Power system alarm denoising and intelligent research method and system based on large model

Abstract

This invention relates to a method and system for power system alarm noise reduction and intelligent judgment based on a large model, belonging to the interdisciplinary field of power system automation and artificial intelligence. The method includes: acquiring multi-source heterogeneous alarm data and constructing a preprocessing dataset; constructing a heterogeneous information network based on the preprocessing dataset, defining meta-paths and generating node sequences, semantically encoding and calculating multi-dimensional similarity, weighting and fusing the results according to dynamic weights to obtain a comprehensive similarity, and clustering to generate alarm clusters; extracting features from the alarm clusters to generate alarm cluster feature data structures; constructing and training a large-scale power threat detection model using a dual-channel architecture, fusing the results to obtain fusion inference results; generating an alarm judgment report based on the fusion inference results and performing confidence assessment; and performing feedback optimization based on the confidence score and manual review results. This invention can effectively reduce noise interference in massive power system alarm data, accurately identify high-risk events, and improve the accuracy and reliability of alarm judgment.

Description

Technical Field

[0001] This invention relates to a method and system for alarm noise reduction and intelligent judgment in power systems based on a large model, belonging to the interdisciplinary field of power system automation and artificial intelligence. Background Technology

[0002] With the continuous improvement of the digitalization and intelligence of power systems, a large number of monitoring devices and sensors have been deployed, generating massive amounts of operational data and alarm information daily. This alarm data comes from diverse sources and formats, including telemetry alarms from SCADA systems, fault alarms from protection devices, and attack alarms from network security devices, exhibiting typical multi-source heterogeneous characteristics. At the same time, the operational risks faced by power systems are becoming increasingly complex, with high-risk events often hidden within the massive amounts of alarm data, making them difficult to detect and accurately identify in a timely manner. A large number of false alarms and redundant alarms not only increase the workload of dispatchers but may also introduce noise interference into situational awareness models, distorting the judgment of the true operational situation.

[0003] In existing technologies, power system alarm processing has mainly undergone three stages of development and evolution: Phase 1 – Threshold-based rule-based alarms (1990s-2010s): This phase primarily relied on manually set fixed thresholds and simple rules to filter and screen alarms. While simple to implement, this method struggled to cope with the complex and ever-changing operating conditions of power systems, resulting in high false alarm and false negative rates. Furthermore, the cost of rule maintenance increased dramatically as the system scaled up.

[0004] The second stage—anomaly detection based on machine learning (2010s-2020s): This stage introduced machine learning algorithms to perform clustering analysis and anomaly detection on alarm data. For example, existing patents have disclosed a clustering and fusion method for alarm information in heterogeneous network environments, which achieves clustering analysis of similar alarms through alarm preprocessing and fuzzy clustering algorithms. However, this type of method mainly relies on the shallow features of the alarms themselves for clustering, failing to fully explore the spatiotemporal correlations, device topology correlations, and deep semantic correlations between alarms, and the accuracy and interpretability of the clustering results are still insufficient.

[0005] Phase Three – Intelligent Operation and Maintenance Based on Knowledge Graphs and Large Models (2020s-): In recent years, knowledge graph and large language model technologies have begun to be introduced into the field of power system alarm analysis. For example, patents have disclosed methods for generating power grid fault response strategies based on knowledge graphs driven by large models; other patents have proposed methods for diagnosing hydropower station equipment faults by integrating knowledge graphs and large models. In addition, methods for generating alarm handling schemes based on large model-based hybrid retrieval enhancement and intelligent alerting methods for high-risk alarms based on large model situational awareness have also emerged.

[0006] However, the aforementioned existing technologies still have the following shortcomings: First, the granularity of alarm clustering is insufficient. Current technologies primarily rely on semantic similarity of alarm texts or simple device associations, failing to fully integrate spatiotemporal, device topology, and semantic dimensions for comprehensive multi-dimensional judgment. Different alarm scenarios (such as transient fault scenarios, evolving fault scenarios, and network attack scenarios) exhibit varying sensitivities to each dimension. Existing technologies employ fixed-weight similarity calculations, which cannot adaptively adjust according to scenario type, resulting in unstable clustering results across different scenarios.

[0007] Second, the knowledge utilization of large-scale models is insufficient. Although existing technologies have introduced the integration of knowledge graphs with large-scale models, they mostly adopt the approach of using knowledge graphs as offline knowledge bases for retrieval enhancement, failing to deeply integrate the structured knowledge of knowledge graphs as constraints into the model's training and inference process. The inference accuracy of large-scale models in the specialized field of power systems is limited by the coverage of domain knowledge, and simply relying on general pre-trained models is insufficient to accurately identify complex fault modes in power systems.

[0008] Third, the interpretability and reliability of the reasoning process are insufficient. In existing technologies, the reasoning process of large models is often a "black box," lacking interpretability support and confidence assessment for the reasoning results. Schedulers find it difficult to determine whether the alarm judgment results output by the model are reliable, affecting the acceptability of the technical solution in actual production environments.

[0009] Fourth, there is a lack of closed-loop optimization mechanisms. Most existing technologies are open-loop systems, which fail to adaptively adjust and continuously optimize alarm clustering strategies and model parameters based on feedback from actual use (such as manual review results, model confidence levels, etc.).

[0010] Among the aforementioned prior art, the closest to this application is the patent application CN121998403A, entitled "An alarm noise reduction method and system based on a large power system model." This patent application discloses an alarm noise reduction method based on a large power system model, comprising: acquiring multi-source heterogeneous alarm data and constructing a preprocessed dataset; constructing a heterogeneous information network based on the preprocessed dataset, using the heterogeneous information network to generate node sequences containing alarm semantics, and aggregating multiple node sequences that meet similarity requirements into alarm clusters; generating alarm cluster feature data structures based on alarm clusters; acquiring knowledge graphs and historical alarm data to construct a large power threat detection model; and inputting the alarm cluster feature data structure into the large model to generate an alarm analysis report.

[0011] However, the prior application has at least the following defects: (1) Its heterogeneous information network only vaguely mentions the node sequence containing alarm semantics, without specifying that the network contains multiple node types such as time nodes and location nodes, as well as multiple semantic relationships such as temporal correlation and spatial topology relationship between alarms; (2) Its node sequence generation and clustering adopt a single similarity requirement, without involving the weighted fusion of multi-dimensional similarity and dynamic weight adaptive adjustment; (3) Its large model construction does not specify the specific way of using knowledge graph as external knowledge constraint, nor does it involve dual-channel architecture; (4) Its generated alarm judgment report lacks a confidence assessment mechanism, and cannot provide a quantitative reference for the reliability of decision-making for dispatchers; (5) The overall scheme is an open-loop system, lacking a feedback-based closed-loop optimization mechanism. Summary of the Invention

[0012] Based on the problems described in the background, the problem to be solved by the present invention is to provide a method and system for power system alarm noise reduction and intelligent judgment based on a large model, which aims to achieve efficient noise reduction and accurate judgment of massive alarm data of power system, so as to solve the problems mentioned above.

[0013] To achieve the above objectives, the present invention provides the following technical solution: a power system alarm noise reduction and intelligent judgment method based on a large model, comprising the following steps: S1. Obtain multi-source heterogeneous alarm data from the power system, preprocess the multi-source heterogeneous alarm data, and construct a preprocessed dataset; S2. Construct a heterogeneous information network based on the preprocessed dataset, and assign initial weights to each type of node and each type of edge in the heterogeneous information network. The heterogeneous information network includes alarm nodes, device nodes, time nodes, and location nodes, as well as multi-dimensional semantic relationships between the nodes. The multi-dimensional semantic relationships include at least the attribution relationship between alarms and devices, the temporal correlation relationship between alarms, and the spatial topological relationship between alarms. The initial weights are determined based on the importance of node types and the semantic strength of edge types. S3. Define multiple meta-paths on the heterogeneous information network, perform a biased random walk based on the multiple meta-paths to generate multiple node sequences, semantically encode each node sequence to generate an alarm semantic vector, calculate the multi-dimensional similarity between any two alarm semantic vectors, the multi-dimensional similarity includes semantic similarity, spatiotemporal similarity and device topology similarity, weight the semantic similarity, spatiotemporal similarity and device topology similarity according to dynamic weights to obtain a comprehensive similarity, the dynamic weights are adaptively adjusted according to the alarm scenario type, and cluster the multiple node sequences based on the comprehensive similarity to generate alarm clusters; S4. Based on the alarm clusters, extract the spatiotemporal distribution features, device association features, and semantic aggregation features of each alarm cluster to generate an alarm cluster feature data structure. S5. Obtain the knowledge graph and historical alarm data of the power system. Using the knowledge graph as a structured knowledge constraint set and the historical alarm data as training corpus, construct and train a large-scale power threat detection model using a dual-channel architecture. The dual-channel architecture includes a knowledge enhancement channel and a temporal reasoning channel. The knowledge enhancement channel is used to link and semantically align entities in the alarm cluster feature data structure with corresponding entities in the knowledge graph to generate knowledge-enhanced alarm semantic representations. The temporal reasoning channel is used to perform sequence modeling on the temporal features in the alarm cluster feature data structure to generate temporally enhanced alarm evolutionary representations. The knowledge-enhanced alarm semantic representations and the temporally enhanced alarm evolutionary representations are fused across channels to obtain a fusion reasoning result. S6. Based on the fusion reasoning results, generate an alarm assessment report for the power system, evaluate the confidence level of the alarm assessment report, and output the confidence score corresponding to the alarm assessment report.

[0014] Preferably, the probability of selecting a walk path in the biased random walk in step S3 is dynamically adjusted based on the differences in meta-path type and node type, specifically including: Different walk preference weights are set for different types of metapaths; During the walk, the probability of the current node transitioning to each candidate node is determined by the degree of matching between the candidate node type and the type of the next node expected by the current meta-path, the degree of matching between the edge type between the candidate node and the current node and the edge type expected by the current meta-path, and the node importance weight of the candidate node itself.

[0015] Preferably, the semantic similarity in step S3 is calculated based on the cosine distance between the two alarm semantic vectors; The spatiotemporal similarity is calculated based on the overlap rate of the time windows and the spatial distance between the two alarm clusters. The device topology similarity is calculated based on the shortest path distance and the number of common neighbor nodes of the device sets associated with the two alarm clusters in the power system topology graph. The dynamic weights are obtained from a preset weight mapping table based on the current alarm scenario type. The alarm scenario types include at least instantaneous fault scenarios, evolving fault scenarios, and network attack scenarios. The weight allocation of semantic similarity, spatiotemporal similarity, and device topology similarity differs under different alarm scenario types.

[0016] Preferably, after clustering the multiple node sequences based on the comprehensive similarity to generate an alarm cluster in step S3, the method further includes: The clustering results are verified for intra-cluster compactness and inter-cluster separation. The average intra-cluster distance and minimum inter-cluster distance of each alarm cluster are calculated. If the average intra-cluster distance is greater than the first threshold or the minimum inter-cluster distance is less than the second threshold, the dynamic weights are adjusted and the clustering is performed again.

[0017] Preferably, step S4 includes: Extract the distribution range of alarm timestamps and the trend of alarm frequency changes within each alarm cluster, as well as the geographical area or power grid topology area involved in the alarms within each alarm cluster, as the spatiotemporal distribution characteristics. Extract the set of devices associated with alarms in each alarm cluster, as well as the topological connection relationship and electrical coupling relationship between the devices, as the device association feature; Extract the cluster center semantic vector and alarm type distribution statistical vector from each alarm cluster after the alarm text is encoded by the large model, and use them as the semantic aggregation features; The spatiotemporal distribution features, device association features, and semantic aggregation features are fused and encoded to generate a unified alarm cluster feature data structure.

[0018] Preferably, step S5, which uses the knowledge graph as a structured knowledge constraint set and the historical alarm data as training corpus to construct and train a large-scale power threat detection model using a dual-channel architecture, includes: Extract alarm text, alarm sequence, alarm handling records and fault attribution information from the historical alarm data to construct a training dataset; The topological relationships of power equipment, the association rules of equipment parameters, and historical fault modes are extracted from the knowledge graph to construct a structured knowledge constraint set; Based on a pre-trained large language model, the dual-channel architecture is constructed using a parameter-efficient fine-tuning strategy. During the fine-tuning process, the knowledge enhancement channel uses the structured knowledge constraint set as external knowledge for constraint enhancement, and the temporal reasoning channel uses a sequence modeling network to model temporal features. During training, only some parameters of the base model are updated, while the rest are frozen.

[0019] Preferably, the cross-channel fusion in step S5 adopts a gated fusion mechanism. The gated fusion mechanism dynamically calculates the fusion weight of the two channels based on the information entropy and confidence of the knowledge-enhanced alarm semantic representation and the time-enhanced alarm evolution representation, and performs weighted fusion of the representations of the two channels based on the fusion weight.

[0020] Preferably, the generation of the power system alarm assessment report in step S6 includes: Based on the fusion reasoning results, identify the high-risk event types and risk levels corresponding to the alarm clusters; Call the preset alarm analysis report template and fill the corresponding fields of the report template with the high-risk event type, risk level, spatiotemporal distribution information of the alarm cluster, device association information and semantic aggregation information; The filled report is augmented with natural language generation to generate a structured alarm analysis report, which includes at least four parts: event overview, risk analysis, root cause inference, and handling recommendations.

[0021] Preferably, step S6, which involves evaluating the confidence level of the alarm assessment report and outputting a confidence score corresponding to the alarm assessment report, includes: The first confidence component is calculated based on the distribution entropy of the probability of identifying high-risk event types in the fusion inference results; The second confidence component is calculated based on the degree of matching between the root cause inference in the alarm analysis report and the historical fault patterns in the knowledge graph; The third confidence component is calculated based on the intra-cluster density and inter-cluster separation of the alarm clusters; The confidence score is obtained by weighting and fusing the first confidence component, the second confidence component, and the third confidence component.

[0022] This invention also provides a power system alarm noise reduction and intelligent judgment system based on a large model, comprising: The data acquisition and preprocessing module is used to acquire multi-source heterogeneous alarm data in the power system, preprocess the multi-source heterogeneous alarm data, and construct a preprocessed dataset. A heterogeneous information network construction and alarm clustering module is used to construct a heterogeneous information network based on the preprocessed dataset. The heterogeneous information network includes alarm nodes, device nodes, time nodes, and location nodes, as well as multi-dimensional semantic relationships between the nodes. Multiple meta-paths are defined on the heterogeneous information network. Multiple node sequences are generated by performing a biased random walk based on the multiple meta-paths. Each node sequence is semantically encoded to generate an alarm semantic vector. A multi-dimensional similarity is calculated between any two alarm semantic vectors. The multi-dimensional similarity includes semantic similarity, spatiotemporal similarity, and device topology similarity. The semantic similarity, spatiotemporal similarity, and device topology similarity are weighted and fused according to dynamic weights to obtain a comprehensive similarity. Based on the comprehensive similarity, the multiple node sequences are clustered to generate alarm clusters. The alarm cluster feature extraction module is used to extract the spatiotemporal distribution features, device association features and semantic aggregation features of each alarm cluster based on the alarm cluster, and generate an alarm cluster feature data structure. The large model construction and reasoning module is used to acquire the knowledge graph and historical alarm data of the power system. The knowledge graph is used as a structured knowledge constraint set and the historical alarm data is used as training corpus. A dual-channel architecture is adopted to construct and train a large power threat detection model. The dual-channel architecture includes a knowledge enhancement channel and a temporal reasoning channel. The alarm cluster feature data structure is input into the large power threat detection model for reasoning to obtain the fused reasoning result. The alarm analysis report generation module is used to generate an alarm analysis report for the power system based on the fusion inference results, evaluate the confidence level of the alarm analysis report, and output the confidence score corresponding to the alarm analysis report. The feedback optimization module is used to incrementally update the node weights, meta-path selection, and parameters of the power threat detection big model of the heterogeneous information network based on the confidence score of the alarm analysis report and the results of manual review.

[0023] The beneficial effects of this invention are: 1. The accuracy and scenario adaptability of alarm clustering are significantly improved. In existing technologies, alarm clustering is mainly based on a single similarity index or a multi-index fusion method with fixed weights. This invention introduces multi-dimensional similarity (semantic similarity, spatiotemporal similarity, and device topology similarity) and employs a dynamic weight adaptive adjustment mechanism. This allows for automatic adjustment of the weight allocation of each dimension according to different alarm scenario types (transient faults, evolving faults, network attacks, etc.). This mechanism ensures high accuracy of alarm clustering across different scenarios, avoiding the performance degradation problem of fixed-weight schemes when switching scenarios. Furthermore, by verifying and iteratively optimizing the clustering results for intra-cluster compactness and inter-cluster separation, the clustering quality is further guaranteed.

[0024] 2. The professionalism and accuracy of large-scale model reasoning have been significantly enhanced. In existing technologies, the fusion of large models and knowledge graphs often employs retrieval enhancement methods, with the knowledge graph only being invoked as an external knowledge base during the inference phase. This invention deeply integrates the knowledge graph as a structured set of knowledge constraints into the model's training process. Through knowledge enhancement channels, alarm features are linked and semantically aligned with knowledge graph entities, ensuring the model is guided by power system domain knowledge and physical constraints during training. This deep fusion significantly improves the model's inference accuracy within the power system domain and effectively reduces the "illusion" problem that often arises with general-purpose large models in specialized scenarios.

[0025] 3. The interpretability and credibility of the reasoning results are significantly improved. In existing technologies, the reasoning process of large models lacks interpretability support, making it difficult for schedulers to judge the reliability of the output results. This invention, through a dual-channel architecture design, ensures that the reasoning results are simultaneously guided by the structured knowledge constraints of the knowledge graph and the temporal evolution rules, resulting in higher interpretability of the reasoning process. Furthermore, this invention introduces a multi-dimensional confidence assessment mechanism, comprehensively evaluating the reliability of the assessment report from three dimensions: model output certainty, degree of matching with known failure modes, and clustering quality, providing schedulers with a quantitative credibility reference for decision-making.

[0026] 4. Achieved closed-loop continuous optimization of alarm handling. Existing technologies are mostly open-loop systems, lacking the ability to self-improve based on feedback from actual use. This invention establishes a feedback optimization mechanism based on confidence scores and manual review results, capable of incrementally updating node weights, meta-path selection strategies, and large model parameters in heterogeneous information networks. This closed-loop mechanism enables the system to continuously learn and adapt to new alarm modes and fault types during actual operation, possessing continuous evolution capabilities and outperforming existing statically configured technologies in the long run.

[0027] 5. The system architecture has high scalability and versatility. The core modules of this invention, such as heterogeneous information network construction, multi-dimensional similarity clustering, and dual-channel large model architecture, all possess excellent scalability. The heterogeneous information network supports the flexible addition of new node and relationship types, the multi-dimensional similarity calculation supports the addition of new similarity dimensions, and the dual-channel architecture supports the addition of new inference channels. This modular and scalable design makes this invention not only applicable to alarm noise reduction and intelligent judgment in power systems, but also extendable to alarm analysis scenarios in other industrial fields. Attached Figure Description

[0028] Figure 1 This is a flowchart of the method steps of the present invention. Detailed Implementation

[0029] The embodiments of the present invention will be further described below with reference to the accompanying drawings: Example

[0030] like Figure 1 As shown, this invention provides a power system alarm noise reduction and intelligent judgment method based on a large model, including the following steps: S1. Acquisition and preprocessing of multi-source heterogeneous alarm data: Acquire multi-source heterogeneous alarm data in the power system, preprocess the multi-source heterogeneous alarm data, and construct a preprocessed dataset; The multi-source heterogeneous alarm data includes at least telemetry over-limit alarms from SCADA / EMS systems, fault alarms from relay protection devices, attack alarms from network security devices, and status alarms from online monitoring devices. These alarm data differ significantly in data format, data granularity, time precision, and semantic expression, and are typical examples of heterogeneous data.

[0031] The preprocessing of the aforementioned multi-source heterogeneous alarm data includes at least the following: data cleaning (removing duplicate alarms and correcting outliers), data standardization (unifying alarm encoding formats, timestamp formats, and device naming conventions), and data completion (completing or annotating missing key fields). This preprocessing process builds a standardized and quality-controlled preprocessed dataset.

[0032] S2. Construction of Heterogeneous Information Network: Construct a heterogeneous information network based on the preprocessed dataset, and assign initial weights to each type of node and each type of edge in the heterogeneous information network. Unlike existing technologies, the heterogeneous information network of this invention includes four types of nodes: Alarm Nodes: Each alarm event corresponds to one node; Equipment node: The physical equipment in a power system, such as transformers, circuit breakers, and lines; Time frame: The time interval or point in time during which the alarm occurred; Location node: The geographical area or power grid topology area involved in the alarm; The nodes of different types have multiple semantic relationships, including at least: Alarm and device attribution: A certain alarm belongs to a certain device; The temporal relationship between alarms: the order and interval of alarms on the timeline; Spatial topology relationships between alarms: the electrical connection relationships of the devices involved in the alarm within the power grid topology; The relationship between alarms and timestamps: the time label of when the alarm occurred.

[0033] Based on this, initial weights are assigned to each type of node and edge in the heterogeneous information network. The initial weight of a node type is determined based on the importance of that type of node in alarm analysis; for example, device nodes usually have a higher weight than ordinary alarm nodes. The initial weight of an edge type is determined based on the semantic strength carried by that type of edge; for example, device topological connection relationships have a higher semantic weight than simple temporal relationships.

[0034] S3. Alarm Clustering: Define multiple meta-paths on the heterogeneous information network. Each meta-path represents an alarm semantic propagation path type. For example, "alarm node - device node - alarm node" represents associated alarms on the same device, "alarm node - time node - alarm node" represents associated alarms within the same time window, and "alarm node - location node - alarm node" represents associated alarms within the same spatial area.

[0035] Based on the multiple meta-paths, a biased random walk is performed to generate multiple node sequences. Each node sequence is a path containing multiple nodes and their connection relationships, carrying specific alarm semantic information. Each node sequence is semantically encoded to generate an alarm semantic vector. The alarm semantic vector integrates node type information, edge type information, and path context information, which can comprehensively characterize the alarm semantics carried by the node sequence. Calculate the multi-dimensional similarity between any two alarm semantic vectors, the multi-dimensional similarity including semantic similarity, spatiotemporal similarity and device topology similarity, and weight the semantic similarity, spatiotemporal similarity and device topology similarity according to dynamic weights to obtain a comprehensive similarity, the dynamic weights are adaptively adjusted according to the alarm scenario type, and the multiple node sequences are clustered based on the comprehensive similarity to generate alarm clusters; In particular, the probability of path selection in a biased random walk is dynamically adjusted based on the differences in meta-path type and node type, specifically including: Different walk preference weights are set for different types of metapaths; During the walk, the probability of the current node transitioning to each candidate node is determined by the degree of matching between the candidate node type and the type of the next node expected by the current meta-path, the degree of matching between the edge type between the candidate node and the current node and the edge type expected by the current meta-path, and the node importance weight of the candidate node itself.

[0036] The semantic similarity is calculated based on the cosine distance between two alarm semantic vectors; The spatiotemporal similarity is calculated based on the overlap rate of the time windows and the spatial distance between the two alarm clusters. The device topology similarity is calculated based on the shortest path distance and the number of common neighbor nodes of the device sets associated with the two alarm clusters in the power system topology graph. The dynamic weights are obtained from a preset weight mapping table based on the current alarm scenario type. The alarm scenario types include at least transient fault scenarios, evolving fault scenarios, and network attack scenarios. The weight allocation of semantic similarity, spatiotemporal similarity, and device topology similarity differs under different alarm scenario types. For example, in transient fault scenarios, spatiotemporal similarity may have a higher weight; in network attack scenarios, semantic similarity and device topology similarity may be more important.

[0037] The process of clustering the multiple node sequences based on the comprehensive similarity to generate an alarm cluster further includes: The clustering results are verified for intra-cluster compactness and inter-cluster separation. The average intra-cluster distance and minimum inter-cluster distance of each alarm cluster are calculated. If the average intra-cluster distance is greater than the first threshold or the minimum inter-cluster distance is less than the second threshold, i.e. if the average intra-cluster distance is too large or the minimum inter-cluster distance is too small, the dynamic weights are adjusted and the clustering is repeated until the clustering results meet the preset quality requirements.

[0038] S4. Alarm cluster feature extraction: Based on the alarm clusters, extract the spatiotemporal distribution features, device association features, and semantic aggregation features of each alarm cluster to generate an alarm cluster feature data structure. Step S4 includes: Spatiotemporal distribution characteristics: Extract the distribution range of alarm timestamps and the trend of alarm frequency changes within each alarm cluster, as well as the geographical area or power grid topology area involved in the alarms within each alarm cluster, as the spatiotemporal distribution characteristics. Device association features: Extract the set of devices associated with alarms in each alarm cluster, as well as the topological connection relationship and electrical coupling relationship between devices, as the device association features; Semantic aggregation features: Extract the cluster center semantic vector and alarm type distribution statistical vector of alarm text after being encoded by a large model in each alarm cluster, and use them as the semantic aggregation features; The spatiotemporal distribution features, device association features, and semantic aggregation features are fused and encoded to generate a unified alarm cluster feature data structure, which serves as the input for subsequent large-scale model inference.

[0039] S5. Construction and Training of a Dual-Channel Architecture Power Threat Detection Model: Acquire the knowledge graph and historical alarm data of the power system. Use the knowledge graph as a structured knowledge constraint set and the historical alarm data as training corpus. Construct and train a dual-channel architecture power threat detection model. Specifically, a large-scale power threat detection model is constructed and trained using the knowledge graph as a structured knowledge constraint set and the historical alarm data as training corpus, employing a dual-channel architecture. This includes: Extract alarm text, alarm sequence, alarm handling records and fault attribution information from the historical alarm data to construct a training dataset; The topological relationships of power equipment, the association rules of equipment parameters, and historical fault modes are extracted from the knowledge graph to construct a structured knowledge constraint set; Based on a pre-trained large language model, the dual-channel architecture is constructed using a parameter-efficient fine-tuning strategy. During the fine-tuning process, the knowledge enhancement channel uses the structured knowledge constraint set as external knowledge for constraint enhancement, and the temporal reasoning channel uses a sequence modeling network to model temporal features. During training, only some parameters of the base model are updated, while the rest are frozen.

[0040] The dual-channel architecture includes a knowledge enhancement channel and a temporal reasoning channel; The knowledge enhancement channel is used to link and semantically align entities in the alarm cluster feature data structure with corresponding entities in the knowledge graph, generating knowledge-enhanced alarm semantic representations. During fine-tuning, this channel uses a structured knowledge constraint set as external knowledge for constraint enhancement, ensuring that the inference results output by the model conform to the domain knowledge and physical constraints of the power system.

[0041] The temporal inference channel is used to perform sequence modeling on the temporal features in the alarm cluster feature data structure to generate a temporally enhanced alarm evolution representation. This channel employs sequence modeling networks (such as Transformer, LSTM, etc.) to model the temporal features of the alarms, capturing the evolutionary patterns of alarm events over time.

[0042] During training, only some parameters of the base model are updated, while the remaining parameters are frozen to reduce training costs and prevent catastrophic forgetting. After training, the knowledge-enhanced alarm semantic representation and the temporally enhanced alarm evolution representation are fused across channels to obtain the fused inference result.

[0043] The cross-channel fusion adopts a gated fusion mechanism. The gated fusion mechanism dynamically calculates the fusion weight of the two channels based on the information entropy and confidence of the knowledge-enhanced alarm semantic representation and the time-enhanced alarm evolution representation, and performs weighted fusion of the representations of the two channels based on the fusion weight.

[0044] S6. Generation and confidence assessment of alarm analysis reports: Based on the fusion inference results, generate alarm analysis reports for the power system, assess the confidence of the alarm analysis reports, and output the confidence score corresponding to the alarm analysis reports.

[0045] The generation of power system alarm analysis reports includes: Based on the fusion reasoning results, identify the high-risk event types and risk levels corresponding to the alarm clusters; Call the preset alarm analysis report template and fill the corresponding fields of the report template with the high-risk event type, risk level, spatiotemporal distribution information of the alarm cluster, device association information and semantic aggregation information; The filled report is augmented with natural language generation to generate a structured alarm analysis report, which includes at least four parts: event overview, risk analysis, root cause inference, and handling recommendations.

[0046] The process includes: evaluating the confidence level of the alarm analysis report and outputting a confidence score for the alarm analysis report; and including: The first confidence component is calculated based on the distribution entropy of the probability of identifying high-risk event types in the fusion inference results. The more concentrated the probability distribution, the higher the certainty of the model in the identification results. The second confidence component is calculated based on the degree of matching between the root cause inference in the alarm analysis report and the historical fault patterns in the knowledge graph. The higher the degree of matching, the better the consistency between the reasoning result and the known fault patterns. The third confidence component is calculated based on the intra-cluster density and inter-cluster separation of the alarm clusters. The denser the intra-cluster density and the more separated the inter-cluster density, the higher the quality of the clustering results and the more reliable the basis for subsequent inference. The confidence score is obtained by weighting and fusing the first confidence component, the second confidence component, and the third confidence component.

[0047] In addition, this invention also establishes a closed-loop feedback optimization mechanism.

[0048] Based on the confidence scores of the alarm analysis reports and the results of manual review, the node weights, meta-path selection, and parameters of the large-scale power threat detection model in the heterogeneous information network are incrementally updated.

[0049] Specifically, when the confidence score falls below a preset threshold or when manual review reveals a deviation in the judgment result, an incremental update process is triggered: the manual review result is quantified into a supervisory signal, node weights are fine-tuned, the meta-path selection strategy is optimized, and large model parameters are incrementally trained. Through continuous feedback optimization, the system continuously improves itself in actual operation, enhancing the accuracy and robustness of alarm noise reduction and intelligent judgment.

[0050] This invention also provides a power system alarm noise reduction and intelligent judgment system based on a large model, comprising: The data acquisition and preprocessing module is used to acquire multi-source heterogeneous alarm data in the power system, preprocess the multi-source heterogeneous alarm data, and construct a preprocessed dataset. A heterogeneous information network construction and alarm clustering module is used to construct a heterogeneous information network based on the preprocessed dataset. The heterogeneous information network includes alarm nodes, device nodes, time nodes, and location nodes, as well as multi-dimensional semantic relationships between the nodes. Multiple meta-paths are defined on the heterogeneous information network. Multiple node sequences are generated by performing a biased random walk based on the multiple meta-paths. Each node sequence is semantically encoded to generate an alarm semantic vector. A multi-dimensional similarity is calculated between any two alarm semantic vectors. The multi-dimensional similarity includes semantic similarity, spatiotemporal similarity, and device topology similarity. The semantic similarity, spatiotemporal similarity, and device topology similarity are weighted and fused according to dynamic weights to obtain a comprehensive similarity. Based on the comprehensive similarity, the multiple node sequences are clustered to generate alarm clusters. The alarm cluster feature extraction module is used to extract the spatiotemporal distribution features, device association features and semantic aggregation features of each alarm cluster based on the alarm cluster, and generate an alarm cluster feature data structure. The large model construction and reasoning module is used to acquire the knowledge graph and historical alarm data of the power system. The knowledge graph is used as a structured knowledge constraint set and the historical alarm data is used as training corpus. A dual-channel architecture is adopted to construct and train a large power threat detection model. The dual-channel architecture includes a knowledge enhancement channel and a temporal reasoning channel. The alarm cluster feature data structure is input into the large power threat detection model for reasoning to obtain the fused reasoning result. The alarm analysis report generation module is used to generate an alarm analysis report for the power system based on the fusion inference results, evaluate the confidence level of the alarm analysis report, and output the confidence score corresponding to the alarm analysis report. The feedback optimization module is used to incrementally update the node weights, meta-path selection, and parameters of the power threat detection big model of the heterogeneous information network based on the confidence score of the alarm analysis report and the results of manual review.

[0051] Each module executes the corresponding steps in the above method, working together to complete the entire process from alarm data input to analysis report output: After the system starts up, the data acquisition and preprocessing module accesses the multi-source heterogeneous alarm data stream of the power system in real time, cleans, standardizes and completes the data, and constructs a preprocessed dataset.

[0052] The heterogeneous information network construction and alarm clustering module periodically reads data from the preprocessed dataset using a sliding time window as the unit, constructs a heterogeneous information network, and performs operations such as biased random walks, multi-dimensional similarity calculations, and dynamic weight adaptive clustering to generate alarm clusters.

[0053] The alarm cluster feature extraction module extracts spatiotemporal distribution features, device association features, and semantic aggregation features for each alarm cluster, generating alarm cluster feature data structure.

[0054] The large model building and inference module receives alarm cluster feature data structures, performs inference through a dual-channel architecture, and outputs fused inference results.

[0055] The alarm analysis report generation module generates a structured alarm analysis report based on the fusion reasoning results, performs a confidence assessment, and pushes the report to the dispatcher's terminal system.

[0056] The feedback optimization module continuously monitors the confidence score of the report and the results of manual review, and automatically executes the incremental update process when the trigger conditions are met.

[0057] The above modules work together to form a complete closed-loop process from alarm data input to analysis report output, enabling real-time noise reduction and intelligent analysis of massive alarm data in the power system.

Claims

1. A power system alarm noise reduction and intelligent judgment method based on a large model, characterized in that, Includes the following steps: S1. Obtain multi-source heterogeneous alarm data from the power system, preprocess the multi-source heterogeneous alarm data, and construct a preprocessed dataset; S2. Construct a heterogeneous information network based on the preprocessed dataset, and assign initial weights to each type of node and each type of edge in the heterogeneous information network. The heterogeneous information network includes alarm nodes, device nodes, time nodes, and location nodes, as well as multi-dimensional semantic relationships between the nodes. The multi-dimensional semantic relationships include at least the attribution relationship between alarms and devices, the temporal correlation relationship between alarms, and the spatial topological relationship between alarms. The initial weights are determined based on the importance of node types and the semantic strength of edge types. S3. Define multiple meta-paths on the heterogeneous information network, perform a biased random walk based on the multiple meta-paths to generate multiple node sequences, semantically encode each node sequence to generate an alarm semantic vector, calculate the multi-dimensional similarity between any two alarm semantic vectors, the multi-dimensional similarity includes semantic similarity, spatiotemporal similarity and device topology similarity, weight the semantic similarity, spatiotemporal similarity and device topology similarity according to dynamic weights to obtain a comprehensive similarity, the dynamic weights are adaptively adjusted according to the alarm scenario type, and cluster the multiple node sequences based on the comprehensive similarity to generate alarm clusters; S4. Based on the alarm clusters, extract the spatiotemporal distribution features, device association features, and semantic aggregation features of each alarm cluster to generate an alarm cluster feature data structure. S5. Obtain the knowledge graph and historical alarm data of the power system. Using the knowledge graph as a structured knowledge constraint set and the historical alarm data as training corpus, construct and train a large-scale power threat detection model using a dual-channel architecture. The dual-channel architecture includes a knowledge enhancement channel and a temporal reasoning channel. The knowledge enhancement channel is used to link and semantically align entities in the alarm cluster feature data structure with corresponding entities in the knowledge graph to generate knowledge-enhanced alarm semantic representations. The temporal reasoning channel is used to perform sequence modeling on the temporal features in the alarm cluster feature data structure to generate temporally enhanced alarm evolutionary representations. The knowledge-enhanced alarm semantic representations and the temporally enhanced alarm evolutionary representations are fused across channels to obtain a fusion reasoning result. S6. Based on the fusion reasoning results, generate an alarm assessment report for the power system, evaluate the confidence level of the alarm assessment report, and output the confidence score corresponding to the alarm assessment report.

2. The power system alarm noise reduction and intelligent judgment method based on a large model according to claim 1, characterized in that, The probability of selecting a walk path in the biased random walk in step S3 is dynamically adjusted based on the differences in meta-path type and node type, specifically including: Different walk preference weights are set for different types of metapaths; During the walk, the probability of the current node transitioning to each candidate node is determined by the degree of matching between the candidate node type and the type of the next node expected by the current meta-path, the degree of matching between the edge type between the candidate node and the current node and the edge type expected by the current meta-path, and the node importance weight of the candidate node itself.

3. The power system alarm noise reduction and intelligent judgment method based on a large model according to claim 1, characterized in that, The semantic similarity in step S3 is calculated based on the cosine distance between the two alarm semantic vectors. The spatiotemporal similarity is calculated based on the overlap rate of the time windows and the spatial distance between the two alarm clusters. The device topology similarity is calculated based on the shortest path distance and the number of common neighbor nodes of the device sets associated with the two alarm clusters in the power system topology graph. The dynamic weights are obtained from a preset weight mapping table based on the current alarm scenario type. The alarm scenario types include at least instantaneous fault scenarios, evolving fault scenarios, and network attack scenarios. The weight allocation of semantic similarity, spatiotemporal similarity, and device topology similarity differs under different alarm scenario types.

4. The power system alarm noise reduction and intelligent judgment method based on a large model according to claim 1, characterized in that, After clustering the multiple node sequences based on the comprehensive similarity to generate an alarm cluster in step S3, the method further includes: The clustering results are verified for intra-cluster compactness and inter-cluster separation. The average intra-cluster distance and minimum inter-cluster distance of each alarm cluster are calculated. If the average intra-cluster distance is greater than the first threshold or the minimum inter-cluster distance is less than the second threshold, the dynamic weights are adjusted and the clustering is performed again.

5. The power system alarm noise reduction and intelligent judgment method based on a large model according to claim 1, characterized in that, Step S4 includes: Extract the distribution range of alarm timestamps and the trend of alarm frequency changes within each alarm cluster, as well as the geographical area or power grid topology area involved in the alarms within each alarm cluster, as the spatiotemporal distribution characteristics. Extract the set of devices associated with alarms in each alarm cluster, as well as the topological connection relationship and electrical coupling relationship between the devices, as the device association feature; Extract the cluster center semantic vector and alarm type distribution statistical vector from each alarm cluster after the alarm text is encoded by the large model, and use them as the semantic aggregation features; The spatiotemporal distribution features, device association features, and semantic aggregation features are fused and encoded to generate a unified alarm cluster feature data structure.

6. The power system alarm noise reduction and intelligent judgment method based on a large model according to claim 1, characterized in that, Step S5, which uses the knowledge graph as a structured knowledge constraint set and the historical alarm data as training corpus to construct and train a large-scale power threat detection model using a dual-channel architecture, includes: Extract alarm text, alarm sequence, alarm handling records and fault attribution information from the historical alarm data to construct a training dataset; The topological relationships of power equipment, the association rules of equipment parameters, and historical fault modes are extracted from the knowledge graph to construct a structured knowledge constraint set; Based on a pre-trained large language model, the dual-channel architecture is constructed using a parameter-efficient fine-tuning strategy. During the fine-tuning process, the knowledge enhancement channel uses the structured knowledge constraint set as external knowledge for constraint enhancement, and the temporal reasoning channel uses a sequence modeling network to model temporal features. During training, only some parameters of the base model are updated, while the rest are frozen.

7. The power system alarm noise reduction and intelligent judgment method based on a large model according to claim 1, characterized in that, The cross-channel fusion in step S5 adopts a gated fusion mechanism. The gated fusion mechanism dynamically calculates the fusion weight of the two channels based on the information entropy and confidence of the knowledge-enhanced alarm semantic representation and the time-enhanced alarm evolution representation, and performs weighted fusion of the representations of the two channels based on the fusion weight.

8. The power system alarm noise reduction and intelligent judgment method based on a large model according to claim 1, characterized in that, The generation of the power system alarm analysis report in step S6 includes: Based on the fusion reasoning results, identify the high-risk event types and risk levels corresponding to the alarm clusters; Call the preset alarm analysis report template and fill the corresponding fields of the report template with the high-risk event type, risk level, spatiotemporal distribution information of the alarm cluster, device association information and semantic aggregation information; The filled report is augmented with natural language generation to generate a structured alarm analysis report, which includes at least four parts: event overview, risk analysis, root cause inference, and handling recommendations.

9. The power system alarm noise reduction and intelligent judgment method based on a large model according to claim 1, characterized in that, Step S6, which involves evaluating the confidence level of the alarm analysis report and outputting a confidence score corresponding to the alarm analysis report, includes: The first confidence component is calculated based on the distribution entropy of the probability of identifying high-risk event types in the fusion inference results; The second confidence component is calculated based on the degree of matching between the root cause inference in the alarm analysis report and the historical fault patterns in the knowledge graph; The third confidence component is calculated based on the intra-cluster density and inter-cluster separation of the alarm clusters; The confidence score is obtained by weighting and fusing the first confidence component, the second confidence component, and the third confidence component.

10. A power system alarm noise reduction and intelligent judgment system based on a large model, characterized in that, include: The data acquisition and preprocessing module is used to acquire multi-source heterogeneous alarm data in the power system, preprocess the multi-source heterogeneous alarm data, and construct a preprocessed dataset. A heterogeneous information network construction and alarm clustering module is used to construct a heterogeneous information network based on the preprocessed dataset. The heterogeneous information network includes alarm nodes, device nodes, time nodes, and location nodes, as well as multi-dimensional semantic relationships between the nodes. Multiple meta-paths are defined on the heterogeneous information network. Multiple node sequences are generated by performing a biased random walk based on the multiple meta-paths. Each node sequence is semantically encoded to generate an alarm semantic vector. A multi-dimensional similarity is calculated between any two alarm semantic vectors. The multi-dimensional similarity includes semantic similarity, spatiotemporal similarity, and device topology similarity. The semantic similarity, spatiotemporal similarity, and device topology similarity are weighted and fused according to dynamic weights to obtain a comprehensive similarity. Based on the comprehensive similarity, the multiple node sequences are clustered to generate alarm clusters. The alarm cluster feature extraction module is used to extract the spatiotemporal distribution features, device association features and semantic aggregation features of each alarm cluster based on the alarm cluster, and generate an alarm cluster feature data structure. The large model construction and reasoning module is used to acquire the knowledge graph and historical alarm data of the power system. The knowledge graph is used as a structured knowledge constraint set and the historical alarm data is used as training corpus. A dual-channel architecture is adopted to construct and train a large power threat detection model. The dual-channel architecture includes a knowledge enhancement channel and a temporal reasoning channel. The alarm cluster feature data structure is input into the large power threat detection model for reasoning to obtain the fused reasoning result. The alarm analysis report generation module is used to generate an alarm analysis report for the power system based on the fusion inference results, evaluate the confidence level of the alarm analysis report, and output the confidence score corresponding to the alarm analysis report. The feedback optimization module is used to incrementally update the node weights, meta-path selection, and parameters of the power threat detection big model of the heterogeneous information network based on the confidence score of the alarm analysis report and the results of manual review.

Images