International Mobile Subscriber Identity (IMSI) of the physical link layer. Cross-layer mapping is established based on the dependency relationship between the session identifier of the application service layer and the GTP tunnel in the bearer network layer, forming an end-to-end association chain. Entity nodes are established in each layer, and time-series association edges are established according to the timestamp alignment relationship. Version sequence numbers are assigned to the time-series association edges through the timestamp version marking mechanism, thus constructing a full-link knowledge graph. A graph neural network model is used to aggregate and update the heterogeneous features of cross-layer nodes in the full-link knowledge graph, generating hidden layer representation vectors for the nodes. Using the fused feature vector as observation data and the node hidden layer representation vector as topological prior constraints, the FRITL algorithm is used to infer local causal directions and eliminate spurious correlation variables in the fused feature vector, outputting the probability distribution of fault root causes. The FRITL algorithm introduces the topological similarity of the node hidden layer representation vector in the conditional independence test, introduces causal prior constraints in the power field in the direction inference, and introduces time-series consistency verification in the latent variable detection.

2. The method as described in claim 1, characterized in that, The terminal-side sensing data includes the terminal device's CPU utilization, memory usage, wireless signal reception strength indication, bit error rate, and communication module operation log; the end-to-end detection data includes end-to-end latency, packet loss rate, available bandwidth, and jitter parameters; and the network signaling data includes bearer resource allocation failure error codes.

3. The method as described in claim 1, characterized in that, When cross-validating the consistency of tunnel endpoint identifiers in two or more consecutive GTP-C control plane signaling messages, constructing a dynamic mapping table, and maintaining the dynamic mapping table through a dual-timer lease mechanism, the following steps are included: Extract the International Mobile Subscriber Identity (IMSI) from the GTP-C session creation request message, extract the tunnel endpoint identifier from the session creation response message of the same session process, and establish a mapping record with the tunnel endpoint identifier as the key and the IMSI as the value. Listen to subsequent GTP-C signaling after the session creation response message. If the tunnel endpoint identifier in two or more consecutive GTP-C signaling messages is consistent with the mapping record, then confirm that the mapping record is effective; otherwise, trigger the mapping reconstruction process. Set a lifetime timer and a lease renewal timer for each mapping record in the dynamic mapping table. The lifetime timer is used to limit the effective lifespan of the mapping record, and the lease renewal timer is used to periodically initiate renewal verification during the existence of the mapping record. When the time-to-live timer expires and the lease renewal timer fails to trigger renewal, the mapping record is marked as pending verification. If no renewal is triggered within two consecutive lifetimes, the mapping record is deleted.

4. The method as described in claim 1, characterized in that, When generating the fused feature vector, the following steps are included: End-to-end probe data is obtained through flow detection, and the packet parsing of the flow detection includes checking the inner IPv6 header length and the ICMPv6 header length. The asymmetric transmission delay of each link segment is estimated by using the bidirectional timestamp difference between the sending timestamp embedded in the sending end and the receiving timestamp on the core network side in the flow detection probe message, and the asymmetric transmission delay is used to perform reverse compensation correction on the timestamp of the terminal side sensing data. The granularity of the alignment time window is determined according to the type of power service: a first granularity time window is used for distribution automation services, a second granularity time window is used for power consumption acquisition services, and a third granularity time window is used for power equipment status monitoring services. The second granularity time window is larger than the first granularity time window, and the third granularity time window is larger than the second granularity time window. Within the same time window, terminal-side sensing data, end-to-end detection data, service quality level, and network signaling data are horizontally spliced ​​according to feature dimensions to generate a fused feature vector.

5. The method as described in claim 1, characterized in that, The entities of the physical link layer include IoT terminals, base station equipment, transmission fiber optic links, and edge computing nodes; the entities of the bearer network layer include GTP tunnel instances, virtual private network instances, and quality of service policy configuration entities, and the dynamic mapping table binds the GTP tunnel to the International Mobile Subscriber Identity (IMSI) corresponding to the terminal; the entities of the application service layer include power service process entities and MQTT session connection entities.

6. The method as described in claim 1, characterized in that, Also includes: Based on the newly added end-to-end probe data, the missing relation edges in the full-link knowledge graph are dynamically filled and reconstructed using the knowledge graph link prediction algorithm. The dynamic completion and reconstruction includes: setting an effective time interval for each relation edge in the full-link knowledge graph; when the terminal's access base station is switched, retaining historical relation edges and marking them as invalid through a timestamp version marking mechanism, while establishing new wireless access relation edges; for cases where GTP tunnels are deleted due to session release, using the dynamic mapping table as an index, cascading deletion of associated edges in the bearer network layer and application service layer that depend on the GTP tunnel; when the feature smoothness of the full-link knowledge graph exceeds the dynamic adaptive threshold, determining the link prediction window based on the power service time series period; within the link prediction window, using the feature vectors of entity nodes in the current full-link knowledge graph and existing relation edges as input, calculating the possible relation edge types and their confidence scores between each node to be verified; confirming candidate relation edges with confidence scores greater than the dynamic confidence threshold as valid relation edges and adding them to the graph; and deleting existing relation edges with confidence scores less than the dynamic confidence threshold from the graph. The dynamic confidence threshold is adaptively determined based on the criticality of the power business carried by the target node and its historical stability. The average confidence of similar business relationship edges within the historical normal period is used as the benchmark, and the offset is corrected according to the business criticality adjustment coefficient.

7. The method as described in claim 1, characterized in that, The graph neural network model is selected from at least one of the GraphSAGE model and the graph attention network model; The GraphSAGE model concatenates the node's own features with the mean features of its first-order neighboring nodes, and then outputs the node's hidden layer representation vector through linear transformation and nonlinear activation. The graph attention network model calculates the normalized attention coefficients of neighboring nodes to the target node, performs a weighted summation of the neighboring node features, and then outputs the node's hidden layer representation vector through linear transformation and nonlinear activation.

8. The method as described in claim 1, characterized in that, When using the fused feature vector as observation data and the node hidden layer representation vector as topological prior constraints, and employing the FRITL algorithm to infer local causal directions and eliminate spurious correlation variables in the fused feature vector, the process includes: A partial ancestor graph is constructed based on the conditional independence test. The conditional independence test targets the observed variables in the fused feature vector and uses a topology enhancement test statistic. The topology enhancement test statistic is obtained by adding the standard conditional independence test statistic and the product of the topology feature weight coefficient and the cosine similarity of the hidden layer representation vectors of the two nodes. The standard conditional independence test statistic is the dependency statistic obtained from the standard conditional independence test, and the topology feature weight coefficient is a pre-configured hyperparameter. When the topology enhancement test statistic is greater than the preset independence determination threshold, it is determined that the two observed variables participating in the conditional independence test are not independent under the given condition set; otherwise, they are determined to be conditionally independent. For undirected edges with uncertain directions in the partial ancestor graph, a two-way fitting test is performed using an independent noise conditional model. In the two-way fitting test, a causal prior constraint from the power field is introduced as a penalty term to infer the local causal direction. When a conflict violating the Markov equivalence class constraint is detected, it is determined that there are unobserved latent variables. The latent variables are detected using the three-part constraint, and the temporal consistency verification is introduced to complete the structural merging. The undetermined local causal structure is estimated by combining independent component analysis, and the complete causal structure graph is reconstructed.

9. The method as described in claim 1, characterized in that, When outputting the probability distribution of root causes of faults, the process includes: normalizing the causal path weights from the target fault node to each candidate root cause node in the reconstructed causal structure graph to obtain the probability distribution of each candidate root cause; when the probability of root cause at the network bearer layer is greater than the dynamic warning threshold and the probability of root cause at the terminal device is less than the dynamic safety threshold, intercepting the restart command sent to the power terminal and pushing a self-healing scheduling request for the bearer network to the operator's network management system; wherein, the dynamic warning threshold is adaptively determined based on the criticality of the power service carried by the target terminal and the mean and standard deviation of the probability sequence of root causes at the network bearer layer within the historical normal period, and the dynamic safety threshold is adaptively determined based on the historical erroneous restart cost of the terminal device and the mean and standard deviation of the probability sequence of root causes at the terminal device within the historical normal period.

Images