Cyber-physical system cyber-physical system network-chain data anomaly root cause tracing self-optimization method, device and medium

Abstract

The application discloses a cyber-chain data anomaly root cause tracing self-optimization method and device of an information physical system and a medium, obtains multi-source operation data, extracts a cyber-chain evidence vector, constructs a cyber-chain correlation matrix, maps the cyber-chain evidence vector to a cyber-chain root cause prior of an anomaly root cause category based on the cyber-chain correlation matrix, inputs data into a heterogeneous sub-model, fuses prediction probabilities according to category differences, outputs a tracing result, obtains user feedback to form a real label and backflow, constructs a compound loss based on category balance cross-entropy and cyber-chain consistency constraints during periodic retraining, modulates a differentiable sub-model gradient according to the conflict degree of the prediction probability and the prior, updates the sub-model under the supervision of the real label, updates the fusion weight according to the category-model reliability and the last round weight stability constraint, deploys after verification, and maintains the original configuration otherwise. The application realizes double-level sequential cooperation under the constraint of cyber-chain evidence, and makes the tracing result self-optimized with feedback.

Description

Technical Field

[0001] This invention relates to the field of data anomaly diagnosis and intelligent optimization technology for power cyber-physical systems, specifically to a self-optimizing method, device, and medium for tracing the root causes of network-chain data anomalies in cyber-physical systems. Background Technology

[0002] With the continuous improvement of new power system construction and information collection capabilities, the scale of user-side measurement data, equipment operation data, communication status data, master station business data, archival data, environmental data, and load behavior data is constantly growing, becoming an important foundation for supporting power grid operation management, energy consumption analysis, and digital operation and maintenance. In actual operation, due to factors such as equipment operating conditions, communication status, master station processing, and business system coupling, problems such as abnormal data formats, timing mismatches, and inconsistent performance across links may occur. Accurately identifying anomalies and tracing their root causes is a key step in improving data availability and reducing the risk of misjudgments and omissions.

[0003] From the perspective of a cyber-physical system (CPS), multi-source operational data flows along the link of "intelligent measurement—local and remote communication—master station processing—business application": the impact of anomalies is network-like and propagates on the communication and information system side, and exhibits chain-like transmission and temporal evolution driven by the physical equipment status and external factors. The coupling of the two forms a network-chain-like anomaly propagation characteristic. Therefore, the root causes of anomalies usually have the characteristics of multiple factors superimposed, cross-link propagation, and blurred category boundaries.

[0004] The current state of research and its limitations are as follows: Knowledge-driven approaches: In early and current engineering practices, expert thresholds, fault trees, rule bases, and prior constraints are widely used for anomaly identification and root cause analysis. These methods offer interpretable conclusions and auditable processes, but as system size increases and the operating environment changes, rule maintenance costs rise continuously, and their ability to extrapolate to strongly coupled, long-tailed new anomaly patterns is limited.

[0005] Single-model data-driven methods, such as root cause analysis based on statistics, information theory, or single deep learning models, have gradually developed and can reduce reliance on manual rules to some extent. However, electricity consumption data simultaneously contains multimodal characteristics such as time series, topology, structured business data, and meteorological data. Single-path models have limited ability to comprehensively characterize strongly nonlinear and multimodal information. They also struggle to systematically reflect the complex interconnected structures under network-chain propagation.

[0006] Multi-model fusion methods: To accommodate different data formats, engineering practices are increasingly adopting a method of parallel inference using multiple base models, followed by fusion to output multi-class root cause results. Base models can include various types such as time-series deep models, tabular feature models, graph structure models, rule-based or knowledge models. These different models often have complementary advantages across different root cause categories, making multi-model fusion an important technical direction in this field.

[0007] The continuous update method during operation: It alleviates the changes in data distribution by predicting data entry, feedback collection, tag return, and periodic retraining. However, it usually still uses ordinary cross-entropy and general optimizer to update differentiable models. It does not convert network-chain evidence such as physical devices, communication links, main station services, archives, environment, and load behavior into training constraints, and it also lacks clear constraints on the relationship between the output after sub-model update and the order of fusion weight adjustment. Summary of the Invention

[0008] The technical problem to be solved by this invention: (1) In view of the problem that although multiple sources of operational evidence, such as physical equipment, communication links, main station services, archives, environment and load behavior, jointly affect the judgment of abnormal root causes, existing methods do not organize them into a unified computable network-chain data object. This invention aims to solve how to construct network-chain evidence vectors and form abnormal root cause priors.

[0009] (2) In view of the characteristics of small batch and class imbalance in periodic backflow data, conventional multi-class cross-entropy does not distinguish the sample size of different classes, nor does it constrain the consistency between model prediction and electrical network-chain evidence. This invention aims to solve how to enable network-chain evidence and class distribution to jointly participate in the training objective of the differential model.

[0010] (3) In view of the problem that the standard adaptive optimization method directly uses the classification loss gradient without adjusting the sample update contribution according to the degree of conflict between the prediction result and the network-chain root cause prior, the present invention aims to solve how to perform scenario-based modulation of the sample gradient before entering the adaptive moment estimation process.

[0011] (4) In view of the problem that the existing category-differentiated fusion weights are updated only based on the classification loss of the current batch, it is difficult to reflect the classification reliability of each sub-model at the same time, and may deviate from the stable production configuration of the previous round under small batch feedback, the present invention aims to solve how to use category-model reliability and deployed configuration to jointly constrain the fusion weight update.

[0012] (5) In view of the unclear real data dependency relationship between sub-model parameter update and fusion strategy adjustment, as well as the lack of candidate configuration verification, deployment, manual coverage and rollback mechanism, this invention aims to establish a two-level sequential collaborative mechanism of updating the sub-model first and then updating the fusion weight, and make the candidate results verifiable, conditionally deployable and rollbackable.

[0013] To address the aforementioned problems in existing technologies, a self-optimizing method, apparatus, and medium for tracing the root causes of data anomalies in cyber-physical systems using a network-chain approach are provided. This approach ensures that both sub-model training and fusion weight configuration are constrained by network-chain evidence and are continuously optimized based on operational feedback, with sub-model updates preceding fusion weight adaptation.

[0014] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: In a first aspect, the present invention proposes a self-optimizing method for tracing the root causes of data anomalies in a network-chain-based cyber-physical system, comprising the following steps: Acquire multi-source operational data of cyber-physical systems, extract evidence features from the multi-source operational data to obtain network-chain evidence vectors, and construct network-chain correlation matrices based on the correlation between the evidence features and anomaly root cause categories; The multi-source operating data is input into multiple heterogeneous sub-models containing differentiable sub-models to predict the root causes of anomalies, and the prediction probability of each sub-model is obtained. The prediction probabilities are weighted and fused through a category-differentiated fusion weight parameter matrix to obtain the fused prediction result and output it. Obtain user feedback on the fusion prediction results to determine the true labels. Associate and store the true labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results to obtain the corresponding records. Add the records that meet the backflow conditions as backflow samples to the training label dataset. When the training label dataset meets the periodic retraining condition, backflow samples are extracted from the training label dataset, and the backflow samples are input into the differentiable model to obtain the predicted probability of the differentiable model. The network-chain root cause prior vector is calculated based on the network-chain evidence vector and network-chain association matrix corresponding to the backflow samples. The network-chain consistency loss is calculated based on the difference between the network-chain root cause prior corresponding to the backflow samples and the predicted probability of the differentiable model. The class-balanced cross-entropy loss is calculated based on the true label corresponding to the backflow samples. The class-balanced cross-entropy loss and the network-chain consistency loss are combined into the network-chain consistency composite loss. The network parameters of the differentiable model are updated with gradients based on the network-chain consistency composite loss. The network parameters of the differentiable sub-model are fixed and the predicted probabilities of each sub-model are reacquired. The category-model reliability matrix is ​​determined based on the reacquired predicted probabilities and the true labels. The category-model reliability matrix and the stability constraints relative to the previously deployed fusion weight configuration are used to update the category-differentiated fusion weight parameter matrix to obtain the updated fusion weight configuration. Deploy the updated network parameters and fusion weight configuration for the differentiable model.

[0015] Furthermore, the multi-source operational data includes physical equipment status data, communication link status data, main station service processing status data, archive data, environmental factor data, and load behavior status data. Extracting evidence features from the multi-source operational data to obtain the network-link evidence vector includes the following steps: For the same abnormal event, the multi-source runtime data is time-aligned and object-associated; From the multi-source operational data after time alignment and object association, evidential features characterizing the physical equipment status, communication link status, main station business processing status, file consistency, environmental factors, and load behavior status are extracted respectively. Among them, the evidential features characterizing the physical equipment status include at least voltage deviation rate, current imbalance, power fluctuation amplitude, power factor deviation, and data missing rate; the evidential features characterizing the communication link status include at least terminal online rate, acquisition success rate, mean signal strength, communication latency, and packet loss rate; the evidential features characterizing the main station business processing status include at least interface call success rate, task queue backlog, data processing anomaly rate, and system response latency; the evidential features characterizing file consistency include at least file matching identifier, parameter configuration deviation, and household transformer relationship consistency; the evidential features characterizing environmental factors include at least temperature deviation, humidity, precipitation, and comprehensive meteorological index; and the evidential features characterizing load behavior status include at least load fluctuation coefficient, load factor, peak-valley difference rate, and deviation from historical data. State encoding is performed on various types of evidence features to convert non-numerical features into numerical representations; numerical normalization is performed on the state-encoded evidence features to map the feature values ​​of each dimension to the [0,1] interval; the normalized evidence features are concatenated in a fixed order to form a fixed-length feature vector, which serves as the network-chain evidence vector.

[0016] Furthermore, the heterogeneous sub-model includes an expert rule sub-model. The expert rule sub-model outputs a deterministic class determination result and corresponding confidence score through rule matching. It sets the confidence score of classes that do not match the rules to 0, and normalizes the confidence scores of all classes using the Softmax function, transforming them into a probability distribution with the same dimensions as the differentiable sub-model. The normalization formula is as follows:

[0017] In the formula, This indicates that the expert rule sub-model determines that the input data belongs to the first... The probability of each abnormal root cause category. This represents the abnormal root cause category number. C This represents the total number of abnormal root cause categories. s i For the first i Confidence scores for each category of abnormal root causes. k For summation index variables, >0 represents the temperature coefficient.

[0018] Furthermore, before associating and storing the real labels with the corresponding multi-source operational data, network-chain evidence vectors, prediction probabilities, and fusion prediction results, the method further includes: initializing self-optimizing extension fields, which include a real category field, a feedback type field, a return flow identifier field, and a network-chain evidence field. The real category field is initially empty, the feedback type field is initially set to no feedback, the return flow identifier field is initially set to no return flow, and the network-chain evidence field is used to store the network-chain evidence vectors corresponding to the fusion prediction results. When storing the real labels in association with the corresponding multi-source operational data, network-chain evidence vectors, prediction probabilities, and fusion prediction results, the real labels determined by manual feedback are written into the real category field, the corresponding network-chain evidence vectors are written into the network-chain evidence field, and the feedback type field is updated to "feedback received". When adding records that meet the reflow conditions to the training label dataset as reflow samples, the specific process involves selecting valid records from those whose feedback type field is "feedback has been received" and whose reflow identifier field is "not reflowed". The real labels of the valid records and their associated multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results are added to the training label dataset, and the corresponding reflow identifier field is updated to "reflowed" to prevent duplicate reflow.

[0019] Furthermore, when constructing the network-chain correlation matrix based on the correlation between the evidence features and the abnormal root cause categories, the process includes: based on the experience of experts in the power system field, determining the degree of correlation between each evidence feature and each abnormal root cause category, wherein the degree of correlation is divided into three levels: strong correlation, weak correlation, and no correlation, and each level is assigned a corresponding integer value; filling the corresponding positions of the matrix with the assigned degree of correlation to obtain an initial integer matrix; and normalizing each column of the initial integer matrix so that the sum of the elements in each column is 1, thereby obtaining the network-chain correlation matrix. Before calculating the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the returned samples, the method further includes: using the returned samples to statistically analyze the actual distribution of each evidence feature under different abnormal root cause categories, and updating the matrix elements of the network-chain association matrix in a moving average manner, as shown in the following mathematical expression:

[0020] In the formula, These are the matrix element values ​​before the update. The updated matrix element values, For learning rate, f ji Based on the statistics of recent feedback samples, the firstj The evidence feature in the first Standardized contribution frequency in class samples.

[0021] Furthermore, after extracting the recurrent samples from the training label dataset, the method further includes: adding the recurrent samples to the periodic retraining dataset; and calculating the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the recurrent samples, including: The network-chain evidence vectors of the backflow samples in the periodic retraining dataset are mapped to each anomaly root cause category using the network-chain correlation matrix, and then normalized to obtain the corresponding network-chain root cause prior vectors. The mathematical expression is as follows:

[0022] In the above formula, Indicates reflux sample s The network-chain evidence vector, This represents the transpose of the network-chain correlation matrix A. Indicates reflux sample s The network-chain root cause prior vector, softmax(·) denotes the normalized exponential function.

[0023] Furthermore, when calculating the category-balanced cross-entropy loss based on the true labels corresponding to the returned samples, the following steps are included: Based on the number of backflow samples for each anomaly root cause category in the periodic retraining dataset, the corresponding category balance weights are calculated, and the mathematical expression is as follows:

[0024] In the above formula, C represents the total number of abnormal root cause categories. i and r These represent the anomaly root cause category number and the category summation index, respectively. and These respectively indicate that the real label belongs to the first... i Class and First r The number of training samples for each class Indicates the first i Class category balancing weights, δ >0 indicates a smoothing constant for the number of samples in each category. γ ∈[0,1] represents the class imbalance adjustment coefficient; For any differentiable model, the class-balanced cross-entropy loss is calculated based on the true labels of the returned samples, the predicted probabilities output by the differentiable model, and the class-balanced weights. The mathematical expression is as follows:

[0025] In the above formula, This represents the category-balanced cross-entropy loss. ε >0 represents the numerical stability constant, and ln represents the natural logarithm. Indicates reflux sample s The true label one-hot encoding corresponds to the first i Class components, Let represent the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

[0026] Furthermore, when calculating the network-chain consistency loss based on the difference between the network-chain root cause prior vector corresponding to the returned sample and the predicted probability of the differentiable model, the mathematical expression is as follows:

[0027] In the above formula, This indicates network-chain consistency loss. ε >0 indicates the numerical stability constant, and C represents the total number of abnormal root cause categories. The first term represents the first root cause prior vector of the network-chain. i Each category component Let represent the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

[0028] Furthermore, the category-balanced cross-entropy loss and the network-chain consistency loss are combined into a network-chain consistency composite loss. When updating the network parameters of the differentiable model using the network-chain consistency composite loss, the following steps are taken: The corresponding network-chain root cause prior vector is obtained. The class-balanced cross-entropy loss and the network-chain consistency loss are then weighted and combined to obtain the network-chain consistency composite loss corresponding to the differentiable submodel. The mathematical expression is as follows:

[0029] In the above formula, , and These represent the category-balanced cross-entropy loss, the network-chain consistency loss, and the network-chain consistency composite loss, respectively. λ ≥0 indicates the network-chain consistency constraint coefficient; Calculate the average network-chain consistency loss of each reflow sample within the current training batch, and determine the corresponding conflict modulation coefficient based on the deviation of the network-chain consistency loss of each reflow sample from the average value. The mathematical expression is as follows:

[0030]

[0031] In the above formula, B represents the average network-chain consistency loss of the current training batch; B represents the number of reflow samples in the current training batch. u This represents the summation index of samples within the current training batch. Indicates reflux sample s Corresponding Differentiable Model j The conflict modulation coefficients, and These represent the lower and upper limits of the collision modulation coefficient, respectively. clip(x,a,b) means restricting x to between the lower limit a and the upper limit b. κ ≥0 indicates the collision modulation intensity coefficient; The gradient of the network-chain consensus composite loss of each return sample with respect to the network parameters of the differentiable model is modulated and summarized using the conflict modulation coefficient to obtain the conflict-modulated batch gradient, the mathematical expression of which is as follows:

[0032] In the above formula, Representing the model of the three-dimensional particle j Network parameters, Indicates to Find the gradient. Indicates the first t The conflict-modulated batch gradient used for secondary parameter updates; The conflict-modulated batch gradient is input into the adaptive moment estimation process to update the first-order moment estimate and the second-order moment estimate. After bias correction, the update amount of each dimension of the network parameters of the differentiable model is determined. Specifically, if the differentiable model is a deep pyramid convolutional network, the weights of the deep pyramid convolutional layer, the parameters of the region embedding layer, and the parameters of the fully connected classification layer are updated. If the differentiable model is a graph neural network, the weights of the graph message passing layer, the attention coefficient, the parameters of the graph pooling layer, and the parameters of the node classification layer are updated.

[0033] Furthermore, after fixing the updated network parameters of the differentiable sub-models and re-acquiring the predicted probabilities of each sub-model, the process also includes: replacing the predicted probabilities of the corresponding backflow samples with the re-acquiring predicted probabilities and adding them to the weight optimization training set; when determining the category-model reliability matrix based on the re-acquiring predicted probabilities and the true labels, the process includes: The fusion ratio matrix is ​​obtained by performing Softmax normalization row by row on the category-differentiated fusion weight parameter matrix. The fusion score is calculated based on the prediction probability of each sub-model under the same anomaly root cause category. Then, the fusion score of all anomaly root cause categories is normalized to obtain the fusion prediction probability, as shown in the following formula:

[0034]

[0035]

[0036] In the above formula, Indicates the return sample All The fusion prediction probability is obtained by normalizing the fusion scores of each category again. Represents the numerical stability constant. Indicates the sequence number of the returned sample. This indicates that after fixing the state of the current wheel model, the first... Sub-models for refluxed samples Belongs to the The predicted probability of the class output; Indicates reflux sample Corresponding to the Fusion score of the root cause of the anomaly This represents the category-differentiated fusion weight parameter matrix. The fusion ratio matrix obtained by performing Softmax normalization row by row The Middle Line number Column elements, This represents the natural exponential function. Represents the category differentiation fusion weight parameter matrix The Middle Line number Column elements, Represents the numerical stability constant; For weight optimization, the true label in the training set is the [i]. i Number of reflux samples for each abnormal root cause category In this case, the corresponding row of the category-model reliability matrix that has been validated and deployed in the previous round will be used, and the automatic update of the fusion weight parameters corresponding to the root cause category of the anomaly will be stopped; for the weight optimization training set where the true label is the first... i Number of reflux samples for each abnormal root cause category In this case, the category-model reliability matrix is ​​calculated based on the average predicted probability of the true category output and normalized row by row, as shown in the following formula:

[0037] In the above formula, Indicates the first Each sub-model in the real category is The average predicted probability of the true class output on the returned samples; Indicates to The category-model reliability matrix obtained by row-by-row normalization The category-model reliability matrix represents the first... Line number Column elements, summation condition This indicates that it only applies to the true category. Summing of the refluxed samples.

[0038] Furthermore, when updating the category-differentiated fusion weight parameter matrix to obtain the updated fusion weight configuration based on the category-model reliability matrix and the stability constraints relative to the previously deployed fusion weight configuration, the process includes: Using real labels as supervision, the composite loss of network-chain consistency in the fusion layer is determined based on the fusion prediction probability and the network-chain root cause prior, as shown in the following formula:

[0039] In the above formula, This indicates the total number of samples in the training set for weight optimization. Indicates the fusion layer number 1 The class balance weights of the abnormal root causes are determined by the number of class samples in the weight optimization training set using the class balance weight calculation method. Indicates sample The true label one-hot encoding corresponds to the first The components of the class, the real category is Time to take Otherwise take ; Indicates the probability of fusion prediction; Indicates sample The first in the network-chain root cause prior vector The component corresponding to the class; This represents the network-chain consistency constraint coefficient of the fusion layer, used to adjust the contribution of consistency loss to the composite loss of the fusion layer; Represents the natural logarithm; Represents the numerical stability constant; The fusion weight optimization loss is calculated by combining the network-chain consistency composite loss of the fusion layer, the deviation between the fusion ratio matrix and the normalized category-model reliability matrix, and the change of the fusion ratio matrix relative to the fusion ratio matrix that has been validated and deployed in the previous round. The mathematical expression is as follows:

[0040] In the above formula, This represents the composite loss of network-chain consistency in the fusion layer; This represents the fusion ratio matrix for this round; This represents the category-model reliability matrix after row-by-row normalization. This represents the fusion ratio matrix that has been validated and deployed in the previous round; This represents the reliability guidance constraint coefficient, used to adjust the degree to which the fusion scaling matrix approaches the normalized reliability matrix; This represents the configuration stability constraint coefficient, used to adjust the degree of change in the fusion ratio matrix relative to the previous round of deployed configurations; denoted by Frobenius norm, whose square is the sum of the squares of all elements of the matrix; The category-differentiated fusion weight parameter matrix is ​​updated by gradient based on the fusion weight optimization loss to obtain the updated fusion weight configuration.

[0041] Furthermore, when updating the category-differentiated fusion weight parameter matrix using the fusion weight optimization loss, the following steps are included: Based on the elements in the category-differentiated fusion weight parameter matrix that have been manually covered, and the abnormal root cause categories not covered by the reflow samples used for training in this round, a locking mask with the same dimension as the category-differentiated fusion weight parameter matrix is ​​generated. M The matrix elements that are allowed to update automatically have a mask value of 1, while the matrix elements that are not allowed to update automatically have a mask value of 0. The gradient of the fusion weight optimization loss with respect to the category-differentiated fusion weight parameter matrix is ​​calculated. This gradient is then multiplied element-wise by the locking mask to obtain the controlled fusion weight gradient, as shown in the following formula:

[0042] In the above formula, Indicates a lock mask. This indicates that the corresponding [condition] is allowed. Automatic updates This indicates that the parameter should remain unchanged; This represents element-wise multiplication of matrices; Indicates the loss of fusion weight optimization Regarding the category-differentiated fusion weight parameter matrix gradient, Indicates using the matrix before update Calculate and lock-mask-constrained controlled fusion weight gradients; The controlled fusion weight gradient is input into the adaptive moment estimation process. After moment estimation and bias correction, the unlocked fusion weight parameters are updated, while keeping the manually configured values ​​or previously deployed configuration values ​​corresponding to the locked elements unchanged. The formula is as follows:

[0043] In the above formula, and These represent the fusion weight parameter matrices before and after this iteration, respectively. Indicates the learning rate of the fusion weights; and They represent according to Calculate and estimate the first and second moments after bias correction; This represents the numerical stability constant that prevents the denominator of the update expression from becoming zero; Upon receiving a manual weight coverage instruction, the matrix element to be locked is determined according to the abnormal root cause category and sub-model specified by the manual weight coverage instruction. The matrix element to be locked is set to the manual configuration value, and the corresponding element in the locking mask is set to 0, so that the matrix element to be locked maintains the manual configuration value in the subsequent automatic optimization process. Upon receiving a delock instruction, the corresponding element in the locking mask is restored to 1.

[0044] Furthermore, when deploying the updated network parameters and fusion weight configuration for the differentiable submodel, the following should be included: The updated differential model network parameters and fusion weight configuration are jointly verified. The joint verification includes calculating the overall accuracy, network-chain inconsistency rate, and fusion weight change. When the verification results meet the preset deployment conditions, the updated differential model network parameters and fusion weight configuration are jointly deployed; otherwise, the differential model network parameters and fusion weight configuration deployed in the previous round are maintained.

[0045] Furthermore, when the verification results meet the preset deployment conditions, specifically, the following conditions must be met simultaneously: The overall accuracy of the candidate configuration is no less than the overall accuracy of the configuration deployed in the previous round on the same validation set; The macro average F1 of the candidate configuration is not lower than the preset threshold, or the recall rate of all pre-specified key categories is not lower than the corresponding preset threshold. The network-chain inconsistency rate of the candidate configuration does not exceed the preset upper limit; The maximum row change of the candidate fusion ratio matrix relative to the fusion ratio matrix deployed in the previous round does not exceed a preset safety threshold.

[0046] Furthermore, it also includes: initializing the category differentiation fusion weight parameter matrix, specifically setting each element in the same row of the category differentiation fusion weight parameter matrix to the same initial value so that the initial fusion ratio of each sub-model corresponding to the same abnormal root cause category is the same; or, if there is a category differentiation fusion weight parameter matrix that has been verified and deployed in the previous round, the category differentiation fusion weight parameter matrix that has been verified and deployed in the previous round is used as the initial value for this round.

[0047] Secondly, this invention proposes a network-chain-based data anomaly root cause tracing self-optimization device for cyber-physical systems, comprising: The data acquisition unit is used to acquire multi-source operational data of the cyber-physical system, extract evidence features from the multi-source operational data to obtain a network-chain evidence vector, and construct a network-chain correlation matrix based on the correlation between the evidence features and the anomaly root cause category. An anomaly root cause prediction unit is used to input the multi-source running data into multiple heterogeneous sub-models containing differentiable sub-models to predict anomalies root causes, obtain the prediction probability of each sub-model, and perform weighted fusion of the prediction probabilities through a category-differentiated fusion weight parameter matrix to obtain a fusion prediction result. The training label dataset construction unit is used to obtain user feedback on the fusion prediction results to determine the real labels, associate and store the real labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results to obtain the corresponding records, and add the records that meet the backflow conditions as backflow samples to the training label dataset. The differentiable model parameter update unit is used to extract backflow samples from the training label dataset when the training label dataset meets the periodic retraining condition, input the backflow samples into the differentiable model to obtain the predicted probability of the differentiable model, calculate the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the backflow samples, calculate the network-chain consistency loss based on the difference between the network-chain root cause prior vector corresponding to the backflow samples and the predicted probability of the differentiable model, calculate the class-balanced cross-entropy loss based on the true label corresponding to the backflow samples, combine the class-balanced cross-entropy loss and the network-chain consistency loss into a network-chain consistency composite loss, and perform gradient updates on the network parameters of the differentiable model based on the network-chain consistency composite loss. The fusion weight configuration update unit is used to fix the updated differentiable sub-model network parameters and reacquire the prediction probabilities of each sub-model. Based on the reacquired prediction probabilities and the true labels, the class-model reliability matrix is ​​determined. Based on the class-model reliability matrix and the stability constraints relative to the fusion weight configuration deployed in the previous round, the class-differentiated fusion weight parameter matrix is ​​updated to obtain the updated fusion weight configuration. Update the deployment unit to deploy the updated network parameters and fusion weight configuration of the differentiable submodel.

[0048] Furthermore, the multi-source operational data includes physical equipment status data, communication link status data, main station service processing status data, archive data, environmental factor data, and load behavior status data. When the data acquisition unit extracts evidence features from the multi-source operational data to obtain the network-link evidence vector, it includes the following steps: For the same abnormal event, the multi-source runtime data is time-aligned and object-associated; From the multi-source operational data after time alignment and object association, evidential features characterizing the physical equipment status, communication link status, main station business processing status, file consistency, environmental factors, and load behavior status are extracted respectively. Among them, the evidential features characterizing the physical equipment status include at least voltage deviation rate, current imbalance, power fluctuation amplitude, power factor deviation, and data missing rate; the evidential features characterizing the communication link status include at least terminal online rate, acquisition success rate, mean signal strength, communication latency, and packet loss rate; the evidential features characterizing the main station business processing status include at least interface call success rate, task queue backlog, data processing anomaly rate, and system response latency; the evidential features characterizing file consistency include at least file matching identifier, parameter configuration deviation, and household transformer relationship consistency; the evidential features characterizing environmental factors include at least temperature deviation, humidity, precipitation, and comprehensive meteorological index; and the evidential features characterizing load behavior status include at least load fluctuation coefficient, load factor, peak-valley difference rate, and deviation from historical data. State encoding is performed on various types of evidence features to convert non-numerical features into numerical representations; numerical normalization is performed on the state-encoded evidence features to map the feature values ​​of each dimension to the [0,1] interval; the normalized evidence features are concatenated in a fixed order to form a fixed-length feature vector, which serves as the network-chain evidence vector.

[0049] Furthermore, the heterogeneous sub-model includes an expert rule sub-model. The expert rule sub-model outputs a deterministic class determination result and corresponding confidence score through rule matching. It sets the confidence score of classes that do not match the rules to 0, and normalizes the confidence scores of all classes using the Softmax function, transforming them into a probability distribution with the same dimensions as the differentiable sub-model. The normalization formula is as follows:

[0050] In the formula, This indicates that the expert rule sub-model determines that the input data belongs to the first... The probability of each abnormal root cause category. This represents the abnormal root cause category number. C This represents the total number of abnormal root cause categories. s i For the first i Confidence scores for each category of abnormal root causes. k For summation index variables, >0 represents the temperature coefficient.

[0051] Furthermore, before the training label dataset construction unit associates and stores the real labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities, and fusion prediction results, it also includes: initializing self-optimizing extension fields, which include a real category field, a feedback type field, a return flow identifier field, and a network-chain evidence field. The real category field is initially empty, the feedback type field is initially set to no feedback, the return flow identifier field is initially set to no return flow, and the network-chain evidence field is used to store the network-chain evidence vectors corresponding to the fusion prediction results. When the training label dataset construction unit associates and stores the real labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results, it specifically writes the real labels determined by manual feedback into the real category field, writes the corresponding network-chain evidence vectors into the network-chain evidence field, and updates the feedback type field to "feedback received". When the training label dataset construction unit adds records that meet the reflow conditions as reflow samples to the training label dataset, it specifically selects valid records from those whose feedback type field is "feedback has been received" and whose reflow identifier field is "not reflowed". The unit then adds the real label of the valid record and its associated multi-source running data, network-chain evidence vector, prediction probability and fusion prediction result to the training label dataset, and updates the corresponding reflow identifier field to "reflowed" to prevent duplicate reflow.

[0052] Furthermore, when the data acquisition unit constructs the network-chain correlation matrix based on the correlation between the evidence features and the abnormal root cause categories, it includes: determining the degree of correlation between each evidence feature and each abnormal root cause category based on the experience of experts in the power system field, wherein the degree of correlation is divided into three levels: strong correlation, weak correlation, and no correlation, and each level is assigned a corresponding integer value; filling the corresponding positions of the matrix with the correlation degree values ​​to obtain an initial integer matrix; and normalizing each column of the initial integer matrix so that the sum of the elements in each column is 1, thereby obtaining the network-chain correlation matrix. Before the differentiable submodel parameter update unit calculates the network-chain root cause prior vector based on the network-chain evidence vector and network-chain correlation matrix corresponding to the backflow samples, it further includes: using the backflow samples to statistically analyze the actual distribution of each evidence feature under different abnormal root cause categories, and updating the matrix elements of the network-chain correlation matrix in a moving average manner, as shown in the following mathematical expression:

[0053] In the formula, These are the matrix element values ​​before the update. The updated matrix element values, For learning rate, f jiBased on the statistics of recent feedback samples, the first j The evidence feature in the first Standardized contribution frequency in class samples.

[0054] Furthermore, after the differentiable model parameter update unit extracts the recurrent samples from the training label dataset, it also adds the recurrent samples to the periodic retraining dataset; when the differentiable model parameter update unit calculates the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the recurrent samples, it includes: The network-chain evidence vectors of the backflow samples in the periodic retraining dataset are mapped to each anomaly root cause category using the network-chain correlation matrix, and then normalized to obtain the corresponding network-chain root cause prior vectors. The mathematical expression is as follows:

[0055] In the above formula, Indicates reflux sample s The network-chain evidence vector, This represents the transpose of the network-chain correlation matrix A. Indicates reflux sample s The network-chain root cause prior vector, softmax(·) denotes the normalized exponential function.

[0056] Furthermore, when the differentiable model parameter update unit calculates the class-balanced cross-entropy loss based on the true labels corresponding to the returned samples, it includes: Based on the number of backflow samples for each anomaly root cause category in the periodic retraining dataset, the corresponding category balance weights are calculated, and the mathematical expression is as follows:

[0057] In the above formula, C represents the total number of abnormal root cause categories. i and r These represent the anomaly root cause category number and the category summation index, respectively. and These respectively indicate that the real label belongs to the first... i Class and First r The number of training samples for each class Indicates the first i Class category balancing weights, δ >0 indicates a smoothing constant for the number of samples in each category. γ ∈[0,1] represents the class imbalance adjustment coefficient; For any differentiable model, the class-balanced cross-entropy loss is calculated based on the true labels of the returned samples, the predicted probabilities output by the differentiable model, and the class-balanced weights. The mathematical expression is as follows:

[0058] In the above formula, This represents the category-balanced cross-entropy loss. ε >0 represents the numerical stability constant, and ln represents the natural logarithm. Indicates reflux sample s The true label one-hot encoding corresponds to the first i Class components, Let represent the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

[0059] Furthermore, when the differentiable model parameter update unit calculates the network-chain consistency loss based on the difference between the network-chain root cause prior vector corresponding to the backflow sample and the predicted probability of the differentiable model, the mathematical expression is as follows:

[0060] In the above formula, This indicates network-chain consistency loss. ε >0 indicates the numerical stability constant, and C represents the total number of abnormal root cause categories. The first term represents the first root cause prior vector of the network-chain. i Each category component Let represent the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

[0061] Furthermore, the differentiable submodel parameter update unit combines the class-balanced cross-entropy loss and the network-chain consistency loss into a network-chain consistency composite loss. When updating the network parameters of the differentiable submodel using the network-chain consistency composite loss, it includes: The weighted combination of the category-balanced cross-entropy loss and the network-chain consistency loss yields the network-chain consistency composite loss corresponding to the differentiable submodel, as expressed mathematically below:

[0062] In the above formula, , and These represent the category-balanced cross-entropy loss, the network-chain consistency loss, and the network-chain consistency composite loss, respectively. λ ≥0 indicates the network-chain consistency constraint coefficient; Calculate the average network-chain consistency loss of each reflow sample within the current training batch, and determine the corresponding conflict modulation coefficient based on the deviation of the network-chain consistency loss of each reflow sample from the average value. The mathematical expression is as follows:

[0063]

[0064] In the above formula, B represents the average network-chain consistency loss of the current training batch; B represents the number of reflow samples in the current training batch. u This represents the summation index of samples within the current training batch. Indicates reflux sample s Corresponding Differentiable Model j The conflict modulation coefficients, and These represent the lower and upper limits of the collision modulation coefficient, respectively. clip(x,a,b) means restricting x to between the lower limit a and the upper limit b. κ ≥0 indicates the collision modulation intensity coefficient; The gradient of the network-chain consensus composite loss of each return sample with respect to the network parameters of the differentiable model is modulated and summarized using the conflict modulation coefficient to obtain the conflict-modulated batch gradient, the mathematical expression of which is as follows:

[0065] In the above formula, Representing the model of the three-dimensional particle j Network parameters, Indicates to Find the gradient. Indicates the first t The conflict-modulated batch gradient used for secondary parameter updates; The conflict-modulated batch gradient is input into the adaptive moment estimation process to update the first-order moment estimate and the second-order moment estimate. After bias correction, the update amount of each dimension of the network parameters of the differentiable model is determined. Specifically, if the differentiable model is a deep pyramid convolutional network, the weights of the deep pyramid convolutional layer, the parameters of the region embedding layer, and the parameters of the fully connected classification layer are updated. If the differentiable model is a graph neural network, the weights of the graph message passing layer, the attention coefficient, the parameters of the graph pooling layer, and the parameters of the node classification layer are updated.

[0066] Furthermore, after fixing the updated network parameters of the differentiable sub-model and re-acquiring the prediction probabilities of each sub-model, the fusion weight configuration update unit also replaces the prediction probabilities of the corresponding backflow samples with the re-acquiring prediction probabilities and adds them to the weight optimization training set; when determining the category-model reliability matrix based on the re-acquiring prediction probabilities and the true labels, the fusion weight configuration update unit includes: The fusion ratio matrix is ​​obtained by performing Softmax normalization row by row on the category-differentiated fusion weight parameter matrix. The fusion score is calculated based on the prediction probability of each sub-model under the same anomaly root cause category. Then, the fusion score of all anomaly root cause categories is normalized to obtain the fusion prediction probability, as shown in the following formula:

[0067]

[0068]

[0069] In the above formula, Indicates the return sample All The fusion prediction probability is obtained by normalizing the fusion scores of each category again. Represents the numerical stability constant. Indicates the sequence number of the returned sample. This indicates that after fixing the state of the current wheel model, the first... Sub-models for refluxed samples Belongs to the The predicted probability of the class output; Indicates reflux sample Corresponding to the Fusion score of the root cause of the anomaly This represents the category-differentiated fusion weight parameter matrix. The fusion ratio matrix obtained by performing Softmax normalization row by row The Middle Line number Column elements, This represents the natural exponential function. Represents the category differentiation fusion weight parameter matrix The Middle Line number Column elements, Represents the numerical stability constant; For weight optimization, the true label in the training set is the [i]. i Number of reflux samples for each abnormal root cause category In this case, the corresponding row of the category-model reliability matrix that has been validated and deployed in the previous round will be used, and the automatic update of the fusion weight parameters corresponding to the root cause category of the anomaly will be stopped; for the weight optimization training set where the true label is the first... i Number of reflux samples for each abnormal root cause category In this case, the category-model reliability matrix is ​​calculated based on the average predicted probability of the true category output and normalized row by row, as shown in the following formula:

[0070] In the above formula, Indicates the first Each sub-model in the real category is The average predicted probability of the true class output on the returned samples; Indicates to The category-model reliability matrix obtained by row-by-row normalization The category-model reliability matrix represents the first... Line number Column elements, summation condition This indicates that it only applies to the true category. Summing of the refluxed samples.

[0071] Furthermore, when the fusion weight configuration update unit updates the category-differentiated fusion weight parameter matrix to obtain the updated fusion weight configuration based on the category-model reliability matrix and the stability constraints relative to the previously deployed fusion weight configuration, it includes: Using real labels as supervision, the composite loss of network-chain consistency in the fusion layer is determined based on the fusion prediction probability and the network-chain root cause prior, as shown in the following formula:

[0072] In the above formula, This indicates the total number of samples in the training set for weight optimization. Indicates the fusion layer number 1 The class balance weights of the abnormal root causes are determined by the number of class samples in the weight optimization training set using the class balance weight calculation method. Indicates sample The true label one-hot encoding corresponds to the first The components of the class, the real category is Time to take Otherwise take ; Indicates the probability of fusion prediction; Indicates sample The first in the network-chain root cause prior vector The component corresponding to the class; This represents the network-chain consistency constraint coefficient of the fusion layer, used to adjust the contribution of consistency loss to the composite loss of the fusion layer; Represents the natural logarithm; Represents the numerical stability constant; The fusion weight optimization loss is calculated by combining the network-chain consistency composite loss of the fusion layer, the deviation between the fusion ratio matrix and the normalized category-model reliability matrix, and the change of the fusion ratio matrix relative to the fusion ratio matrix that has been validated and deployed in the previous round. The mathematical expression is as follows:

[0073] In the above formula, This represents the composite loss of network-chain consistency in the fusion layer; This represents the fusion ratio matrix for this round; This represents the category-model reliability matrix after row-by-row normalization. This represents the fusion ratio matrix that has been validated and deployed in the previous round; This represents the reliability guidance constraint coefficient, used to adjust the degree to which the fusion scaling matrix approaches the normalized reliability matrix; This represents the configuration stability constraint coefficient, used to adjust the degree of change in the fusion ratio matrix relative to the previous round of deployed configurations; denoted by Frobenius norm, whose square is the sum of the squares of all elements of the matrix; The category-differentiated fusion weight parameter matrix is ​​updated by gradient based on the fusion weight optimization loss to obtain the updated fusion weight configuration.

[0074] Furthermore, when the fusion weight configuration update unit performs gradient updates on the category-differentiated fusion weight parameter matrix based on the fusion weight optimization loss, it includes the following steps: Based on the elements in the category-differentiated fusion weight parameter matrix that have been manually covered, and the abnormal root cause categories not covered by the reflow samples used for training in this round, a locking mask with the same dimension as the category-differentiated fusion weight parameter matrix is ​​generated. M The matrix elements that are allowed to update automatically have a mask value of 1, while the matrix elements that are not allowed to update automatically have a mask value of 0. The gradient of the fusion weight optimization loss with respect to the category-differentiated fusion weight parameter matrix is ​​calculated. This gradient is then multiplied element-wise by the locking mask to obtain the controlled fusion weight gradient, as shown in the following formula:

[0075] In the above formula, Indicates a lock mask. This indicates that the corresponding [condition] is allowed. Automatic updates This indicates that the parameter should remain unchanged; This represents element-wise multiplication of matrices; Indicates the loss of fusion weight optimization Regarding the category-differentiated fusion weight parameter matrix gradient, Indicates using the matrix before update Calculate and lock-mask-constrained controlled fusion weight gradients; The controlled fusion weight gradient is input into the adaptive moment estimation process. After moment estimation and bias correction, the unlocked fusion weight parameters are updated, while keeping the manually configured values ​​or previously deployed configuration values ​​corresponding to the locked elements unchanged. The formula is as follows:

[0076] In the above formula, and These represent the fusion weight parameter matrices before and after this iteration, respectively. Indicates the learning rate of the fusion weights; and They represent according to Calculate and estimate the first and second moments after bias correction; This represents the numerical stability constant that prevents the denominator of the update expression from becoming zero; Upon receiving a manual weight coverage instruction, the matrix element to be locked is determined according to the abnormal root cause category and sub-model specified by the manual weight coverage instruction. The matrix element to be locked is set to the manual configuration value, and the corresponding element in the locking mask is set to 0, so that the matrix element to be locked maintains the manual configuration value in the subsequent automatic optimization process. Upon receiving a delock instruction, the corresponding element in the locking mask is restored to 1.

[0077] Furthermore, when the update deployment unit deploys the updated network parameters and fusion weight configuration of the differentiable submodel, it includes: The updated differential model network parameters and fusion weight configuration are jointly verified. The joint verification includes calculating the overall accuracy, network-chain inconsistency rate, and fusion weight change. When the verification results meet the preset deployment conditions, the updated differential model network parameters and fusion weight configuration are jointly deployed; otherwise, the differential model network parameters and fusion weight configuration deployed in the previous round are maintained.

[0078] Furthermore, when the verification results meet the preset deployment conditions, specifically, the following conditions must be met simultaneously: The overall accuracy of the candidate configuration is no less than the overall accuracy of the configuration deployed in the previous round on the same validation set; The macro average F1 of the candidate configuration is not lower than the preset threshold, or the recall rate of all pre-specified key categories is not lower than the corresponding preset threshold. The network-chain inconsistency rate of the candidate configuration does not exceed the preset upper limit; The maximum row change of the candidate fusion ratio matrix relative to the previously deployed fusion ratio matrix does not exceed a preset safety threshold.

[0079] Furthermore, the anomaly root cause prediction unit is also used to initialize the category-differentiated fusion weight parameter matrix. Specifically, it sets each element in the same row of the category-differentiated fusion weight parameter matrix to the same initial value so that the initial fusion ratio of each sub-model corresponding to the same anomaly root cause category is the same; or, if there is a category-differentiated fusion weight parameter matrix that has been validated and deployed in the previous round, it uses the category-differentiated fusion weight parameter matrix that has been validated and deployed in the previous round as the initial value for this round.

[0080] Thirdly, the present invention also proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems described in the first aspect.

[0081] Compared with the prior art, the advantages of the present invention are as follows: (1) In response to the problem that multi-source operational evidence is not organized into a unified computable object, this invention constructs a network-chain correlation matrix based on the pre-set correlation between evidence features and abnormal root cause categories, and extracts evidence features from multi-source operational data to obtain network-chain evidence vectors. Multi-source heterogeneous evidence such as physical equipment, communication links, main station services, archives, environment and load behavior are organized into a unified network-chain evidence vector, so that the network-chain propagation relationship is transformed from background description into a computable object that can participate in model training and fusion optimization.

[0082] (2) To address the problem of imbalanced class and lack of network-chain evidence constraints in periodic backflow data, this invention calculates the network-chain consistency loss based on the difference between the network-chain root cause prior and the prediction probability of the differentiable model, and combines it with the class balance cross-entropy loss to form the network-chain consistency composite loss. This allows network-chain evidence and class distribution to jointly participate in the construction of the training objective of the differentiable model, which is beneficial to improving the problems of insufficient root cause learning with few samples and inconsistency between prediction results and actual network-chain evidence under imbalanced class conditions.

[0083] (3) In response to the problem that the standard optimization does not adjust the sample gradient according to the network-chain conflict, the present invention updates the gradient of the network parameters of the differentiable model according to the network-chain consistency loss, and adjusts the gradient contribution of different samples to the network parameter update according to the degree of conflict between the prediction results and the network-chain root cause prior, which is conducive to improving the training sufficiency of high conflict samples and improving the learning effect of samples whose prediction results are inconsistent with the network-chain evidence.

[0084] (4) To address the problem that fusion weights are difficult to reflect the reliability of sub-models and are prone to mutation, this invention fixes the updated network parameters of differentiable sub-models and re-obtains the prediction probabilities of each sub-model. Based on the prediction probabilities and the true labels, the category-model reliability matrix is ​​determined. The fusion weights are then updated based on the reliability matrix and the stability constraints relative to the fusion weight configuration deployed in the previous round. This allows the fusion weights to adapt to changes in the classification output quality of sub-models and reduces mutations in the fusion configuration caused by small-batch feedback.

[0085] (5) To address the issues of unclear dependencies between sub-models and fusion strategies and the lack of controllable deployment mechanisms, this invention first updates the network parameters of the differentiable sub-models, then updates the fusion weights, and performs joint effect verification on the updated network parameters and fusion weight configurations. When the preset deployment conditions are met, they are deployed together; otherwise, the previous deployment configuration is maintained. This accurately reflects the unidirectional data dependency between the two optimization levels, enabling the continuous optimization results to be verified before entering the production configuration, and allowing for conditional deployment and rollback. Attached Figure Description

[0086] Figure 1 This is a general flowchart of the method in an embodiment of the present invention.

[0087] Figure 2 Flowchart for adaptive optimization of sub-model parameters.

[0088] Figure 3 Flowchart for adaptive optimization and deployment of category-differentiated fusion weights.

[0089] Figure 4 This is a flowchart of a two-level collaborative self-optimization retraining process.

[0090] Figure 5 Comparison chart of convergence performance for training sub-models.

[0091] Figure 6 Heatmap of the distribution of category-differentiated fusion weight matrix.

[0092] Figure 7 A comparison table of classification accuracy for each fault category.

[0093] Figure 8 A bar chart comparing the classification accuracy of each fault category. Detailed Implementation

[0094] The present invention will be further described below with reference to the accompanying drawings and specific preferred embodiments, but this does not limit the scope of protection of the present invention.

[0095] Before introducing specific embodiments of the present invention, relevant concepts or terms will be explained.

[0096] (1) Multi-source operational data and network-chain evidence.

[0097] The multi-source operational data in this embodiment includes data reflecting physical equipment, communication links, main station service processing, file configuration, environmental factors, and load behavior status. Time alignment and object association are performed for the same abnormal event. Six types of evidence features are extracted from the associated data. Non-numerical features are state-coded. After min-max numerical normalization of all features, the network-chain evidence vector is concatenated and output. A network-chain root cause prior is generated based on the network-chain association matrix. The network-chain association matrix is ​​initialized using expert experience (strong association assigned 3, weak association assigned 1, no association assigned 0, normalized column by column) and calibrated using a moving average of feedback samples.

[0098] (2) Heterogeneous sub-models and periodic retraining.

[0099] During periodic retraining, deep sub-models with differentiable structures typically employ fixed-learning-rate optimizers such as Stochastic Gradient Descent (SGD); while non-differentiable models or those reliant on the native training process retain their respective optimization mechanisms. Because the gradient magnitudes differ significantly between different network layers, parameter dimensions, and sub-models, and because runtime feedback often exhibits mini-batch and class imbalance characteristics, fixed-step optimization is prone to problems such as slow convergence, update oscillations, strong reliance on manual parameter tuning, and excessively long retraining windows.

[0100] This embodiment employs four types of sub-models: DPCNN, LightGBM, GNN, and expert rules. The differentiable sub-model refers to a sub-model capable of backpropagating its own network parameters using the network-chain consistency composite loss and updating the network parameters using the resulting gradient. In this embodiment, DPCNN and GNN are specifically used. LightGBM updates according to its native training mechanism, while expert rules maintain existing rules or update rules based on manual maintenance results; neither uses the conflict modulation network parameter update process of this embodiment. The predicted probabilities of all four types of sub-models participate in subsequent fusion weight optimization. During this stage, the state of each sub-model is fixed, and only the gradient of the fusion weight parameter matrix is ​​calculated; backpropagation of internal sub-model parameters is not performed. Periodic retraining is triggered when the number of effective feedback samples reaches a threshold or a preset time condition is met.

[0101] (3) Network-chain consistency composite loss and conflict modulation.

[0102] Periodic backflow samples may suffer from class imbalance and inconsistencies between model predictions and physical, communication, or business evidence. To address this, class balance weights are calculated based on the number of samples in each class, and a consistency loss is constructed using the difference between network-chain root cause priors and sub-model predicted probabilities. Based on this composite loss, the sample gradient is modulated according to the degree of network-chain conflict and then input into the adaptive moment estimation process.

[0103] (4) Category differentiation integration and reliability constraints.

[0104] Different sub-models have varying recognition capabilities across different root cause categories. The category-differentiated fusion weight parameter matrix configures the fusion ratio of each sub-model for each root cause category; the category-model reliability is determined based on recent true labels and the probability of the sub-model's output to the true category; the fusion weight update is constrained by both the reliability deviation and the change relative to the previous round of deployment configuration.

[0105] (5) Sequential coordination, verification deployment and manual control.

[0106] Two-level sequential collaboration refers to first updating the network parameters of the differentiable sub-model, then using the updated sub-model to regenerate the predicted probabilities and update the fusion weights. Changes in the fusion weights do not participate in the parameter update of the sub-model in this round. Candidate results formed by the two levels are jointly validated and then jointly deployed or jointly rejected; manual overlay and locking masks are used to keep the configuration of key categories controllable.

[0107] Example 1 This embodiment proposes a network-chain-based self-optimizing method for tracing the root causes of data anomalies in cyber-physical systems. This method is based on a two-level sequential self-optimizing mechanism guided by network-chain consistency constraints and category-model reliability. It utilizes a four-model fusion tracing framework comprised of a deep pyramid convolutional network (DPCNN), a gradient boosting tree (LightGBM), a graph neural network (GNN), and expert rules. The design architecture of this method is as follows: First, network-chain evidence vectors are extracted from multi-source operational data, and network-chain root cause priors for eight types of anomalies are generated based on the network-chain correlation matrix. Before fusion, the four sub-models—DPCNN, GNN, LightGBM, and expert rules—each output different forms of judgment results. Specifically, DPCNN outputs an 8-dimensional probability vector transformed by a Softmax layer; GNN outputs an 8-dimensional probability vector processed by global pooling and Softmax; LightGBM outputs 8-dimensional class probabilities based on leaf node voting frequencies (also calibrated to a probability distribution by Softmax before fusion); and the expert rules module outputs deterministic class judgment results. To ensure that these results have the same dimensions as the Softmax probability distributions of the first three sub-models, the following transformation method is used: The expert rule engine has several pre-defined production rules, each rule r containing preconditions. Antecedent r (e.g., "voltage deviation rate V_dev>0.2 and duration ≥5 minutes"), conclusion Conclusion r (Corresponding to one anomaly root cause category, in this embodiment corresponding to one of the 8 anomaly root cause categories) and the confidence score of the rule. (e.g., 0.95); After receiving the input data, the rule engine compares the numerical features in the input data with the threshold conditions in the rule preconditions, and matches the categorical features with the enumerated values ​​in the conditions; it evaluates the preconditions one by one in the rule base order, and if all conditions are met, the rule is determined to be hit, and the confidence score of the corresponding category of the rule is recorded. If multiple rules match within the same category, the highest confidence score is taken as the final confidence score for that category; if no rules match in a category, the confidence score for that category is set to 0; the confidence scores of all C categories are then calculated. s 1, s 2,…, s c After performing Softmax normalization, an 8-dimensional probability distribution is output, as shown in the following formula: (1) In the formula, This indicates that the expert rule sub-model determines that the input data belongs to the first... The probability of each abnormal root cause category. For the abnormal root cause category number ( i =1,2,.., C ), C The total number of abnormal root cause categories (in this method) C=8 ); s i For the first i The confidence score of each abnormal root cause category is determined by the rule engine after matching, and the value range is [0,1]. k For summation index variables, and i Synonyms, used to iterate through all C One category; >0 represents the temperature coefficient, used to control the smoothness of the probability distribution. When the value is large (e.g.) The probability distribution tends to be uniform when When the value is small (e.g.) The probability distribution tends to be sharp, and in this method... The default value is This indicates that the smoothness of the distribution is not adjusted additionally; For the natural constant e An exponential function with base 0; for input samples that do not match any rules, the exponential function for all categories. s i =0, at which point the expert rule output is uniformly distributed. , indicating that there are no valid rules to match; after the above transformation, the output of the expert rule sub-model has the same dimensions and numerical range as the Softmax probability distribution of DPCNN, GNN, and LightGBM (each dimension is [0,1] and the sum is 1), and can directly participate in the weighted fusion of the category differentiation fusion weight matrix; If the rule engine has no matching rules for a given input, the output will be uniformly distributed, indicating that there are no valid rules to match. After this transformation, the output of the expert rule sub-model has the same dimensions and numerical range as the Softmax probability distribution of DPCNN, GNN, and LightGBM (each dimension is [0,1] and the sum is 1), and can directly participate in the weighted fusion of the subsequent category differentiation fusion weight matrix.

[0108] Secondly, at the sub-model parameter layer, the class balance weights are determined based on the number of samples in each abnormal root cause category. The class balance cross-entropy loss and the network-chain consistency loss are used to construct the network-chain consistency composite loss. The gradient contribution of the training samples is modulated according to the degree of conflict between the model prediction probability and the network-chain root cause prior. The conflict-modulated batch gradient is input into the adaptive moment estimation process to update the network parameters of DPCNN and GNN. LightGBM is updated according to its native training mechanism. Expert rules do not perform gradient updates and maintain the original rule parameters or update the rule parameters according to the results of manual maintenance.

[0109] After completing the sub-model update, the state of the current sub-model is fixed and the prediction probabilities of the four sub-models are regenerated. An 8×4 category-model reliability matrix is ​​calculated based on the real labels. In the fusion weight layer, with the real labels as supervision, the network-chain consistency composite loss of the fusion layer is determined based on the fusion prediction probability and the network-chain root cause prior. The 8×4 category-differentiated fusion weight parameter matrix is ​​updated based on the deviation between the normalized fusion ratio and the category-model reliability, the change of the current fusion ratio relative to the previously deployed fusion ratio, and the manual locking status.

[0110] The two optimization layers work together in the order of updating sub-models first, followed by updating fusion weights. Sub-model parameter updates change the prediction probabilities of each sub-model for different anomaly root cause categories. The fusion weight layer redetermines the category-model reliability based on the updated prediction probabilities and the true labels, and adjusts the fusion ratio of each sub-model for different anomaly root cause categories accordingly. Changes in fusion weights do not participate in the sub-model parameter updates in this round.

[0111] After completing the updates at both levels, the candidate network parameters and candidate fusion weight configurations are jointly verified as a whole. If the verification results meet the preset deployment conditions, the candidate network parameters and candidate fusion weight configurations are jointly deployed and registered as a new deployed version. If the verification results do not meet the preset deployment conditions, the candidate results are rejected and the previous deployed configuration is maintained. Figure 1 As shown, user feedback and tag feedback constitute the outer operating loop, while sub-model parameter updates and fusion weight updates constitute the inner sequential self-optimization process with a clear order.

[0112] The implementation of this method depends on the following functional modules: Multi-source data and network-chain evidence construction module: Collects or reads data from physical devices, communication links, main station services, archives, environment and load behavior, performs time alignment and object association for the same abnormal event, extracts six types of evidence features from the associated data, outputs network-chain evidence vectors after state coding and numerical normalization, and generates network-chain root cause priors based on the network-chain association matrix.

[0113] Anomaly prediction module: Deploys DPCNN, LightGBM, GNN and expert rule sub-models, receives multi-source running data and outputs the predicted probability of each anomaly root cause category.

[0114] Prediction result storage module: Stores the prediction probability of each sub-model, the fused prediction result, the network-chain evidence vector, the model version, the fused weight version, the true category, the feedback type, and the feedback identifier.

[0115] User feedback collection module: front-end interactive interface, supports "confirm correct" or "correct to a certain category" operations, and writes the actual category marked by the user back to storage.

[0116] Reflow Management Module: Can be triggered by scheduled tasks or manually, filter feedback records, synchronize them to the training label dataset, and update the reflow identifier to prevent duplication.

[0117] Sub-model retraining module: Generates batch gradients for DPCNN and GNN based on class-balanced weights, network-chain root cause priors, and conflict modulation coefficients, and updates network parameters; LightGBM updates according to its native training mechanism, while expert rules are maintained or manually. Fusion weight learning module: Reacquires the predicted probabilities of each sub-model, calculates the class-model reliability matrix, and updates the class-differentiated fusion weights under the constraints of reliability and the stability of the previous deployment configuration, using the real labels as supervision.

[0118] Effect verification module: Saves snapshots of candidate parameters and candidate weight configurations, calculates preset metrics on the verification set and decides whether to deploy or reject, and maintains candidate versions and deployed versions respectively.

[0119] The deployment and manual intervention module deploys validated model parameters and fusion weights, supporting manual weight overriding, element or category row locking, and unlocking. These modules are interconnected through data and control flows to form a complete self-optimizing system.

[0120] like Figure 1 As shown, the method includes the following steps: S101) Construct a data loop between anomaly prediction and model retraining.

[0121] Acquire multi-source operational data of cyber-physical systems, extract evidence features from the multi-source operational data to obtain network-chain evidence vectors, construct network-chain correlation matrix based on the correlation between the evidence features and the anomaly root cause categories, initialize network-chain correlation matrix A when the system is first deployed, and execute periodic calibration rules after subsequent periodic retraining; The multi-source operational data is input into multiple heterogeneous sub-models containing differentiable sub-models for anomaly root cause prediction, obtaining the prediction probability of each sub-model. The prediction probabilities are then weighted and fused using a category-differentiated fusion weight parameter matrix to obtain and output the fused prediction result. The initialization of the category-differentiated fusion weight parameter matrix is ​​performed during the initial deployment of the system and before periodic retraining. When initializing the category-differentiated fusion weight parameter matrix, each element in the same row of the category-differentiated fusion weight parameter matrix is ​​set to the same initial value so that the initial fusion ratio of each sub-model corresponding to the same anomaly root cause category is the same; or, if there is a category-differentiated fusion weight parameter matrix that has been validated and deployed in the previous round, the category-differentiated fusion weight parameter matrix that has been validated and deployed in the previous round is used as the initial value for this round. Obtain user feedback on the fusion prediction results to determine the true labels. Associate and store the true labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results to obtain the corresponding records. Add the records that meet the backflow conditions as backflow samples to the training label dataset.

[0122] S102) Cyclic retraining process.

[0123] When the training label dataset meets the periodic retraining condition, backflow samples are extracted from the training label dataset. The backflow samples are input into the differentiable model to obtain the predicted probability of the differentiable model. The network-chain root cause prior vector is calculated based on the network-chain evidence vector and network-chain association matrix corresponding to the backflow samples. The class-balanced cross-entropy loss is calculated based on the true label corresponding to the backflow samples. The network-chain consistency loss is calculated based on the difference between the network-chain root cause prior vector corresponding to the backflow samples and the predicted probability of the differentiable model. The class-balanced cross-entropy loss and the network-chain consistency loss are combined into a network-chain consistency composite loss. The network parameters of the differentiable model are updated using gradients based on the network-chain consistency composite loss. The network parameters of the differentiable sub-model are fixed and the predicted probabilities of each sub-model are reacquired. The category-model reliability matrix is ​​determined based on the reacquired predicted probabilities and the true labels. The category-model reliability matrix and the stability constraints relative to the previously deployed fusion weight configuration are used to update the category-differentiated fusion weight parameter matrix to obtain the updated fusion weight configuration. Deploy the updated differential model network parameters and fusion weight configuration. Specifically, perform joint effect verification on the updated differential model network parameters and fusion weight configuration. The joint effect verification includes calculating the overall accuracy, network-chain inconsistency rate, and fusion weight change. If the verification results meet the preset deployment conditions, jointly deploy the updated differential model network parameters and fusion weight configuration; otherwise, maintain the differential model network parameters and fusion weight configuration deployed in the previous round.

[0124] The relevant content will be explained in detail below.

[0125] In this embodiment, before anomaly prediction, for the same measurement object or anomaly event, time alignment and object association are performed on data related to physical equipment status, communication link status, main station service processing status, file consistency, environmental factors, and load behavior status. Six types of evidence features are extracted from the associated data, and these features are then state-encoded and numerically normalized to form a fixed-length network-chain evidence vector. Specifically, in the data closed-loop stage between anomaly prediction and model retraining, the method for constructing the network-chain evidence vector includes: Acquire multi-source operational data of the cyber-physical system, including physical device status data, communication link status data, master station service processing status data, archive data, environmental factor data, and load behavior status data; For the same abnormal event, the multi-source operational data is time-aligned and object-associated, so that data from different sources belonging to the same abnormal event can establish a corresponding relationship in the time and space dimensions. From the time-aligned and object-associated data, we extract evidential features representing the physical device status, communication link status, main station business processing status, file consistency, environmental factors, and load behavior status, respectively. Among them, the evidentiary features characterizing the physical equipment status include at least voltage deviation rate, current imbalance, power fluctuation amplitude, power factor deviation, and data missing rate; the evidentiary features characterizing the communication link status include at least terminal online rate, data acquisition success rate, average signal strength, communication latency, and packet loss rate; the evidentiary features characterizing the main station's business processing status include at least interface call success rate, task queue backlog, data processing anomaly rate, and system response latency; the evidentiary features characterizing file consistency include at least file matching identifier, parameter configuration deviation, and consistency of household-transformer relationship; the evidentiary features characterizing environmental factors include at least temperature deviation, humidity, precipitation, and comprehensive meteorological index; and the evidentiary features characterizing load behavior status include at least load fluctuation coefficient, load factor, peak-valley difference rate, and deviation from historical data for the same period. State encoding is performed on various types of evidence features to convert non-numerical features into numerical representations; numerical normalization is performed on the state-encoded evidence features to map the feature values ​​of each dimension to the [0,1] interval; the normalized evidence features are concatenated in a fixed order to form a fixed-length feature vector, which serves as the network-chain evidence vector.

[0126] In this embodiment, after obtaining the network-chain evidence vector, multi-source running data is input into four types of sub-models (DPCNN, GNN, LightGBM, and expert rules). The predicted probabilities, fused prediction results, network-chain evidence vectors, model version numbers, and fused weight version numbers of each sub-model are stored, and the true category, feedback type, and return identifier fields are initialized. User manual feedback is received and the true label is determined. The true label is associated with the above data. Valid records that have been fed back but have not been returned are selected and added to the training label dataset. After writing is completed, the return identifier is updated to "returned".

[0127] Specifically, before associating and storing the real labels with the corresponding multi-source operational data, network-chain evidence vectors, prediction probabilities, and fusion prediction results, the method further includes: initializing a self-optimizing extension field, which includes a real category field, a feedback type field, a return flow identifier field, and a network-chain evidence field. The real category field is initially empty, the feedback type field is initially set to no feedback, the return flow identifier field is initially set to no return flow, and the network-chain evidence field is used to store the network-chain evidence vectors corresponding to the fusion prediction results. When storing the real labels in association with the corresponding multi-source operational data, network-chain evidence vectors, prediction probabilities, and fusion prediction results, the real labels determined by manual feedback are written into the real category field, the corresponding network-chain evidence vectors are written into the network-chain evidence field, and the feedback type field is updated to "feedback received". When adding records that meet the reflow conditions to the training label dataset as reflow samples, the specific process involves selecting valid records from those whose feedback type field is "feedback has been received" and whose reflow identifier field is "not reflowed". The real labels of the valid records and their associated multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results are added to the training label dataset, and the corresponding reflow identifier field is updated to "reflowed" to prevent duplicate reflow.

[0128] The initialization method of the network-chain correlation matrix in this embodiment includes the following steps: (1) Determine the feature dimensions and root cause categories of evidence: Let the network-chain evidence vector be defined. e The dimension is D (Right now D One evidentiary feature, in this embodiment D=25 The total number of abnormal root cause categories is C (In this method) C=8 Then the network-chain correlation matrix A is: A dimensional matrix, where the row index is... j= 1,…, D Corresponding to each evidence feature, column index j= 1,…, C Matrix elements corresponding to each category of abnormal root causes Indicates the first j The first evidentiary feature is related to the first i Association weights of each anomaly root cause category; (2) Establish an evidence-root cause association rule table: Based on the experience of experts in the power system field, for each evidence feature j Determine its relationship with each root cause category. i The degree of correlation is divided into three levels: strong correlation (assigned a value of 3, such as a strong correlation between "acquisition success rate" and "communication anomaly", a strong correlation between "archive matching identifier" and "archive anomaly", and a strong correlation between "voltage deviation rate" and "equipment failure"), weak correlation (assigned a value of 1, such as a weak correlation between "terminal online rate" and "master station anomaly", a weak correlation between "load fluctuation coefficient" and "user behavior", and a weak correlation between "voltage deviation rate" and "equipment power outage"), and no correlation (assigned a value of 0, such as no correlation between "archive matching identifier" and "weather factors", and no correlation between "precipitation" and "archive anomaly"); specifically: voltage deviation rate V dev Strongly correlated with equipment failure type, weakly correlated with equipment power outage type; current imbalance Iunbal Strong correlation with device fault categories, weak correlation with user behavior categories; data collection success rate R collect Strong correlation with communication anomaly categories, weak correlation with equipment failure categories; terminal online rate R online Strongly correlated with communication anomaly categories, weakly correlated with main station anomaly categories; file matching identifier F match Strongly correlated with the anomaly category of archives, but not with other categories; temperature deviation. T dev Strongly correlated with weather factor categories, weakly correlated with load fluctuation categories; load fluctuation coefficient L fluct Strongly correlated with load mutation categories, weakly correlated with user behavior categories; data missing rate R miss Strong correlation with communication anomaly category, weak correlation with equipment failure category, weak correlation with equipment power outage category; the correlation level between other evidence features and each root cause category is determined by expert experience in the same manner. (3) Construct the initial association matrix A~0~: Fill the corresponding positions in the matrix with the association levels determined in step two to obtain the initial integer matrix A~0~, where subscript j and i The meaning is the same as in step one, and the superscript (0) indicates the initial value; (4) Column normalization: Normalize each column of A~0~ (corresponding to a root cause category) so that the normalization of each column is achieved. The sum of the elements is 1: (2) In the formula, For the initial matrix in step three j Line 1 i Assign a value to the column (the value can be 0, 1 or 3). To sum the index variable (k) = 1,…, D ), Indicates the first i List all Sum of initial values, For the normalized matrix A, the first... j Line 1 i The element values ​​of the column.

[0129] After normalization, the sum of the elements in each column of matrix A is 1, and each column constitutes a probability distribution representing the relative contribution weight of each evidentiary feature to the root cause category. For example, in the column corresponding to the "archival anomaly" category, the two evidentiary features "archival matching identifier" and "parameter configuration deviation" have the highest weights.

[0130] During the periodic retraining process, before calculating the network-chain root cause prior based on the network-chain evidence vector and network-chain association matrix corresponding to the returned samples in each round of retraining, periodic calibration is performed: using historically confirmed feedback samples to statistically analyze the actual distribution of each evidence feature under different root cause categories, and calculating the actual contribution frequency of each evidence feature to each category. f ji Update matrix elements using a moving average method: (3) In the formula, These are the matrix element values ​​before the update. The updated matrix element values, The learning rate (in this method, we take...) (0.1), used to control the update magnitude of a single calibration. The larger the value, the greater the impact of the new feedback sample on the matrix; the smaller the value, the smoother the matrix changes. f ji Based on the statistics of recent feedback samples, the first j The evidence feature in the first The standardized contribution frequency in the sample is calculated as follows: Statistically count all true labels for the first class of samples. i The mean of the normalized values ​​of each evidence feature in the feedback samples of the class is then normalized to make the sum of the mean vector equal to 1; through periodic calibration, the correlation matrix gradually evolves from the expert experience initial value to the data-driven optimal value.

[0131] Specifically, periodic calibration is performed after each periodic retraining to prepare for the next round. The network-chain root cause prior vector is calculated based on the network-chain evidence vector and network-chain association matrix corresponding to the returned samples. The training label dataset is judged to meet the periodic retraining conditions. If the number of newly confirmed feedback samples (i.e., returned samples) in the training label dataset reaches the preset threshold (e.g., 50 samples), the matrix elements of the network-chain association matrix are updated according to the moving average formula described in formula (3), and the learning rate η=0.1. If the number of newly added feedback samples is less than 50, the calibration is skipped in this round, and the matrix of the previous round is used to avoid introducing statistical noise due to insufficient sample size.

[0132] like Figure 2As shown, in the periodic retraining process, the conflict modulation update method with network-chain consistency constraints is adopted for DPCNN and GNN; the original training mechanism of LightGBM is retained, and the rule maintenance mechanism of expert rules is retained.

[0133] In this embodiment, after extracting the reflow samples from the training label dataset, the reflow samples are added to the periodic retraining dataset. Specifically, the periodic retraining dataset stores the following: multi-source operational data corresponding to each training sample (including physical device status data, communication link status data, main station service processing status data, archive data, environmental factor data, and load behavior status data), and network-chain evidence vectors. e s The dataset includes the predicted probability vectors of each sub-model (DPCNN, GNN, LightGBM, and expert rules), the true labels determined by user feedback (category numbers of one of the eight anomaly root causes), and the sample collection timestamps and their respective station / user identifiers. This data is appended to the dataset during each reflow operation for use during periodic retraining. In each round of retraining, the category balance weights are determined based on the number of samples for each anomaly root cause category in the periodic retraining dataset. The network-chain root cause priors are determined based on the network-chain evidence vector and network-chain association matrix. The network-chain consistency composite loss and conflict modulation coefficients of the differentiable sub-model are calculated, and the network parameters of the differentiable sub-model are updated based on the gradients after conflict modulation.

[0134] In this embodiment, the differentiable model is the DPCNN and GNN. Its network parameters can be calculated by backpropagation using the network-chain consistency composite loss. The network-chain root cause prior vector is calculated based on the network-chain evidence vector and network-chain association matrix corresponding to the returned samples. The class-balanced cross-entropy loss is calculated based on the true labels corresponding to the returned samples. The network-chain consistency loss is calculated based on the difference between the network-chain root cause prior vector corresponding to the returned samples and the predicted probability of the differentiable model. The class-balanced cross-entropy loss and the network-chain consistency loss are combined into a network-chain consistency composite loss. When updating the network parameters of the differentiable model using the network-chain consistency composite loss, specifically for each returned record, the network-chain root cause prior vectors for eight root causes are calculated based on the network-chain evidence vector and network-chain association matrix. The samples of each root cause category in the current training data (i.e., the periodic retraining dataset) are then used for further updates. The calculation process involves: 1) Calculating class-balanced weights; 2) Calculating class-balanced cross-entropy loss and network-chain consistency loss for both DPCNN and GNN, and combining them to form a network-chain consistency composite loss: 3) Calculating class-balanced cross-entropy loss based on the true labels, and calculating network-chain consistency loss based on the difference between the network-chain root cause prior and the predicted probability of the differentiable model; 4) Combining the class-balanced cross-entropy loss and the network-chain consistency loss to form a network-chain consistency composite loss; 5) Determining conflict modulation coefficients based on the network-chain consistency loss of each sample, modulating and summarizing the gradients of each sample within the same batch to obtain the conflict-modulated batch gradient; 6) Determining conflict modulation coefficients based on the network-chain consistency loss corresponding to each training sample, and using these conflict modulation coefficients to modulate the gradient of the network-chain consistency composite loss of the corresponding training sample with respect to the network parameters of the differentiable model, and updating the network parameters of the differentiable model based on the modulated gradient. The specific calculation process is as follows: For any training sample in the periodic retraining dataset (i.e., any reflow sample in the periodic retraining dataset) s The network-chain evidence vectors of the training samples are obtained through the network-chain association matrix A. e s The samples are mapped to different root cause categories and then normalized to obtain the network-chain root cause prior vectors corresponding to the training samples. c s The mathematical expression is as follows: (4) Based on the number of samples in each anomaly root cause category in the periodic retraining dataset, the corresponding class balance weights are calculated, and the mathematical expression is as follows: (5) For any differentiable model jBased on the true labels of the training samples, the predicted probabilities output by the differentiable model, and the class balance weights, the class balance cross-entropy loss is calculated, and the mathematical expression is as follows: (6) The network-chain consistency loss is calculated based on the difference between the network-chain root cause prior and the predicted probability output by the differentiable submodel, and the mathematical expression is as follows: (7) The weighted combination of the category-balanced cross-entropy loss and the network-chain consistency loss yields the network-chain consistency composite loss corresponding to the differentiable submodel, as expressed mathematically below: (8) Calculate the average network-chain consistency loss of each training sample in the current training batch, and determine the corresponding conflict modulation coefficient based on the deviation of the network-chain consistency loss of each training sample from the average value. The mathematical expression is as follows: (9) (10) The gradient of the network-chain consistency composite loss of each training sample in the current training batch with respect to the network parameters of the differentiable sub-model is modulated and summarized using the conflict modulation coefficient to obtain the conflict-modulated batch gradient, as shown in the following mathematical expression: (11) In the formula: Indicates the training sample number. This represents the summation index of samples within the current training batch; and These represent the anomaly root cause category number and category summation index, respectively, both ranging from 1 to... ; This represents the total number of abnormal root cause categories; in this embodiment, it is set to 8. This represents the number of samples in the current training batch, and is a positive integer. The sub-models are numbered sequentially as 1, 2, 3, and 4 according to DPCNN, LightGBM, GNN, and expert rules; the differentiable sub-models in equations (6) to (11) are DPCNN and GNN, corresponding to j=1 and j=3 respectively. t represents the parameter update iteration number of the corresponding differentiable sub-model in the current cycle retraining, starting from 1. It is formed by six types of evidentiary features in the aforementioned fixed order. Dimensional network-chain evidence column vector, The total dimension of the evidentiary features is 25 in this embodiment; for The dimensional network-chain correlation matrix, with rows corresponding to evidence features and columns corresponding to anomaly root cause categories, uses the aforementioned initialization and periodic calibration methods. This is the matrix transpose. The result obtained after Softmax normalization 3D network-chain root cause prior vector, For the vector of the first Each component is non-negative and its sum is 1. This means dividing the natural index of each category score by the sum of the natural indices of all category scores; during this round of parameter optimization, and the products generated therefrom As a given quantity, it is not used for updating the network parameters of the differentiable submodel. and For the periodic retraining dataset, the true label belongs to the first... Class and First The number of samples in each class; For the first The class balance weights are calculated according to formula (5), and the arithmetic mean of all class weights is 1. The smoothing constant for the number of samples in each category. This is the class imbalance adjustment coefficient. hour, All are 1; As the number increases, the relative weight of the fewer sample classes increases. For the sample The true label one-hot encoded component, the true category is The value is 1 if the condition is met, otherwise it is 0. For sub-model For the sample Belongs to the Predicted probability of class, superscript This represents the category components rather than powers, and the sum of the predicted probabilities for all categories is 1. , and Samples Corresponding sub-model The categories balance cross-entropy loss, network-chain consistency loss, and network-chain consistency composite loss, with superscript... Indicates the sample index; For the current batch of sub-models The average network-chain consistency loss; Represents the natural logarithm; This is a numerical stability constant used to avoid taking the logarithm of zero or using zero as the denominator; is the network-chain consistency constraint coefficient, used to adjust the contribution of consistency loss to the composite loss. The conflict modulation intensity coefficient; For the sample Corresponding sub-model The conflict modulation coefficients; and These are the lower and upper limits of the modulation coefficient, respectively, satisfying... ; Indicates input Implement upper and lower limit cutoffs. For the first Network parameters of a differentiable submodel Indicates to Find the gradient; For the first The conflict-modulated batch gradient used for secondary parameter updates. The sample loss and gradient in Equation (10) are the values ​​before the update. calculate, It is only used as the multiplication coefficient for this gradient summation, and is not... Take the derivative in reverse order; The conflict-modulated batch gradient is input into the network parameter update process. Specifically, the conflict-modulated batch gradient is input into the adaptive moment estimation process. The gradient contribution of training samples with different network-chain conflict levels to the network parameter update is adjusted by the conflict modulation coefficient, updating the first-order moment estimate and the second-order moment estimate. Based on the first-order moment estimate and the second-order moment estimate of the conflict-modulated batch gradient, the update amount of each dimension of the network parameters of the differentiable model is determined after bias correction. The relevant calculation process is as follows: First moment of sub-model: (12) Second moment of sub-model: (13) The square is calculated for each element of the gradient vector.

[0135] Bias correction: (14) Differential model parameter update: (15) In the formula: This indicates the number of the differentiable model that participated in the network parameter update in this round, corresponding to DPCNN and GNN respectively; This indicates the parameter update iteration number of the corresponding sub-model, starting from 1. The batch gradient after collision modulation is obtained from equation (11); , These are the first-order moment estimate calculated based on the gradient and the second-order raw moment estimate calculated element-wise based on its squared value, respectively. , This is the state saved from the previous iteration. The above vector or parameter tensor and... They have the same shape.

[0136] and The exponential decay coefficients estimated from the first and second moments, respectively, satisfy... , ; and These represent the corresponding attenuation coefficients. Power of 1. , The moment estimator after eliminating zero initialization bias according to equation (14); For the first Learning rate of network parameters for a differentiable submodel; These are the network parameters before this update. These are the network parameters after this update; To prevent numerical stability constants where the denominator of the update expression is zero.

[0137] In one implementation, when initiating a new periodic retraining, the currently deployed network parameters are used as... ,Will and Initialize to zero, and then re-start from... Begin counting. The squares in equation (13) and the square roots and divisions in equation (15) are calculated element-wise. The denominator of equation (15) is... DPCNN and GNN maintain their respective moment estimation states and iteration counts.

[0138] In this embodiment, for the Deep Pyramid Convolutional Network (DPCNN) in the differentiable model, the weights of the deep pyramid convolutional layers, the parameters of the region embedding layers, and the parameters of the fully connected classification layers are updated; for the Graph Neural Network (GNN) in the differentiable model, the weights of the graph message passing layer, the attention coefficients, the parameters of the graph pooling layer, and the parameters of the node classification layer are updated. Conflict modulation changes the contribution of different training samples to the batch gradient, and the first moment, second moment, and bias correction are used to form the update amounts of each parameter dimension based on the modulated batch gradient.

[0139] like Figure 3As shown, during the periodic retraining phase, after updating the differentiable sub-model in each round of retraining, the state of the sub-model in this round is fixed and the weights are recalculated to optimize the four-model prediction probabilities for each sample in the training set. An 8×4 category-differentiated fusion weight parameter matrix W is constructed, with eight rows corresponding to eight types of abnormal root causes: equipment failure, communication anomaly, user behavior, weather factors, main station anomaly, equipment power outage, file anomaly, and load mutation. The four columns correspond to DPCNN, LightGBM, GNN, and expert rules. Softmax normalization is performed on each row of W to obtain the fusion ratio matrix S. The fusion score is calculated based on the prediction probabilities of the four sub-models under the same root cause category, and then the eight fusion scores are normalized to obtain the fusion prediction probability.

[0140] In this embodiment, after fixing the updated differentiable sub-model network parameters and re-acquiring the prediction probabilities of each sub-model, the prediction probabilities of the corresponding backflow samples are replaced with the re-acquiring prediction probabilities and added to the weight optimization training set. Specifically, the updated differentiable sub-model is used to recalculate the prediction probabilities of samples in the periodic retraining dataset. The prediction probabilities, true labels, and the fusion weight configuration deployed in the previous round are added to the weight optimization training set. Then, the category-model reliability matrix is ​​calculated based on the weight optimization training set. Based on the category-model reliability matrix and the fusion weight configuration deployed in the previous round, the update of the category-differentiated fusion weight matrix is ​​constrained to obtain the candidate fusion weight configuration for this round.

[0141] Specifically, the category-model reliability matrix is ​​determined based on the reacquired predicted probabilities and true labels. When updating the category-differentiated fusion weight parameter matrix to obtain the updated fusion weight configuration, the 8×4 category-model reliability matrix R is calculated based on the average probability of each sub-model's output to the true category under each true root cause category in the weight optimization training set. The fusion weight optimization loss consists of the network-chain consistency composite loss of the fusion prediction, the deviation between the fusion ratio matrix and the normalized reliability matrix, and the change between the current fusion ratio and the previously deployed fusion ratio. A locking mask is generated based on the artificial coverage status and categories without effective backflow samples. Only the unlocked weight elements are updated to obtain the candidate fusion weight configuration. Thus, the category-model reliability matrix for each sub-model corresponding to each abnormal root cause category is determined based on the predicted probabilities and true labels of each sub-model. Using the true labels as supervision, the category-differentiated fusion weight matrix is ​​updated based on the category-model reliability matrix and the stability constraints relative to the previous fusion weight configuration. The relevant calculation derivation process is as follows: The fusion ratio matrix is ​​obtained by performing Softmax normalization row by row on the category-differentiated fusion weight parameter matrix. The fusion score is calculated based on the prediction probability of each sub-model under the same anomaly root cause category. Then, the fusion scores of all anomaly root cause categories are normalized to obtain the fusion prediction probability. The relevant formulas are as follows: Line-by-line normalization fusion ratio: (16) Category fusion score: (17) Fusion prediction probability: (18) For weight optimization, the true label in the training set is the [i]. i Number of reflux samples for each abnormal root cause category In this case, the corresponding row of the category-model reliability matrix that has been validated and deployed in the previous round will be used, and the automatic update of the fusion weight parameters corresponding to the root cause category of the anomaly will be stopped; for the weight optimization training set where the true label is the first... i Number of reflux samples for each abnormal root cause category In this case, the category-model reliability matrix is ​​calculated based on the average predicted probability of the true category output and normalized row by row, as shown in the following formula: Category-Model Reliability and its Normalization: (19) in, This indicates that the true label in the weight optimization training set is the first... The number of valid samples in the class; Indicates sample The actual category number, One-hot encoded components for the same real label; This indicates that it only applies to the true category. The effective sample summation. In equation (19) The formula for the sample mean is only used when Used when; At that time, the mean of the sample is not calculated; instead, the effective and deployed sample from the previous round is used. For the corresponding row, set all lock masks for that category to 0, ensuring that its fusion weight parameters retain the values ​​deployed in the previous round. Normalized reliability matrix. As determined above It was calculated row by row.

[0142] Using real labels as supervision, the composite loss of network-chain consistency in the fusion layer is determined based on the fusion prediction probability and the network-chain root cause prior, as shown in the following formula: (20) In the above formula, This indicates the total number of samples in the training set for weight optimization. Indicates the fusion layer number 1 The class balance weights of the abnormal root causes are determined by the number of class samples in the weight optimization training set using the class balance weight calculation method. Indicates sample The true label one-hot encoding corresponds to the first The components of the class, the real category is Time to take Otherwise take ; Indicates the probability of fusion prediction; Indicates sample The first in the network-chain root cause prior vector The component corresponding to the class; This represents the network-chain consistency constraint coefficient of the fusion layer, used to adjust the contribution of consistency loss to the composite loss of the fusion layer; Represents the natural logarithm; Represents the numerical stability constant; The fusion weight optimization loss is calculated by combining the network-chain consistency composite loss of the fusion layer, the deviation between the fusion ratio matrix and the normalized category-model reliability matrix, and the change of the fusion ratio matrix relative to the fusion ratio matrix that has been validated and deployed in the previous round. The formula is as follows: (twenty one) In the above formula, This represents the composite loss of network-chain consistency in the fusion layer; This represents the fusion ratio matrix for this round; This represents the category-model reliability matrix after row-by-row normalization. This represents the fusion ratio matrix that has been validated and deployed in the previous round; This represents the reliability guidance constraint coefficient, used to adjust the degree to which the fusion scaling matrix approaches the normalized reliability matrix; This represents the configuration stability constraint coefficient, used to adjust the degree of change in the fusion ratio matrix relative to the previous round of deployed configurations; The Frobenius norm is represented by the sum of the squares of all elements of the matrix; the fusion weight optimization loss includes the fusion layer network-chain consistency composite loss, the reliability guidance constraint term, and the configuration stability constraint term. These are reliability-guided constraint coefficients used to adjust the fusion scaling matrix. To normalize the category-model reliability matrix The degree of closeness; To configure stability constraint coefficients for adjusting the fusion ratio matrix. Compared to the previous round of deployed fusion ratio matrix The degree of change. The two coefficients are independent and their sum is not required to be 1; when one coefficient is 0, it indicates that the corresponding constraint term is not enabled. In one implementation, and The candidate is determined through verification within a predefined non-negative candidate interval. Specifically, this can be done within the interval... Candidate values ​​are set internally, sub-model states and other training conditions are fixed, and different combinations of candidate coefficients are used to optimize the fusion weights. The macro-average F1 score, network-chain inconsistency rate, and fusion ratio change are calculated on the validation set that did not participate in the fusion weight update. From the candidate combinations that meet the preset deployment conditions, the one with the best validation performance is determined. and If no candidate combination meets the preset deployment conditions, the coefficients and fusion configurations already verified in the previous round will be used. The above candidate range is an optional implementation range and does not represent a universally optimal range of values.

[0143] After obtaining the fusion weight optimization loss, the category-differentiated fusion weight parameter matrix is ​​updated using gradient based on the fusion weight optimization loss to obtain the updated fusion weight configuration, specifically including: Based on the elements in the category-differentiated fusion weight parameter matrix that have been manually covered, and the abnormal root cause categories not covered by the reflow samples used for training in this round, a locking mask with the same dimension as the category-differentiated fusion weight parameter matrix is ​​generated. M The matrix elements that are allowed to update automatically have a mask value of 1, while the matrix elements that are not allowed to update automatically have a mask value of 0. The gradient of the fusion weight optimization loss with respect to the category-differentiated fusion weight parameter matrix is ​​calculated. This gradient is then multiplied element-wise by the locking mask to obtain the controlled fusion weight gradient, as shown in the following formula: (twenty two) In the above formula, Indicates a lock mask. This indicates that the corresponding [condition] is allowed. Automatic updates This indicates that the parameter should remain unchanged; This represents element-wise multiplication of matrices; Indicates the loss of fusion weight optimization Regarding the category-differentiated fusion weight parameter matrix gradient, Indicates using the matrix before update Calculate and lock-mask-constrained controlled fusion weight gradients; The controlled fusion weight gradient is input into the adaptive moment estimation process. After moment estimation and bias correction, the unlocked fusion weight parameters are updated, while keeping the manually configured values ​​or the previously deployed configuration values ​​for the locked elements unchanged. The candidate fusion weight configuration for this round is obtained, as shown in the following formula: (twenty three) In the above formula, and These represent the fusion weight parameter matrices before and after this iteration, respectively. Indicates the learning rate of the fusion weights; and They represent according to Calculate and estimate the first and second moments after bias correction; This represents the numerical stability constant that prevents the denominator of the update expression from becoming zero.

[0144] In formulas (16) to (23): This indicates the total number of abnormal root cause categories. This represents the total number of sub-models participating in the fusion, which are 8 and 4 in this embodiment; , For category indexing, , The sub-model indexes are DPCNN, LightGBM, GNN, and expert rules, respectively. This represents the sample number in the weight optimization training set. , , , , and All A multidimensional matrix, where rows correspond to the root cause categories of anomalies and columns correspond to sub-models. This represents the fusion weight parameter matrix. Indicates its first Line 1 The real number parameter of the column; Indicates to The fusion ratio matrix is ​​obtained by performing Softmax normalization row by row. Indicates the first The sub-model is for the first The class fusion ratio satisfies and , This represents the natural exponential function. Indicates the first Sub-models for samples Belongs to the The predicted probability of a class; This indicates the category fusion score. This represents the fusion prediction probability after cross-category normalization. Indicates sample The actual category number, This represents the corresponding one-hot encoded component; , , and They represent the weights in the training set for weight optimization. The number of effective samples of the class, the fusion layer The class balance weights, the total number of valid samples, and the consistency constraint coefficient of the fusion layer network-chain. Indicates sample The first in the network-chain root cause prior vector The component corresponding to the class; Represents the natural logarithm; This represents the numerical stability constant. Indicates the first Each sub-model in the real category is The average predicted probability of the output for that category on the valid samples. Indicates to The reliability matrix obtained by row-by-row normalization; This represents the combined loss of network-chain consistency in the fusion layer. Indicates the loss from weight fusion optimization, superscript Indicates the fusion layer; This represents the fusion ratio matrix that has been validated and deployed in the previous round; and These represent the reliability guidance constraint coefficient and the configuration stability constraint coefficient, respectively, and their determination method and value range adopt the aforementioned method; This represents the Frobenius norm. Indicates a lock mask. This indicates that the corresponding [condition] is allowed. Automatic updates This indicates that the parameter should remain unchanged; This represents element-wise multiplication of matrices; express about The gradient. This indicates the parameter update iteration number for the fusion weight optimization; Indicates using the matrix before update Calculate and lock-mask-constrained controlled fusion weight gradients; and These represent the fusion weight parameter matrices before and after this iteration, respectively. Indicates the learning rate of the fusion weights; and They represent according to The first and second moments were calculated and bias-corrected, and their dimensions were... Same. In equation (23), the square root, division, and mask multiplication are all performed according to the corresponding position elements.

[0145] In this embodiment, the moment estimation and bias correction of the fusion weights adopt the structures shown in equations (12) to (14), wherein the batch gradient after conflict modulation is... Replace with controlled fusion weight gradient and will , , and Replace with , , and . and These represent the first and second moment estimates for the fusion weight optimization, respectively. and Let represent the first and second moment estimates after bias correction, respectively. The dimensions of the matrices mentioned above are all equal to 1 / 2. same; and Let these be the exponential decay coefficients of the first and second moment estimates, respectively, satisfying... and When starting this round of fusion weight optimization, and Initialize to zero, and from Start counting, and update according to formula (23) after deviation correction. .

[0146] In this embodiment, upon receiving a manual weight coverage instruction, the matrix element to be locked is determined based on the anomaly root cause category and sub-model specified in the manual weight coverage instruction. This matrix element is then set to a manually configured value, and the corresponding element in the lock mask is set to 0, ensuring that the matrix element to be locked maintains the manually configured value during subsequent automatic optimization. Upon receiving a de-lock instruction, the corresponding element in the lock mask is restored to 1. Specifically, during manual locking, the specified... Set it to a manually configured value, and then set the corresponding Set to 0; for anomaly root cause categories where there are no valid samples in the training set for weight optimization, retain the ones deployed in the previous round. For the corresponding row, set all lock mask elements in that row to 0. The locked object is the fusion weight parameters before Softmax normalization. The locked parameters remain unchanged in this round of fusion weight optimization.

[0147] In each round of the periodic retraining phase, after obtaining the updated differentiable model network parameters and fusion weight configuration, the updated differentiable model network parameters are written into the candidate parameter snapshot library, and a candidate fusion weight configuration table is generated based on the updated class-differentiated fusion weight parameter matrix. It is then determined whether the candidate network parameters and candidate fusion weight configurations meet the loss convergence condition or the early stopping condition. If they do not meet the condition, the network parameter update and fusion weight update are continued using the next batch of training data. If they meet the condition, a validation set independent of the parameter update in this round is used to jointly verify the candidate network parameters and candidate fusion weight configurations. Specifically, the overall accuracy, macro-average F1, class precision and recall, minimum class precision, inter-class performance standard deviation, network-chain inconsistency rate, and maximum row change in fusion ratio are calculated for the candidate configurations compared with the configurations deployed in the previous round.

[0148] Candidate network parameters and candidate fusion weight configurations will only be deployed together if all four of the following conditions are met simultaneously: First, the overall accuracy of the candidate configuration is not lower than the overall accuracy of the previously deployed configuration on the same validation set; Second, the macro-average F1 score of the candidate configuration is not lower than a preset threshold, or the recall rates of all pre-specified key categories are not lower than their respective preset thresholds, either condition being sufficient; Third, the network-chain inconsistency rate of the candidate configuration is not higher than a preset upper limit; Fourth, the maximum row change of the candidate fusion ratio matrix relative to the previously deployed fusion ratio matrix does not exceed a preset safety threshold. If any one of these conditions is not met, the candidate configuration for this round will be rejected, and the previously deployed configuration will be maintained.

[0149] The network-chain inconsistency rate represents the proportion of valid validation samples whose predicted fusion category differs from the category indicated by the network-chain root cause prior. The maximum row change in the fusion ratio represents the maximum degree of change in each category row between the candidate fusion ratio matrix and the previously deployed fusion ratio matrix. Relevant thresholds are pre-set before joint effect verification and remain unchanged during this round of verification. Manually configured weights have higher execution priority than automatic optimization results, and locked fusion weight parameters remain unchanged during automatic optimization.

[0150] like Figure 4As shown, through the aforementioned steps, the method in this embodiment establishes a two-level sequential collaborative mechanism: First, the parameters of the DPCNN and GNN networks are updated using the network-chain consistency composite loss and the gradient after conflict modulation, and LightGBM and expert rules are processed according to their respective mechanisms; then, the state of the current sub-model is fixed, and the prediction probabilities of the four models in the training set are regenerated to optimize the weights; the fusion weight layer calculates the class-model reliability based on the regenerated prediction probabilities and the true labels, and updates the fusion weights under the constraints of reliability deviation, changes in the previous round's deployed configuration, and manually locked state. This sequential relationship allows the fusion layer to adapt to changes in the classification output quality of the sub-models, but changes in the fusion weights do not participate in the parameter update of the current sub-model. The candidate results from both layers are jointly deployed or jointly rejected after joint verification.

[0151] In actual operation, GNN may have higher reliability in categories with strong device status and topological correlation, LightGBM may have higher reliability in categories with strong environmental or load structure characteristics, and expert rules may have higher reliability in categories with file consistency verification. The specific fusion ratio is determined by the fusion weight optimization results under the supervision of real labels, and not pre-setting any model weight will necessarily increase the weight.

[0152] The effectiveness of the method proposed in this embodiment will be verified through specific experiments below.

[0153] The dataset contains 1,000 labeled work orders, covering 8 types of faults. It is divided into a training set of 700 orders, a validation set of 150 orders, and a test set of 150 orders, with the proportion of each category remaining consistent, according to a ratio of 7:1.5:1.5.

[0154] First, multi-source data association and data closed-loop construction are performed. For the same measurement object or abnormal event, fields related to physical equipment status, communication link status, main station business processing status, file consistency, environmental factors, and load behavior are read. After time alignment, object association, and normalization, a network-chain evidence vector is formed. The network-chain association matrix can be initialized according to the correspondence rules between equipment-link-business link and eight root causes, and periodically calibrated using historical feedback sample statistics. When the prediction results are stored, the prediction probabilities of each sub-model, the fused prediction results, the network-chain evidence vector, the model version, and the fused weight version are saved, and the true category, feedback type, and return flow identifier are initialized. After the operation and maintenance personnel perform confirmation or correction operations, the system writes the true label back to the record; a scheduled task selects valid data from the feedback records that have not yet returned and adds them to the training label dataset.

[0155] Once the number of valid reflux labels reaches a threshold, periodic retraining is initiated. At the sub-model layer, class balance weights are calculated based on the number of samples from the eight root causes. The network-chain consistency loss is calculated based on the network-chain root cause prior and the predicted probabilities of DPCNN and GNN, and this loss is combined with the class balance cross-entropy to form a composite loss. The conflict modulation coefficient is calculated based on the consistency loss for each sample, and the modulated batch gradient is input into the Adam moment estimation process to update the DPCNN and GNN parameters. LightGBM updates according to its native training mechanism; expert rules do not perform gradient updates.

[0156] After completing the sub-model update, fix the state of the four types of sub-models in this round, recalculate the weights to optimize the four-model prediction probabilities for each sample in the training set, and obtain... Dimensional Category-Model Reliability Matrix and its row-by-row normalized matrix and build 3D fusion weight parameter matrix and its row-by-row normalized fusion ratio matrix The fusion layer uses real labels as supervision, and according to equation (20), the fusion layer network-chain consistency composite loss, and Reliability deviation between and The weighted combination of changes in the fusion ratio compared to the previous round yields the fusion weight optimization loss; reliability-guided constraint coefficients. and configuration stability constraint coefficient The verification and determination methods described above are followed. A locked mask is used to update only those elements that allow automatic optimization. The candidate network parameters and candidate fusion weight configurations are obtained by performing joint effect verification according to step (4). They are deployed together only when all four deployment conditions are met, where either the macro average F1 requirement or the key category recall requirement in the second condition is met; otherwise, the previous deployment configuration is maintained.

[0157] Using globally unified fusion weights (0.25 for all four sub-models) and fixed learning rate SGD retraining as the baseline, the overall accuracy of the baseline was 91.3%. Subsequently, experiments were conducted to compare the convergence efficiency of sub-model training and to optimize the fusion weights based on class differences.

[0158] In the sub-model training comparison, DPCNN and GNN were retrained using SGD (learning rate 0.01, momentum 0.9) and Adam (learning rate 0.001), respectively, with the same data, network structure, and early stopping condition (validation set loss not decreasing for 10 consecutive epochs). The results showed that Adam reduced the number of convergence epochs for DPCNN from 168 to 47, and the training time from 326 seconds to 91 seconds; for GNN, the number of convergence epochs decreased from 182 to 53, and the training time decreased from 412 seconds to 119 seconds, validating Adam's efficiency advantage in periodic retraining.

[0159] like Figure 5 As shown, the sub-model training convergence performance comparison is illustrated by the curve of loss value changing with the number of training epochs. Adam reaches the loss threshold of 0.01 faster than SGD. The convergence results at approximately 47 and 168 epochs, as indicated in the figure, are consistent with the DPCNN comparison results mentioned above. The results for GNN, which decreased from 182 epochs to 53 epochs, are given separately in the main text. Figure 5 The current diagram represents a representative convergence curve.

[0160] In the category-differentiated weight optimization, 150 validation samples from the original data partitioning were used for fusion weight learning. Using their true labels as supervision, an 8×4 fusion weight parameter matrix was constructed and iterated using Adam for 150 rounds until convergence. Because these samples participate in the fusion weight parameter update, they should be managed as training samples for weight optimization at this stage, and not simultaneously used as independently deployed validation samples. When implementing joint deployment validation, valid validation samples that did not participate in the parameter and fusion weight gradient update of this round should be used separately. The optimized weight matrix exhibits a differentiated distribution: the GNN weights for equipment failure and power outage categories increased to 0.38 and 0.33, respectively; the LightGBM weights for weather and load categories increased to 0.42 and 0.38, respectively; the expert rule weights for archive anomaly categories increased to 0.60; and the DPCNN and expert rule weights for main station anomaly categories increased to 0.30 and 0.35, respectively. After applying this weight matrix to the test set, the overall accuracy improved from 91.3% to 94.8%, with archive anomaly accuracy improving by 7.7 percentage points and main station anomaly accuracy improving by 6.3 percentage points. Further simulations of five rounds of incremental learning (injecting approximately 100 new feedbacks per round) resulted in an accuracy improvement from 91.3% to 93.1%, 94.2%, 94.8%, 95.3%, and 95.6%, a cumulative improvement of 4.3 percentage points, while the class standard deviation decreased from 2.87% to 1.12%. In contrast, the traditional approach using SGD retraining under the same conditions only improved accuracy by 1.5 percentage points. This embodiment, using real data and control experiments, fully validates the application effects of this invention in terms of sub-model convergence efficiency, class differentiation fusion, and incremental learning stability.

[0161] like Figure 8As shown, the classification accuracy of each fault category is compared with the unified weight and Adam optimization results in the form of a bar chart, which intuitively presents the accuracy differences of the eight categories: equipment failure, communication anomaly, user behavior, weather factors, main station anomaly, equipment power outage, file anomaly and load change. Figure 8 and Figure 7 The eight categories of data remain consistent, but the "overall weighted" summary item is not plotted separately.

[0162] like Figure 7 As shown in the table, the accuracy comparison table for each fault category shows the accuracy and improvement of the two schemes, unified weight and Adam optimization, on 8 types of faults: the overall weighted accuracy improved from 91.3% to 94.8%, with archive anomalies improving by 7.7 percentage points, main site anomalies improving by 6.3 percentage points, and the remaining categories also showing varying degrees of improvement.

[0163] like Figure 6 As shown, the category-differentiated fusion weight matrix uses 8 types of anomaly root causes as rows and DPCNN, LightGBM, GNN, and expert rules as columns. A heatmap is used to show the fusion weight distribution for each category. Among them, the GNN weights for equipment failure and equipment power outage categories are 0.38 and 0.33, respectively; the LightGBM weights for weather factors and load mutation categories are 0.42 and 0.38, respectively; the expert rule weight for archive anomaly category is 0.60; and the DPCNN and expert rule weights for main station anomaly category are 0.30 and 0.35, respectively, which is consistent with the key results given in the main text.

[0164] Example 2 This embodiment proposes a self-optimizing device for tracing the root causes of data anomalies in a cyber-physical system. This device is used to implement the self-optimizing method for tracing the root causes of data anomalies in the cyber-physical system of Embodiment 1, including: The data acquisition unit is used to acquire multi-source operational data of the cyber-physical system, extract evidence features from the multi-source operational data to obtain a network-chain evidence vector, and construct a network-chain correlation matrix based on the correlation between the evidence features and the anomaly root cause category. An anomaly root cause prediction unit is used to input the multi-source running data into multiple heterogeneous sub-models containing differentiable sub-models to predict anomalies root causes, obtain the prediction probability of each sub-model, and perform weighted fusion of the prediction probabilities through a category-differentiated fusion weight parameter matrix to obtain a fusion prediction result. The training label dataset construction unit is used to obtain user feedback on the fusion prediction results to determine the real labels, associate and store the real labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results to obtain the corresponding records, and add the records that meet the backflow conditions as backflow samples to the training label dataset. The differentiable model parameter update unit is used to extract backflow samples from the training label dataset when the training label dataset meets the periodic retraining condition, input the backflow samples into the differentiable model to obtain the predicted probability of the differentiable model, calculate the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the backflow samples, calculate the network-chain consistency loss based on the difference between the network-chain root cause prior vector corresponding to the backflow samples and the predicted probability of the differentiable model, calculate the class-balanced cross-entropy loss based on the true label corresponding to the backflow samples, combine the class-balanced cross-entropy loss and the network-chain consistency loss into a network-chain consistency composite loss, and perform gradient updates on the network parameters of the differentiable model based on the network-chain consistency composite loss. The fusion weight configuration update unit is used to fix the updated differentiable sub-model network parameters and reacquire the prediction probabilities of each sub-model. Based on the reacquired prediction probabilities and the true labels, the class-model reliability matrix is ​​determined. Based on the class-model reliability matrix and the stability constraints relative to the fusion weight configuration deployed in the previous round, the class-differentiated fusion weight parameter matrix is ​​updated to obtain the updated fusion weight configuration. Update the deployment unit to deploy the updated network parameters and fusion weight configuration of the differentiable submodel.

[0165] In this embodiment, the multi-source operational data includes physical device status data, communication link status data, main station service processing status data, archive data, environmental factor data, and load behavior status data. When the data acquisition unit extracts evidence features from the multi-source operational data to obtain the network-link evidence vector, it includes the following steps: For the same abnormal event, the multi-source runtime data is time-aligned and object-associated; From the multi-source operational data after time alignment and object association, evidential features characterizing the physical equipment status, communication link status, main station business processing status, file consistency, environmental factors, and load behavior status are extracted respectively. Among them, the evidential features characterizing the physical equipment status include at least voltage deviation rate, current imbalance, power fluctuation amplitude, power factor deviation, and data missing rate; the evidential features characterizing the communication link status include at least terminal online rate, acquisition success rate, mean signal strength, communication latency, and packet loss rate; the evidential features characterizing the main station business processing status include at least interface call success rate, task queue backlog, data processing anomaly rate, and system response latency; the evidential features characterizing file consistency include at least file matching identifier, parameter configuration deviation, and household transformer relationship consistency; the evidential features characterizing environmental factors include at least temperature deviation, humidity, precipitation, and comprehensive meteorological index; and the evidential features characterizing load behavior status include at least load fluctuation coefficient, load factor, peak-valley difference rate, and deviation from historical data. State encoding is performed on various types of evidence features to convert non-numerical features into numerical representations; numerical normalization is performed on the state-encoded evidence features to map the feature values ​​of each dimension to the [0,1] interval; the normalized evidence features are concatenated in a fixed order to form a fixed-length feature vector, which serves as the network-chain evidence vector.

[0166] In this embodiment, the heterogeneous sub-model includes an expert rule sub-model. The expert rule sub-model outputs a deterministic category determination result and the corresponding confidence score through rule matching. The confidence score of the category that did not hit the rule is set to 0. The confidence scores of all categories are normalized by the Softmax function and transformed into a probability distribution with the same dimensions as the differentiable sub-model. The normalization formula is shown in formula (1) of embodiment one:

[0167] In the formula, This indicates that the expert rule sub-model determines that the input data belongs to the first... The probability of each abnormal root cause category. This represents the abnormal root cause category number. C This represents the total number of abnormal root cause categories. s i For the first i Confidence scores for each category of abnormal root causes. k For summation index variables, >0 represents the temperature coefficient.

[0168] In this embodiment, before the training label dataset construction unit associates and stores the real labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities, and fusion prediction results, it further includes: initializing self-optimizing extension fields. The self-optimizing extension fields include a real category field, a feedback type field, a return flow identifier field, and a network-chain evidence field. The real category field is initially empty, the feedback type field is initially set to no feedback, the return flow identifier field is initially set to no return flow, and the network-chain evidence field is used to store the network-chain evidence vectors corresponding to the fusion prediction results. When the training label dataset construction unit associates and stores the real labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results, it specifically writes the real labels determined by manual feedback into the real category field, writes the corresponding network-chain evidence vectors into the network-chain evidence field, and updates the feedback type field to "feedback received". When the training label dataset construction unit adds records that meet the reflow conditions as reflow samples to the training label dataset, it specifically selects valid records from those whose feedback type field is "feedback has been received" and whose reflow identifier field is "not reflowed". The unit then adds the real label of the valid record and its associated multi-source running data, network-chain evidence vector, prediction probability and fusion prediction result to the training label dataset, and updates the corresponding reflow identifier field to "reflowed" to prevent duplicate reflow.

[0169] In this embodiment, when the data acquisition unit constructs the network-chain correlation matrix based on the correlation between the evidence features and the abnormal root cause categories, it includes: determining the degree of correlation between each evidence feature and each abnormal root cause category based on the experience of experts in the power system field, wherein the degree of correlation is divided into three levels: strong correlation, weak correlation, and no correlation, and each level is assigned a corresponding integer value; filling the corresponding positions of the matrix with the correlation degree values ​​to obtain an initial integer matrix; and normalizing each column of the initial integer matrix so that the sum of the elements in each column is 1, thereby obtaining the network-chain correlation matrix. Before the differentiable model parameter update unit calculates the network-chain root cause prior vector based on the network-chain evidence vector and network-chain correlation matrix corresponding to the backflow sample, it further includes: using the backflow sample to statistically analyze the actual distribution of each evidence feature under different abnormal root cause categories, and updating the matrix elements of the network-chain correlation matrix in a moving average manner, as shown in formula (3) of Example 1:

[0170] In the formula, These are the matrix element values ​​before the update. The updated matrix element values, For learning rate, f ji Based on the statistics of recent feedback samples, the first j The evidence feature in the first Standardized contribution frequency in class samples.

[0171] In this embodiment, after the differentiable model parameter update unit extracts the recurrent samples from the training label dataset, it also adds the recurrent samples to the periodic retraining dataset; when the differentiable model parameter update unit calculates the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the recurrent samples, it includes: The network-chain evidence vectors of the backflow samples in the periodic retraining dataset are mapped to each anomaly root cause category through the network-chain correlation matrix, and then normalized to obtain the corresponding network-chain root cause prior vectors. The mathematical expression is shown in formula (4) of Example 1:

[0172] In the above formula, Indicates reflux sample s The network-chain evidence vector, This represents the transpose of the network-chain correlation matrix A. Indicates reflux sample s The network-chain root cause prior vector, softmax(·) denotes the normalized exponential function.

[0173] In this embodiment, when the differentiable model parameter update unit calculates the class-balanced cross-entropy loss based on the true labels corresponding to the backflow samples, it includes: Based on the number of backflow samples for each abnormal root cause category in the periodic retraining dataset, the corresponding category balance weights are calculated, and the mathematical expression is shown in formula (5) of Example 1:

[0174] In the above formula, C represents the total number of abnormal root cause categories. i and r These represent the anomaly root cause category number and the category summation index, respectively. and These respectively indicate that the real label belongs to the first... i Class and First r The number of training samples for each class Indicates the first i Class category balancing weights, δ >0 indicates a smoothing constant for the number of samples in each category. γ ∈[0,1] represents the class imbalance adjustment coefficient; For any differentiable model, the class-balanced cross-entropy loss is calculated based on the true label of the returned sample, the predicted probability output by the differentiable model, and the class-balanced weights. The mathematical expression is shown in formula (6) of Example 1:

[0175] In the above formula, This represents the category-balanced cross-entropy loss. ε >0 represents the numerical stability constant, and ln represents the natural logarithm. Indicates reflux sample s The true label one-hot encoding corresponds to the first i Class components, This represents the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

[0176] In this embodiment, when the differentiable model parameter update unit calculates the network-chain consistency loss based on the difference between the network-chain root cause prior vector corresponding to the backflow sample and the predicted probability of the differentiable model, the mathematical expression is as shown in formula (7) of Embodiment 1:

[0177] In the above formula, This indicates network-chain consistency loss. ε >0 represents the numerical stability constant, and C represents the total number of abnormal root cause categories. The first term represents the first root cause prior vector of the network-chain. i Each category component This represents the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

[0178] In this embodiment, the differentiable submodel parameter update unit combines the class-balanced cross-entropy loss and the network-chain consistency loss into a network-chain consistency composite loss. When updating the network parameters of the differentiable model using the network-chain consistency composite loss, the following steps are taken: The weighted combination of the category-balanced cross-entropy loss and the network-chain consistency loss yields the network-chain consistency composite loss corresponding to the differentiable submodel, and its mathematical expression is shown in formula (8) of Example 1:

[0179] In the above formula, , and These represent the category-balanced cross-entropy loss, the network-chain consistency loss, and the network-chain consistency composite loss, respectively. λ ≥0 indicates the network-chain consistency constraint coefficient; Calculate the average value of the network-chain consistency loss of each backflow sample in the current training batch, and determine the corresponding conflict modulation coefficient based on the degree of deviation of the network-chain consistency loss of each backflow sample from the average value. The mathematical expressions are shown in formulas (9) and (10) of Example 1:

[0180]

[0181] In the above formula, B represents the average network-chain consistency loss of the current training batch; B represents the number of reflow samples in the current training batch. u This represents the summation index of samples within the current training batch. Indicates reflux sample s Corresponding Differentiable Model j The conflict modulation coefficients, and These represent the lower and upper limits of the collision modulation coefficient, respectively. clip(x,a,b) means restricting x to between the lower limit a and the upper limit b. κ≥0 indicates the collision modulation intensity coefficient; The gradient of the network-chain consensus composite loss of each return sample with respect to the network parameters of the differentiable model is modulated and summarized using the conflict modulation coefficient to obtain the batch gradient after conflict modulation. The mathematical expression is shown in formula (11) of Example 1:

[0182] In the above formula, Representing the model of the three-dimensional particle j Network parameters, Indicates to Find the gradient. Indicates the first t The conflict-modulated batch gradient used for secondary parameter updates; The conflict-modulated batch gradient is input into the adaptive moment estimation process to update the first-order moment estimate and the second-order moment estimate. After bias correction, the update amount of each dimension of the network parameters of the differentiable model is determined. Specifically, if the differentiable model is a deep pyramid convolutional network, the weights of the deep pyramid convolutional layer, the parameters of the region embedding layer, and the parameters of the fully connected classification layer are updated. If the differentiable model is a graph neural network, the weights of the graph message passing layer, the attention coefficient, the parameters of the graph pooling layer, and the parameters of the node classification layer are updated.

[0183] In this embodiment, after fixing the updated network parameters of the differentiable sub-model and re-acquiring the prediction probabilities of each sub-model, the fusion weight configuration update unit also replaces the prediction probabilities of the corresponding backflow samples with the re-acquiring prediction probabilities and adds them to the weight optimization training set; when the fusion weight configuration update unit determines the category-model reliability matrix based on the re-acquiring prediction probabilities and the true labels, it includes: The fusion ratio matrix is ​​obtained by performing Softmax normalization on each row of the category-differentiated fusion weight parameter matrix. The fusion score is calculated based on the prediction probability of each sub-model under the same abnormal root cause category. Then, the fusion score of all abnormal root cause categories is normalized to obtain the fusion prediction probability. The formulas are shown in formulas (16) to (18) of Example 1:

[0184]

[0185]

[0186] In the above formula, Indicates the return sample All The fusion prediction probability is obtained by normalizing the fusion scores of each category again. Represents the numerical stability constant. Indicates the sequence number of the returned sample. This indicates that after fixing the state of the current wheel model, the first... Sub-models for refluxed samples Belongs to the The predicted probability of the class output; Indicates reflux sample Corresponding to the Fusion score of the root cause of the anomaly This represents the category-differentiated fusion weight parameter matrix. The fusion ratio matrix obtained by performing Softmax normalization row by row The Middle Line 1 Column elements, This represents the natural exponential function. Represents the category differentiation fusion weight parameter matrix The Middle Line 1 Column elements, Represents the numerical stability constant; For weight optimization, the true label in the training set is the [i]. i Number of reflux samples for each abnormal root cause category In this case, the corresponding row of the category-model reliability matrix that has been validated and deployed in the previous round will be used, and the automatic update of the fusion weight parameters corresponding to the root cause category of the anomaly will be stopped; for the weight optimization training set where the true label is the first... i Number of reflux samples for each abnormal root cause category In this case, the category-model reliability matrix is ​​calculated based on the average predicted probability of the true category output and normalized row by row, as shown in formula (19) of Example 1:

[0187] In the above formula, Indicates the first Each sub-model in the real category is The average predicted probability of the true class output on the returned samples; Indicates to The category-model reliability matrix obtained by row-by-row normalization The category-model reliability matrix represents the first... Line 1 Column elements, summation condition This indicates that it only applies to the true category. Summing of the refluxed samples.

[0188] In this embodiment, when the fusion weight configuration update unit updates the category-differentiated fusion weight parameter matrix to obtain the updated fusion weight configuration based on the category-model reliability matrix and the stability constraint relative to the fusion weight configuration deployed in the previous round, it includes: Using real labels as supervision, the composite loss of network-chain consistency in the fusion layer is determined based on the fusion prediction probability and the network-chain root cause prior, as shown in formula (20) of Example 1:

[0189] In the above formula, This indicates the total number of samples in the training set for weight optimization. Indicates the fusion layer number 1 The class balance weights of the abnormal root causes are determined by the number of class samples in the weight optimization training set using the class balance weight calculation method. Indicates sample The true label one-hot encoding corresponds to the first The components of the class, the real category is Time to take Otherwise take ; Indicates the probability of fusion prediction; Indicates sample The first in the network-chain root cause prior vector The component corresponding to the class; This represents the network-chain consistency constraint coefficient of the fusion layer, used to adjust the contribution of consistency loss to the composite loss of the fusion layer; Represents the natural logarithm; Represents the numerical stability constant; The fusion weight optimization loss is formed by combining the network-chain consistency composite loss of the fusion layer, the deviation between the fusion ratio matrix and the normalized category-model reliability matrix, and the change of the fusion ratio matrix relative to the fusion ratio matrix that has been validated and deployed in the previous round. The mathematical expression is shown in formula (21) of Example 1:

[0190] In the above formula, This represents the composite loss of network-chain consistency in the fusion layer; This represents the fusion ratio matrix for this round; This represents the category-model reliability matrix after row-by-row normalization. This represents the fusion ratio matrix that has been validated and deployed in the previous round; This represents the reliability guidance constraint coefficient, used to adjust the degree to which the fusion scaling matrix approaches the normalized reliability matrix; This represents the configuration stability constraint coefficient, used to adjust the degree of change in the fusion ratio matrix relative to the previous round of deployed configurations; denoted by Frobenius norm, whose square is the sum of the squares of all elements of the matrix; The category-differentiated fusion weight parameter matrix is ​​updated by gradient based on the fusion weight optimization loss to obtain the updated fusion weight configuration.

[0191] In this embodiment, when the fusion weight configuration update unit performs gradient update on the category-differentiated fusion weight parameter matrix based on the fusion weight optimization loss, it includes the following steps: Based on the elements in the category-differentiated fusion weight parameter matrix that have been manually covered, and the abnormal root cause categories not covered by the reflow samples used for training in this round, a locking mask with the same dimension as the category-differentiated fusion weight parameter matrix is ​​generated. M The matrix elements that are allowed to update automatically have a mask value of 1, while the matrix elements that are not allowed to update automatically have a mask value of 0. Calculate the gradient of the fusion weight optimization loss with respect to the category-differentiated fusion weight parameter matrix, and multiply the gradient element-wise with the locking mask to obtain the controlled fusion weight gradient, as shown in formula (22) of Example 1:

[0192] In the above formula, Indicates a lock mask. This indicates that the corresponding [condition] is allowed. Automatic updates This indicates that the parameter should remain unchanged; This represents element-wise multiplication of matrices; Indicates the loss of fusion weight optimization Regarding the category-differentiated fusion weight parameter matrix gradient, Indicates using the matrix before update Calculate and lock-mask-constrained controlled fusion weight gradients; The controlled fusion weight gradient is input into the adaptive moment estimation process. After moment estimation and bias correction, the unlocked fusion weight parameters are updated, while keeping the manually configured value or the previously deployed configuration value corresponding to the locked element unchanged. The formula is as shown in formula (23) of Example 1:

[0193] In the above formula, and These represent the fusion weight parameter matrices before and after this iteration, respectively. Indicates the learning rate of the fusion weights; and They represent according to Calculate and estimate the first and second moments after bias correction; This represents the numerical stability constant that prevents the denominator of the update expression from becoming zero; Upon receiving a manual weight coverage instruction, the matrix element to be locked is determined according to the abnormal root cause category and sub-model specified by the manual weight coverage instruction. The matrix element to be locked is set to the manual configuration value, and the corresponding element in the locking mask is set to 0, so that the matrix element to be locked maintains the manual configuration value in the subsequent automatic optimization process. Upon receiving a delock instruction, the corresponding element in the locking mask is restored to 1.

[0194] In this embodiment, when the update deployment unit deploys the updated network parameters and fusion weight configuration of the differentiable submodel, it includes: The updated differential model network parameters and fusion weight configuration are jointly verified. The joint verification includes calculating the overall accuracy, network-chain inconsistency rate, and fusion weight change. When the verification results meet the preset deployment conditions, the updated differential model network parameters and fusion weight configuration are jointly deployed; otherwise, the differential model network parameters and fusion weight configuration deployed in the previous round are maintained.

[0195] In this embodiment, when the verification result meets the preset deployment conditions, specifically, the following conditions are met simultaneously: The overall accuracy of the candidate configuration is no less than the overall accuracy of the configuration deployed in the previous round on the same validation set; The macro average F1 of the candidate configuration is not lower than the preset threshold, or the recall rate of all pre-specified key categories is not lower than the corresponding preset threshold. The network-chain inconsistency rate of the candidate configuration does not exceed the preset upper limit; The maximum row change of the candidate fusion ratio matrix relative to the previously deployed fusion ratio matrix does not exceed a preset safety threshold.

[0196] In this embodiment, the abnormal root cause prediction unit is also used to initialize the category-differentiated fusion weight parameter matrix. Specifically, it sets each element in the same row of the category-differentiated fusion weight parameter matrix to the same initial value so that the initial fusion ratio of each sub-model corresponding to the same abnormal root cause category is the same; or, if there is a category-differentiated fusion weight parameter matrix that has been verified and deployed in the previous round, it uses the category-differentiated fusion weight parameter matrix that has been verified and deployed in the previous round as the initial value for this round.

[0197] Example 3 This embodiment proposes a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the self-optimizing method for tracing the root causes of network-chain data anomalies in cyber-physical systems as described in Embodiment 1. In summary, this invention proposes a self-optimizing method, apparatus, and medium for tracing the root causes of network-chain data anomalies in cyber-physical systems. This method is used in a fusion tracing framework comprising four basic models: DPCNN, LightGBM, GNN, and expert rules. It can improve model training efficiency and classification accuracy while enhancing the stability of category-differentiated fusion and the controllability of the deployment process. The main contributions are as follows: 1. Improve the consistency between model predictions and electrical grid-chain evidence.

[0198] The network-chain root cause prior is jointly formed by evidence from physical devices, communication links, main station services, archives, environment, and load behavior. Introducing this prior into the differentiable sub-model and fusion layer loss can constrain the deviation between prediction results and evidence of anomalous propagation, in addition to real label supervision, reducing the likelihood of significant contradictions between predicted categories and actual network-chain states. This effect is verified through network-chain inconsistency rate and the classification performance of corresponding conflicting samples.

[0199] 2. Improve the training adequacy of class imbalanced and high-conflict samples.

[0200] The class balancing weights are determined based on the number of samples in each root cause class in the periodic backflow data, ensuring that the minority class receives appropriate weight in the loss. The conflict modulation coefficient is determined based on the network-chain consistency loss for each sample, allowing the gradient contribution of samples with different conflict levels to be adjusted in a bounded manner. This effect is validated using macro-average F1, minimum class accuracy, minority class recall, and training stability.

[0201] 3. Balancing integration reliability with configuration stability.

[0202] The category-model reliability matrix reflects the classification output quality of each sub-model under recent ground truth labels. The reliability deviation guides the fusion ratio to adapt to the model's capabilities, while configuration stability constraints limit excessive changes in the fusion ratio compared to the previous deployment configuration. This effect is validated through classification performance, inter-category performance standard deviation, and the maximum row change in fusion weights.

[0203] 4. Form a sequential, self-optimizing, and controllable deployment that conforms to the actual dependency relationships.

[0204] After the sub-model is updated, the predicted probabilities are reacquired and the fusion weights are updated again. This allows the fusion layer to adapt to the updated sub-model output, without fabricating a reverse effect of the fusion weights on the sub-model parameters. Candidate snapshots, joint validation, manual locking, conditional deployment, and rejection of rollback ensure that the continuous optimization results are controlled before being deployed to production.

[0205] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0206] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A self-optimizing method for tracing the root causes of data anomalies in a network-chain-based cyber-physical system, characterized in that, Includes the following steps: Acquire multi-source operational data of cyber-physical systems, extract evidence features from the multi-source operational data to obtain network-chain evidence vectors, and construct network-chain correlation matrices based on the correlation between the evidence features and anomaly root cause categories; The multi-source operational data is input into multiple heterogeneous sub-models containing differentiable sub-models to predict the root causes of anomalies, and the prediction probability of each sub-model is obtained. The prediction probabilities are then weighted and fused using a category-differentiated fusion weight parameter matrix to obtain the fused prediction result. Obtain user feedback on the fusion prediction results to determine the true labels, associate and store the true labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results to obtain the corresponding records, and add the records that meet the backflow conditions as backflow samples to the training label dataset. When the training label dataset meets the periodic retraining condition, backflow samples are extracted from the training label dataset, and the backflow samples are input into the differentiable model to obtain the predicted probability of the differentiable model. The network-chain root cause prior vector is calculated based on the network-chain evidence vector and network-chain association matrix corresponding to the backflow samples. The network-chain consistency loss is calculated based on the difference between the network-chain root cause prior vector corresponding to the backflow samples and the predicted probability of the differentiable model. The class-balanced cross-entropy loss is calculated based on the true label corresponding to the backflow samples. The class-balanced cross-entropy loss and the network-chain consistency loss are combined into the network-chain consistency composite loss. The network parameters of the differentiable model are updated with gradients based on the network-chain consistency composite loss. The network parameters of the differentiable sub-model are fixed and the predicted probabilities of each sub-model are reacquired. The category-model reliability matrix is ​​determined based on the reacquired predicted probabilities and the true labels. The category-model reliability matrix and the stability constraints relative to the previously deployed fusion weight configuration are used to update the category-differentiated fusion weight parameter matrix to obtain the updated fusion weight configuration. Deploy the updated network parameters and fusion weight configuration for the differentiable model.

2. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 1, characterized in that, The multi-source operational data includes physical equipment status data, communication link status data, main station service processing status data, archive data, environmental factor data, and load behavior status data. Extracting evidence features from the multi-source operational data to obtain the network-link evidence vector includes the following steps: For the same abnormal event, the multi-source runtime data is time-aligned and object-associated; From the multi-source operational data after time alignment and object association, evidential features characterizing the physical equipment status, communication link status, main station business processing status, file consistency, environmental factors, and load behavior status are extracted respectively. Among them, the evidential features characterizing the physical equipment status include at least voltage deviation rate, current imbalance, power fluctuation amplitude, power factor deviation, and data missing rate; the evidential features characterizing the communication link status include at least terminal online rate, acquisition success rate, mean signal strength, communication latency, and packet loss rate; the evidential features characterizing the main station business processing status include at least interface call success rate, task queue backlog, data processing anomaly rate, and system response latency; the evidential features characterizing file consistency include at least file matching identifier, parameter configuration deviation, and household transformer relationship consistency; the evidential features characterizing environmental factors include at least temperature deviation, humidity, precipitation, and comprehensive meteorological index; and the evidential features characterizing load behavior status include at least load fluctuation coefficient, load factor, peak-valley difference rate, and deviation from historical data. State encoding is performed on various types of evidence features to convert non-numerical features into numerical representations; numerical normalization is performed on the state-encoded evidence features to map the feature values ​​of each dimension to the [0,1] interval; the normalized evidence features are concatenated in a fixed order to form a fixed-length feature vector, which serves as the network-chain evidence vector.

3. The network-chain-based data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 1, characterized in that, The heterogeneous sub-model includes an expert rule sub-model. The expert rule sub-model outputs a deterministic class determination result and corresponding confidence score through rule matching. The confidence score of classes that do not match the rules is set to 0. The confidence scores of all classes are normalized using the Softmax function, transforming them into a probability distribution with the same dimensions as the differentiable sub-model. The normalization formula is as follows: In the formula, This indicates that the expert rule sub-model determines that the input data belongs to the first... The probability of each abnormal root cause category. This represents the abnormal root cause category number. C This represents the total number of abnormal root cause categories. s i For the first i Confidence scores for each category of abnormal root causes. k For summation index variables, >0 represents the temperature coefficient.

4. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 1, characterized in that, Before storing the real labels in association with the corresponding multi-source operational data, network-chain evidence vectors, prediction probabilities, and fusion prediction results, the method further includes: initializing self-optimizing extension fields, which include a real category field, a feedback type field, a return flow identifier field, and a network-chain evidence field. The real category field is initially empty, the feedback type field is initially set to no feedback, the return flow identifier field is initially set to no return flow, and the network-chain evidence field is used to store the network-chain evidence vectors corresponding to the fusion prediction results. When storing the real labels in association with the corresponding multi-source operational data, network-chain evidence vectors, prediction probabilities, and fusion prediction results, the real labels determined by manual feedback are written into the real category field, the corresponding network-chain evidence vectors are written into the network-chain evidence field, and the feedback type field is updated to "feedback received". When adding records that meet the reflow conditions to the training label dataset as reflow samples, the specific process involves selecting valid records from those whose feedback type field is "feedback has been received" and whose reflow identifier field is "not reflowed". The real labels of the valid records and their associated multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results are added to the training label dataset, and the corresponding reflow identifier field is updated to "reflowed" to prevent duplicate reflow.

5. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 1, characterized in that, When constructing the network-chain correlation matrix based on the correlation between the evidence features and the anomaly root cause categories, the process includes: determining the degree of correlation between each evidence feature and each anomaly root cause category based on the experience of experts in the power system field; the degree of correlation is divided into three levels: strong correlation, weak correlation, and no correlation, and each level is assigned a corresponding integer value; the degree of correlation is assigned and filled into the corresponding position of the matrix to obtain an initial integer matrix; each column of the initial integer matrix is ​​normalized so that the sum of the elements in each column is 1, thus obtaining the network-chain correlation matrix. Before calculating the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the returned samples, the method further includes: using the returned samples to statistically analyze the actual distribution of each evidence feature under different abnormal root cause categories, and updating the matrix elements of the network-chain association matrix in a moving average manner, as shown in the following mathematical expression: In the formula, These are the matrix element values ​​before the update. The updated matrix element values, For learning rate, f ji Based on the statistics of recent feedback samples, the first j The evidence feature in the first Standardized contribution frequency in class samples.

6. The network-chain-based data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 1, characterized in that, After extracting recurrent samples from the training label dataset, the method further includes: adding the recurrent samples to the periodic retraining dataset; and calculating the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the recurrent samples, including: The network-chain evidence vectors of the backflow samples in the periodic retraining dataset are mapped to each anomaly root cause category using the network-chain correlation matrix, and then normalized to obtain the corresponding network-chain root cause prior vectors. The mathematical expression is as follows: In the above formula, Indicates reflux sample s The network-chain evidence vector, This represents the transpose of the network-chain correlation matrix A. Indicates reflux sample s The network-chain root cause prior vector, softmax(·) denotes the normalized exponential function.

7. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 6, characterized in that, When calculating the category-balanced cross-entropy loss based on the true labels corresponding to the returned samples, the following steps are included: Based on the number of backflow samples for each anomaly root cause category in the periodic retraining dataset, the corresponding category balance weights are calculated, and the mathematical expression is as follows: In the above formula, C represents the total number of abnormal root cause categories. i and r These represent the anomaly root cause category number and the category summation index, respectively. and These respectively indicate that the real label belongs to the first... i Class and First r The number of training samples for each class Indicates the first i Class category balancing weights, δ >0 indicates a smoothing constant for the number of samples in each category. γ ∈[0,1] represents the class imbalance adjustment coefficient; For any differentiable model, the class-balanced cross-entropy loss is calculated based on the true labels of the returned samples, the predicted probabilities output by the differentiable model, and the class-balanced weights. The mathematical expression is as follows: In the above formula, This represents the category-balanced cross-entropy loss. ε >0 represents the numerical stability constant, and ln represents the natural logarithm. Indicates reflux sample s The true label one-hot encoding corresponds to the first i Class components, This represents the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

8. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 7, characterized in that, When calculating the network-chain consistency loss based on the difference between the network-chain root factor prior vector corresponding to the returned samples and the predicted probability of the differentiable model, the mathematical expression is as follows: In the above formula, This indicates network-chain consistency loss. ε >0 represents the numerical stability constant, and C represents the total number of abnormal root cause categories. The first term represents the first root cause prior vector of the network-chain. i Each category component This represents the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

9. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 8, characterized in that, The class-balanced cross-entropy loss and the network-chain consistency loss are combined into a network-chain consistency composite loss. When updating the network parameters of the differentiable model using the network-chain consistency composite loss, the following steps are included: The corresponding network-chain root cause prior vector is obtained. The class-balanced cross-entropy loss and the network-chain consistency loss are then weighted and combined to obtain the network-chain consistency composite loss corresponding to the differentiable submodel. The mathematical expression is as follows: In the above formula, , and These represent the category-balanced cross-entropy loss, the network-chain consistency loss, and the network-chain consistency composite loss, respectively. λ ≥0 indicates the network-chain consistency constraint coefficient; Calculate the average network-chain consistency loss of each reflow sample within the current training batch, and determine the corresponding conflict modulation coefficient based on the deviation of the network-chain consistency loss of each reflow sample from the average value. The mathematical expression is as follows: In the above formula, B represents the average network-chain consistency loss of the current training batch; B represents the number of reflow samples in the current training batch. u This represents the summation index of samples within the current training batch. Indicates reflux sample s Corresponding Differentiable Model j The conflict modulation coefficients, and These represent the lower and upper limits of the collision modulation coefficient, respectively. clip(x,a,b) means restricting x to between the lower limit a and the upper limit b. κ ≥0 indicates the collision modulation intensity coefficient; The gradient of the network-chain consensus composite loss of each return sample with respect to the network parameters of the differentiable model is modulated and summarized using the conflict modulation coefficient to obtain the conflict-modulated batch gradient, the mathematical expression of which is as follows: In the above formula, Representing the model of the three-dimensional particle j Network parameters, Indicates to Find the gradient. Indicates the first t The conflict-modulated batch gradient used for secondary parameter updates; The conflict-modulated batch gradient is input into the adaptive moment estimation process to update the first-order moment estimate and the second-order moment estimate. After bias correction, the update amount of each dimension of the network parameters of the differentiable model is determined. Specifically, if the differentiable model is a deep pyramid convolutional network, the weights of the deep pyramid convolutional layer, the parameters of the region embedding layer, and the parameters of the fully connected classification layer are updated. If the differentiable model is a graph neural network, the weights of the graph message passing layer, the attention coefficient, the parameters of the graph pooling layer, and the parameters of the node classification layer are updated.

10. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 1, characterized in that, After fixing the updated network parameters of the differentiable sub-models and re-acquiring the predicted probabilities of each sub-model, the process also includes: replacing the predicted probabilities of the corresponding re-entered samples with the re-acquired predicted probabilities and adding them to the weighted training set; when determining the class-model reliability matrix based on the re-acquired predicted probabilities and the true labels, the process includes: The fusion ratio matrix is ​​obtained by performing Softmax normalization row by row on the category-differentiated fusion weight parameter matrix. The fusion score is calculated based on the prediction probability of each sub-model under the same anomaly root cause category. Then, the fusion score of all anomaly root cause categories is normalized to obtain the fusion prediction probability, as shown in the following formula: In the above formula, Indicates the return sample All The fusion prediction probability is obtained by normalizing the fusion scores of each category again. Represents the numerical stability constant. Indicates the sequence number of the returned sample. This indicates that after fixing the state of the current wheel model, the first... Sub-models for refluxed samples Belongs to the The predicted probability of the class output; Indicates reflux sample Corresponding to the Fusion score of the root cause of the anomaly This represents the category-differentiated fusion weight parameter matrix. The fusion ratio matrix obtained by performing Softmax normalization row by row The Middle Line 1 Column elements, This represents the natural exponential function. Represents the category differentiation fusion weight parameter matrix The Middle Line 1 Column elements, Represents the numerical stability constant; For weight optimization, the true label in the training set is the [i]. i Number of reflux samples for each abnormal root cause category In this case, the corresponding row of the category-model reliability matrix that has been validated and deployed in the previous round will be used, and the automatic update of the fusion weight parameters corresponding to the root cause category of the anomaly will be stopped; for the weight optimization training set where the true label is the first... i Number of reflux samples for each abnormal root cause category In this case, the category-model reliability matrix is ​​calculated based on the average predicted probability of the true category output and normalized row by row, as shown in the following formula: In the above formula, Indicates the first Each sub-model in the real category is The average predicted probability of the true class output on the returned samples; Indicates to The category-model reliability matrix obtained by row-by-row normalization The category-model reliability matrix represents the first... Line 1 Column elements, summation condition This indicates that it only applies to the true category. Summing of the refluxed samples.

11. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 10, characterized in that, When updating the category-differentiated fusion weight parameter matrix to obtain the updated fusion weight configuration based on the category-model reliability matrix and the stability constraints relative to the previously deployed fusion weight configuration, the following steps are included: ---Using real labels as supervision, the composite loss of network-chain consistency in the fusion layer is determined based on the fusion prediction probability and the network-chain root cause prior, as shown in the following formula: In the above formula, This indicates the total number of samples in the training set for weight optimization. Indicates the fusion layer number 1 The class balance weights of the abnormal root causes are determined by the number of class samples in the weight optimization training set using the class balance weight calculation method. Indicates sample The true label one-hot encoding corresponds to the first The components of the class, the real category is Time to take Otherwise take ; Indicates the probability of fusion prediction; Indicates sample The first in the network-chain root cause prior vector The component corresponding to the class; This represents the network-chain consistency constraint coefficient of the fusion layer, used to adjust the contribution of consistency loss to the composite loss of the fusion layer; Represents the natural logarithm; Represents the numerical stability constant; The fusion weight optimization loss is calculated by combining the network-chain consistency composite loss of the fusion layer, the deviation between the fusion ratio matrix and the normalized category-model reliability matrix, and the change of the fusion ratio matrix relative to the fusion ratio matrix that has been validated and deployed in the previous round. The mathematical expression is as follows: In the above formula, This represents the composite loss of network-chain consistency in the fusion layer; This represents the fusion ratio matrix for this round; This represents the category-model reliability matrix after row-by-row normalization. This represents the fusion ratio matrix that has been validated and deployed in the previous round; This represents the reliability guidance constraint coefficient, used to adjust the degree to which the fusion scaling matrix approaches the normalized reliability matrix; This represents the configuration stability constraint coefficient, used to adjust the degree of change in the fusion ratio matrix relative to the previous round of deployed configurations; denoted by Frobenius norm, whose square is the sum of the squares of all elements of the matrix; The category-differentiated fusion weight parameter matrix is ​​updated by gradient based on the fusion weight optimization loss to obtain the updated fusion weight configuration.

12. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 11, characterized in that, When updating the category-differentiated fusion weight parameter matrix using the fusion weight optimization loss, the following steps are included: Based on the elements in the category-differentiated fusion weight parameter matrix that have been manually covered, and the abnormal root cause categories not covered by the reflow samples used for training in this round, a locking mask with the same dimension as the category-differentiated fusion weight parameter matrix is ​​generated. M The matrix elements that are allowed to update automatically have a mask value of 1, while the matrix elements that are not allowed to update automatically have a mask value of 0. The gradient of the fusion weight optimization loss with respect to the category-differentiated fusion weight parameter matrix is ​​calculated. This gradient is then multiplied element-wise by the locking mask to obtain the controlled fusion weight gradient, as shown in the following formula: In the above formula, Indicates a lock mask. This indicates that the corresponding [condition] is allowed. Automatic updates This indicates that the parameter should remain unchanged; This indicates element-wise multiplication of matrices; Indicates the loss of fusion weight optimization Regarding the category-differentiated fusion weight parameter matrix gradient, Indicates using the matrix before update Calculate and lock-mask-constrained controlled fusion weight gradients; The controlled fusion weight gradient is input into the adaptive moment estimation process. After moment estimation and bias correction, the unlocked fusion weight parameters are updated, while keeping the manually configured values ​​or previously deployed configuration values ​​corresponding to the locked elements unchanged. The formula is as follows: In the above formula, and These represent the fusion weight parameter matrices before and after this iteration, respectively. Indicates the learning rate of the fusion weights; and They represent according to Calculate and estimate the first and second moments after bias correction; This represents the numerical stability constant that prevents the denominator of the update expression from becoming zero; Upon receiving a manual weight coverage instruction, the matrix element to be locked is determined according to the abnormal root cause category and sub-model specified by the manual weight coverage instruction. The matrix element to be locked is set to the manual configuration value, and the corresponding element in the locking mask is set to 0, so that the matrix element to be locked maintains the manual configuration value in the subsequent automatic optimization process. Upon receiving a delock instruction, the corresponding element in the locking mask is restored to 1.

13. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 1, characterized in that, When deploying the updated network parameters and fusion weights for the differentiable submodel, the following should be included: The updated differential model network parameters and fusion weight configuration are jointly verified. The joint verification includes calculating the overall accuracy, network-chain inconsistency rate, and fusion weight change. When the verification results meet the preset deployment conditions, the updated differential model network parameters and fusion weight configuration are jointly deployed; otherwise, the differential model network parameters and fusion weight configuration deployed in the previous round are maintained.

14. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 13, characterized in that, When the verification results meet the preset deployment conditions, specifically, the following conditions must be met simultaneously: The overall accuracy of the candidate configuration is no less than the overall accuracy of the configuration deployed in the previous round on the same validation set; The macro average F1 of the candidate configuration is not lower than the preset threshold, or the recall rate of all pre-specified key categories is not lower than the corresponding preset threshold. The network-chain inconsistency rate of the candidate configuration does not exceed the preset upper limit; The maximum row change of the candidate fusion ratio matrix relative to the fusion ratio matrix deployed in the previous round does not exceed a preset safety threshold.

15. The network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to claim 1, characterized in that, Also includes: Initialize the category differentiation fusion weight parameter matrix by setting each element in the same row of the category differentiation fusion weight parameter matrix to the same initial value so that the initial fusion ratio of each sub-model corresponding to the same abnormal root cause category is the same; or, if there is a category differentiation fusion weight parameter matrix that has been verified and deployed in the previous round, use the category differentiation fusion weight parameter matrix that has been verified and deployed in the previous round as the initial value for this round.

16. A network-chain-based data anomaly root cause tracing and self-optimizing device for a cyber-physical system, characterized in that, include: The data acquisition unit is used to acquire multi-source operational data of the cyber-physical system, extract evidence features from the multi-source operational data to obtain a network-chain evidence vector, and construct a network-chain correlation matrix based on the correlation between the evidence features and the anomaly root cause category. An anomaly root cause prediction unit is used to input the multi-source running data into multiple heterogeneous sub-models containing differentiable sub-models to predict anomalies root causes, obtain the prediction probability of each sub-model, and perform weighted fusion of the prediction probabilities through a category-differentiated fusion weight parameter matrix to obtain a fusion prediction result. The training label dataset construction unit is used to obtain user feedback on the fusion prediction results to determine the real labels, associate and store the real labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results to obtain the corresponding records, and add the records that meet the backflow conditions as backflow samples to the training label dataset. The differentiable model parameter update unit is used to extract backflow samples from the training label dataset when the training label dataset meets the periodic retraining condition, input the backflow samples into the differentiable model to obtain the predicted probability of the differentiable model, calculate the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the backflow samples, calculate the network-chain consistency loss based on the difference between the network-chain root cause prior vector corresponding to the backflow samples and the predicted probability of the differentiable model, calculate the class-balanced cross-entropy loss based on the true label corresponding to the backflow samples, combine the class-balanced cross-entropy loss and the network-chain consistency loss into a network-chain consistency composite loss, and perform gradient updates on the network parameters of the differentiable model based on the network-chain consistency composite loss. The fusion weight configuration update unit is used to fix the updated differentiable sub-model network parameters and reacquire the prediction probabilities of each sub-model. Based on the reacquired prediction probabilities and the true labels, the class-model reliability matrix is ​​determined. Based on the class-model reliability matrix and the stability constraints relative to the fusion weight configuration deployed in the previous round, the class-differentiated fusion weight parameter matrix is ​​updated to obtain the updated fusion weight configuration. Update the deployment unit to deploy the updated network parameters and fusion weight configuration of the differentiable submodel.

17. The network-chain data anomaly root cause tracing self-optimization device for cyber-physical systems according to claim 16, characterized in that, The multi-source operational data includes physical equipment status data, communication link status data, main station service processing status data, archive data, environmental factor data, and load behavior status data. When the data acquisition unit extracts evidence features from the multi-source operational data to obtain the network-link evidence vector, it includes the following steps: For the same abnormal event, the multi-source runtime data is time-aligned and object-associated; From the multi-source operational data after time alignment and object association, evidential features characterizing the physical equipment status, communication link status, main station business processing status, file consistency, environmental factors, and load behavior status are extracted respectively. Among them, the evidential features characterizing the physical equipment status include at least voltage deviation rate, current imbalance, power fluctuation amplitude, power factor deviation, and data missing rate; the evidential features characterizing the communication link status include at least terminal online rate, acquisition success rate, mean signal strength, communication latency, and packet loss rate; the evidential features characterizing the main station business processing status include at least interface call success rate, task queue backlog, data processing anomaly rate, and system response latency; the evidential features characterizing file consistency include at least file matching identifier, parameter configuration deviation, and household transformer relationship consistency; the evidential features characterizing environmental factors include at least temperature deviation, humidity, precipitation, and comprehensive meteorological index; and the evidential features characterizing load behavior status include at least load fluctuation coefficient, load factor, peak-valley difference rate, and deviation from historical data. State encoding is performed on various types of evidence features to convert non-numerical features into numerical representations; numerical normalization is performed on the state-encoded evidence features to map the feature values ​​of each dimension to the [0,1] interval; the normalized evidence features are concatenated in a fixed order to form a fixed-length feature vector, which serves as the network-chain evidence vector.

18. The network-chain data anomaly root cause tracing self-optimization device for cyber-physical systems according to claim 16, characterized in that, The heterogeneous sub-model includes an expert rule sub-model. The expert rule sub-model outputs a deterministic class determination result and corresponding confidence score through rule matching. The confidence score of classes that do not match the rules is set to 0. The confidence scores of all classes are normalized using the Softmax function, transforming them into a probability distribution with the same dimensions as the differentiable sub-model. The normalization formula is as follows: In the formula, This indicates that the expert rule sub-model determines that the input data belongs to the first... The probability of each abnormal root cause category. This represents the abnormal root cause category number. C This represents the total number of abnormal root cause categories. s i For the first i Confidence scores for each category of abnormal root causes. k For summation index variables, >0 represents the temperature coefficient.

19. The network-chain data anomaly root cause tracing self-optimization device for cyber-physical systems according to claim 16, characterized in that, Before the training label dataset construction unit associates and stores the real labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities, and fusion prediction results, it further includes: initializing self-optimizing extension fields. The self-optimizing extension fields include a real category field, a feedback type field, a return flow identifier field, and a network-chain evidence field. The real category field is initially empty, the feedback type field is initially set to no feedback, the return flow identifier field is initially set to no return flow, and the network-chain evidence field is used to store the network-chain evidence vectors corresponding to the fusion prediction results. When the training label dataset construction unit associates and stores the real labels with the corresponding multi-source running data, network-chain evidence vectors, prediction probabilities and fusion prediction results, it specifically writes the real labels determined by manual feedback into the real category field, writes the corresponding network-chain evidence vectors into the network-chain evidence field, and updates the feedback type field to "feedback received". When the training label dataset construction unit adds records that meet the reflow conditions as reflow samples to the training label dataset, it specifically selects valid records from those whose feedback type field is "feedback has been received" and whose reflow identifier field is "not reflowed". The unit then adds the real label of the valid record and its associated multi-source running data, network-chain evidence vector, prediction probability and fusion prediction result to the training label dataset, and updates the corresponding reflow identifier field to "reflowed" to prevent duplicate reflow.

20. The network-chain data anomaly root cause tracing self-optimizing device for cyber-physical systems according to claim 16, characterized in that, When the data acquisition unit constructs the network-chain correlation matrix based on the correlation between the evidence features and the anomaly root cause categories, the process includes: determining the degree of correlation between each evidence feature and each anomaly root cause category based on the experience of experts in the power system field; the degree of correlation is divided into three levels: strong correlation, weak correlation, and no correlation, and each level is assigned a corresponding integer value; the degree of correlation is assigned and filled into the corresponding position of the matrix to obtain an initial integer matrix; and each column of the initial integer matrix is ​​normalized so that the sum of the elements in each column is 1, thus obtaining the network-chain correlation matrix. Before the differentiable submodel parameter update unit calculates the network-chain root cause prior vector based on the network-chain evidence vector and network-chain correlation matrix corresponding to the backflow samples, it further includes: using the backflow samples to statistically analyze the actual distribution of each evidence feature under different abnormal root cause categories, and updating the matrix elements of the network-chain correlation matrix in a moving average manner, as shown in the following mathematical expression: In the formula, These are the matrix element values ​​before the update. The updated matrix element values, For learning rate, f ji Based on the statistics of recent feedback samples, the first j The evidence feature in the first Standardized contribution frequency in class samples.

21. The network-chain data anomaly root cause tracing self-optimizing device for cyber-physical systems according to claim 16, characterized in that, After extracting backflow samples from the training label dataset, the differentiable model parameter update unit also adds the backflow samples to the periodic retraining dataset; when calculating the network-chain root cause prior vector based on the network-chain evidence vector and network-chain association matrix corresponding to the backflow samples, the differentiable model parameter update unit includes: The network-chain evidence vectors of the backflow samples in the periodic retraining dataset are mapped to each anomaly root cause category using the network-chain correlation matrix, and then normalized to obtain the corresponding network-chain root cause prior vectors. The mathematical expression is as follows: In the above formula, Indicates reflux sample s The network-chain evidence vector, This represents the transpose of the network-chain correlation matrix A. Indicates reflux sample s The network-chain root cause prior vector, softmax(·) denotes the normalized exponential function.

22. The network-chain data anomaly root cause tracing self-optimization device for cyber-physical systems according to claim 21, characterized in that, When the differentiable model parameter update unit calculates the class-balanced cross-entropy loss based on the true labels corresponding to the returned samples, it includes: Based on the number of backflow samples for each anomaly root cause category in the periodic retraining dataset, the corresponding category balance weights are calculated, and the mathematical expression is as follows: In the above formula, C represents the total number of abnormal root cause categories. i and r These represent the anomaly root cause category number and the category summation index, respectively. and These respectively indicate that the real label belongs to the first... i Class and First r The number of training samples for each class Indicates the first i Class category balancing weights, δ >0 indicates a smoothing constant for the number of samples in each category. γ ∈[0,1] represents the class imbalance adjustment coefficient; For any differentiable model, the class-balanced cross-entropy loss is calculated based on the true labels of the returned samples, the predicted probabilities output by the differentiable model, and the class-balanced weights. The mathematical expression is as follows: In the above formula, This represents the category-balanced cross-entropy loss. ε >0 represents the numerical stability constant, and ln represents the natural logarithm. Indicates reflux sample s The true label one-hot encoding corresponds to the first i Class components, This represents the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

23. The network-chain data anomaly root cause tracing self-optimization device for cyber-physical systems according to claim 22, characterized in that, When the differentiable model parameter update unit calculates the network-chain consistency loss based on the difference between the network-chain root cause prior vector corresponding to the backflow sample and the predicted probability of the differentiable model, the mathematical expression is as follows: In the above formula, This indicates network-chain consistency loss. ε >0 represents the numerical stability constant, and C represents the total number of abnormal root cause categories. The first term represents the first root cause prior vector of the network-chain. i Each category component This represents the predicted probability that the training sample s output by the differentiable model j belongs to the i-th class.

24. The network-chain data anomaly root cause tracing self-optimization device for cyber-physical systems according to claim 23, characterized in that, The differentiable submodel parameter update unit combines the class-balanced cross-entropy loss and the network-chain consistency loss into a network-chain consistency composite loss. When updating the network parameters of the differentiable model using the network-chain consistency composite loss, it includes: The weighted combination of the category-balanced cross-entropy loss and the network-chain consistency loss yields the network-chain consistency composite loss corresponding to the differentiable submodel, as expressed mathematically below: In the above formula, , and These represent the category-balanced cross-entropy loss, the network-chain consistency loss, and the network-chain consistency composite loss, respectively. λ ≥0 indicates the network-chain consistency constraint coefficient; Calculate the average network-chain consistency loss of each reflow sample within the current training batch, and determine the corresponding conflict modulation coefficient based on the deviation of the network-chain consistency loss of each reflow sample from the average value. The mathematical expression is as follows: In the above formula, B represents the average network-chain consistency loss of the current training batch; B represents the number of reflow samples in the current training batch. u This represents the summation index of samples within the current training batch. Indicates reflux sample s Corresponding Differentiable Model j The conflict modulation coefficients, and These represent the lower and upper limits of the collision modulation coefficient, respectively. clip(x,a,b) means restricting x to between the lower limit a and the upper limit b. κ ≥0 indicates the collision modulation intensity coefficient; The gradient of the network-chain consensus composite loss of each return sample with respect to the network parameters of the differentiable model is modulated and summarized using the conflict modulation coefficient to obtain the conflict-modulated batch gradient, the mathematical expression of which is as follows: In the above formula, Representing the model of the three-dimensional particle j Network parameters, Indicates to Find the gradient. Indicates the first t The conflict-modulated batch gradient used for secondary parameter updates; The conflict-modulated batch gradient is input into the adaptive moment estimation process to update the first-order moment estimate and the second-order moment estimate. After bias correction, the update amount of each dimension of the network parameters of the differentiable model is determined. Specifically, if the differentiable model is a deep pyramid convolutional network, the weights of the deep pyramid convolutional layer, the parameters of the region embedding layer, and the parameters of the fully connected classification layer are updated. If the differentiable model is a graph neural network, the weights of the graph message passing layer, the attention coefficient, the parameters of the graph pooling layer, and the parameters of the node classification layer are updated.

25. The network-chain data anomaly root cause tracing self-optimization device for cyber-physical systems according to claim 16, characterized in that, The fusion weight configuration update unit fixes the updated differentiable sub-model network parameters and re-acquires the prediction probabilities of each sub-model. Then, it replaces the prediction probabilities of the corresponding backflow samples with the re-acquired prediction probabilities and adds them to the weight optimization training set. When the fusion weight configuration update unit determines the category-model reliability matrix based on the reacquired predicted probabilities and true labels, it includes: The fusion ratio matrix is ​​obtained by performing Softmax normalization row by row on the category-differentiated fusion weight parameter matrix. The fusion score is calculated based on the prediction probability of each sub-model under the same anomaly root cause category. Then, the fusion score of all anomaly root cause categories is normalized to obtain the fusion prediction probability, as shown in the following formula: In the above formula, Indicates the return sample All The fusion prediction probability is obtained by normalizing the fusion scores of each category again. Represents the numerical stability constant. Indicates the sequence number of the returned sample. This indicates that after fixing the state of the current wheel model, the first... Sub-models for refluxed samples Belongs to the The predicted probability of the class output; Indicates reflux sample Corresponding to the Fusion score of the root cause of the anomaly This represents the category-differentiated fusion weight parameter matrix. The fusion ratio matrix obtained by performing Softmax normalization row by row The Middle Line 1 Column elements, This represents the natural exponential function. Represents the category differentiation fusion weight parameter matrix The Middle Line 1 Column elements, Represents the numerical stability constant; For weight optimization, the true label in the training set is the [i]. i Number of reflux samples for each abnormal root cause category In this case, the corresponding row of the category-model reliability matrix that has been validated and deployed in the previous round will be used, and the automatic update of the fusion weight parameters corresponding to the root cause category of the anomaly will be stopped; for the weight optimization training set where the true label is the first... i Number of reflux samples for each abnormal root cause category In this case, the category-model reliability matrix is ​​calculated based on the average predicted probability of the true category output and normalized row by row, as shown in the following formula: In the above formula, Indicates the first Each sub-model in the real category is The average predicted probability of the true class output on the returned samples; Indicates to The category-model reliability matrix obtained by row-by-row normalization The category-model reliability matrix represents the first... Line 1 Column elements, summation condition This indicates that it only applies to the true category. Summing of the refluxed samples.

26. The network-chain data anomaly root cause tracing self-optimizing device for cyber-physical systems according to claim 25, characterized in that, When the fusion weight configuration update unit updates the category-differentiated fusion weight parameter matrix to obtain the updated fusion weight configuration based on the category-model reliability matrix and the stability constraints relative to the fusion weight configuration deployed in the previous round, it includes: Using real labels as supervision, the composite loss of network-chain consistency in the fusion layer is determined based on the fusion prediction probability and the network-chain root cause prior, as shown in the following formula: In the above formula, This indicates the total number of samples in the training set for weight optimization. Indicates the fusion layer number 1 The class balance weights of the abnormal root causes are determined by the number of class samples in the weight optimization training set using the class balance weight calculation method. Indicates sample The true label one-hot encoding corresponds to the first The components of the class, the real category is Time to take Otherwise take ; Indicates the probability of fusion prediction; Indicates sample The first in the network-chain root cause prior vector The component corresponding to the class; This represents the network-chain consistency constraint coefficient of the fusion layer, used to adjust the contribution of consistency loss to the composite loss of the fusion layer; Represents the natural logarithm; Represents the numerical stability constant; The fusion weight optimization loss is calculated by combining the network-chain consistency composite loss of the fusion layer, the deviation between the fusion ratio matrix and the normalized category-model reliability matrix, and the change of the fusion ratio matrix relative to the fusion ratio matrix that has been validated and deployed in the previous round. The mathematical expression is as follows: In the above formula, This represents the composite loss of network-chain consistency in the fusion layer; This represents the fusion ratio matrix for this round; This represents the category-model reliability matrix after row-by-row normalization. This represents the fusion ratio matrix that has been validated and deployed in the previous round; This represents the reliability guidance constraint coefficient, used to adjust the degree to which the fusion scaling matrix approaches the normalized reliability matrix; This represents the configuration stability constraint coefficient, used to adjust the degree of change in the fusion ratio matrix relative to the previous round of deployed configurations; denoted by Frobenius norm, whose square is the sum of the squares of all elements of the matrix; The category-differentiated fusion weight parameter matrix is ​​updated by gradient based on the fusion weight optimization loss to obtain the updated fusion weight configuration.

27. The network-chain data anomaly root cause tracing self-optimizing device for cyber-physical systems according to claim 26, characterized in that, When the fusion weight configuration update unit performs gradient update on the category-differentiated fusion weight parameter matrix based on the fusion weight optimization loss, it includes the following steps: Based on the elements in the category-differentiated fusion weight parameter matrix that have been manually covered, and the abnormal root cause categories not covered by the reflow samples used for training in this round, a locking mask with the same dimension as the category-differentiated fusion weight parameter matrix is ​​generated. M The matrix elements that are allowed to update automatically have a mask value of 1, while the matrix elements that are not allowed to update automatically have a mask value of 0. The gradient of the fusion weight optimization loss with respect to the category-differentiated fusion weight parameter matrix is ​​calculated. This gradient is then multiplied element-wise by the locking mask to obtain the controlled fusion weight gradient, as shown in the following formula: In the above formula, Indicates a lock mask. This indicates that the corresponding [condition] is allowed. Automatic updates This indicates that the parameter should remain unchanged; This indicates element-wise multiplication of matrices; Indicates the loss of fusion weight optimization Regarding the category-differentiated fusion weight parameter matrix gradient, Indicates using the matrix before update Calculate and lock-mask-constrained controlled fusion weight gradients; The controlled fusion weight gradient is input into the adaptive moment estimation process. After moment estimation and bias correction, the unlocked fusion weight parameters are updated, while keeping the manually configured values ​​or previously deployed configuration values ​​corresponding to the locked elements unchanged. The formula is as follows: In the above formula, and These represent the fusion weight parameter matrices before and after this iteration, respectively. Indicates the learning rate of the fusion weights; and They represent according to Calculate and estimate the first and second moments after bias correction; This represents the numerical stability constant that prevents the denominator of the update expression from becoming zero; Upon receiving a manual weight coverage instruction, the matrix element to be locked is determined according to the abnormal root cause category and sub-model specified by the manual weight coverage instruction. The matrix element to be locked is set to the manual configuration value, and the corresponding element in the locking mask is set to 0, so that the matrix element to be locked maintains the manual configuration value in the subsequent automatic optimization process. Upon receiving a delock instruction, the corresponding element in the locking mask is restored to 1.

28. The network-chain data anomaly root cause tracing self-optimizing device for cyber-physical systems according to claim 16, characterized in that, When the update deployment unit deploys the updated network parameters and fusion weight configuration of the differentiable submodel, it includes: The updated differential model network parameters and fusion weight configuration are jointly verified. The joint verification includes calculating the overall accuracy, network-chain inconsistency rate, and fusion weight change. When the verification results meet the preset deployment conditions, the updated differential model network parameters and fusion weight configuration are jointly deployed; otherwise, the differential model network parameters and fusion weight configuration deployed in the previous round are maintained.

29. The network-chain data anomaly root cause tracing self-optimizing device for cyber-physical systems according to claim 28, characterized in that, When the verification results meet the preset deployment conditions, specifically, the following conditions must be met simultaneously: The overall accuracy of the candidate configuration is no less than the overall accuracy of the configuration deployed in the previous round on the same validation set; The macro average F1 of the candidate configuration is not lower than the preset threshold, or the recall rate of all pre-specified key categories is not lower than the corresponding preset threshold. The network-chain inconsistency rate of the candidate configuration does not exceed the preset upper limit; The maximum row change of the candidate fusion ratio matrix relative to the fusion ratio matrix deployed in the previous round does not exceed a preset safety threshold.

30. The network-chain data anomaly root cause tracing self-optimization device for cyber-physical systems according to claim 16, characterized in that, The abnormal root cause prediction unit is also used to initialize the category-differentiated fusion weight parameter matrix. Specifically, it sets each element in the same row of the category-differentiated fusion weight parameter matrix to the same initial value so that the initial fusion ratio of each sub-model corresponding to the same abnormal root cause category is the same; or, if there is a category-differentiated fusion weight parameter matrix that has been validated and deployed in the previous round, it uses the category-differentiated fusion weight parameter matrix that has been validated and deployed in the previous round as the initial value for this round.

31. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the network-chain data anomaly root cause tracing self-optimization method for cyber-physical systems according to any one of claims 1 to 15.

Images