A method for pattern discovery and real-time anomaly detection based on knowledge graph, comprising: based on a dataset including messages collected within a certain period, constructing a local knowledge graph (KG); applying a statistical relational learning (SRL) model to predict hidden relations between entities to obtain an updated local KG; from all SPO triples of the updated local KG, discovering a normalcy pattern that includes frequent entities, frequent relations, and frequent SPO triples; and in response to receiving streaming data from a message bus, extracting a plurality of entities, a plurality of relations, and a plurality of SPO triples, from the streaming data for comparison with the normalcy pattern using semantic distance, thereby determining whether there is an abnormal entity, relation, or SPO triple in the streaming data.