Mine abnormal event real-time identification method and system based on time sequence characteristics

Abstract

The invention provides a mine abnormal event real-time identification method and system based on time sequence characteristics, and relates to the technical field of mode identification, and the method comprises the steps: carrying out the time-space alignment and semantic annotation of multi-modal monitoring data, and constructing a time sequence knowledge graph; calculating a dynamic association weight between entities, and analyzing a risk propagation path; predicting a risk situation based on a historical evolution rule; and dynamically generating a differential early warning strategy and establishing a closed-loop tracking system. According to the invention, early identification, accurate prediction and efficient disposal of mine safety risks can be realized, and the mine safety management level is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to pattern recognition technology, and in particular to a mine abnormal event real-time identification method and system based on time sequence characteristics. BACKGROUND

[0002] With the continuous increase of mining depth and the continuous expansion of production scale, the risks and challenges of mine safety production are becoming increasingly severe. The safety risks in the mine environment have the characteristics of strong concealment, high suddenness and fast spread, and once a safety accident occurs, it often causes heavy casualties and property losses. At present, mine safety monitoring systems have widely deployed various types of sensing devices to collect real-time environmental parameters such as temperature, humidity, gas concentration, dust concentration, and wind speed, providing data support for safety production. Traditional mine safety monitoring mainly relies on threshold alarm, which triggers an alarm when a certain index exceeds the preset threshold. With the development of Internet of Things, big data and artificial intelligence technology, mine safety monitoring systems gradually develop towards intelligence, networking and integration, and through analysis and mining of massive monitoring data, safety hazards are found in time to prevent accidents.

[0003] The prior art mainly focuses on anomaly detection of a single sensor or a single parameter, and it is difficult to comprehensively consider the spatio-temporal correlation and interaction between multi-modal data, which leads to the inability to accurately grasp the overall situation and evolution law of safety risks. Traditional methods often process various types of monitoring data separately, lack in-depth mining of the relationships between safety element entities, and are difficult to build a systematic knowledge structure reflecting the complex environment of the mine, thereby affecting the early identification effect of abnormal events.

[0004] The prior art has limitations in risk propagation path analysis, mostly using static risk assessment models, which cannot dynamically reflect the changes in the correlation strength between safety element entities under different time windows, and are difficult to accurately depict the propagation characteristics and evolution trend of risks in the spatio-temporal dimension. This makes it difficult for safety management personnel to anticipate the development direction and influence range of potential risks, and to take targeted preventive measures. SUMMARY

[0005] The embodiment of the present application provides a mine abnormal event real-time identification method and system based on time sequence characteristics, which can solve the problems in the prior art.

[0006] In a first aspect of the embodiment of the present application, a mine abnormal event real-time identification method based on time sequence characteristics is provided, comprising: obtaining multi-modal monitoring data collected by a distributed sensor in a mine, and performing spatio-temporal alignment and semantic annotation on the multi-modal monitoring data, analyzing and identifying safety element entities and their attribute characteristics, and constructing a time sequence knowledge graph based on the safety element entities and the attribute characteristics; mapping between entities in the time sequence knowledge graph is established, and dynamic correlation weights between entities in different time windows are calculated; based on the dynamic correlation weights, a propagation path of a security risk is analyzed to obtain a risk propagation link set; For each link in the risk propagation link set, a risk development trend is obtained by recursive calculation, and based on the historical evolution rule in the time sequence knowledge graph, a risk situation at a future time step is predicted to generate a risk prediction result; According to the correlation degree of the risk prediction result and the risk propagation link, a differentiated early warning strategy is dynamically generated; at the same time, a closed-loop tracking system of early warning response is established, and the early warning result, disposal process and actual effect are included in the decision basis of system optimization, and through deep mining of the emergency management experience of each region, a continuously optimized early warning and emergency management ecology is formed.

[0007] The multi-modal monitoring data are spatio-temporally aligned and semantically annotated, and safety element entities and their attribute features are analyzed and identified, and a time sequence knowledge graph is constructed based on the safety element entities and the attribute features, including: The different modal data streams in the multi-modal monitoring data are time sequence calibrated according to the time stamp, and the data collected by different spatial nodes are spatially registered based on the spatial position mapping relationship, to obtain a unified data representation after spatio-temporal alignment; The data items in the unified data representation are semantically analyzed using a pre-trained domain knowledge base and ontology model, the entity types, inter-entity relationship types and entity attributes corresponding to the data items are identified, and consistency checking and conflict resolution are performed to ensure the accuracy of the annotation results, to obtain standardized data after semantic annotation; From the standardized data after semantic annotation, safety element entities are identified, and for each safety element entity, its corresponding static attribute features and dynamic behavior features are extracted based on the entity types, inter-entity relationship types and entity attributes, to construct an entity-feature mapping set; Based on the safety element entities and their corresponding entity-feature mapping set, an initial time sequence knowledge graph is constructed, and the initial time sequence knowledge graph is verified for topological integrity using the inter-entity relationship types, to identify isolated nodes and broken paths in the graph, and to complete the missing entity relationships in combination with relationship reasoning rules, to finally form a complete time sequence knowledge graph.

[0008] Based on the safety element entities and their corresponding entity-feature mapping set, an initial time sequence knowledge graph is constructed, and the initial time sequence knowledge graph is verified for topological integrity using the inter-entity relationship types, to identify isolated nodes and broken paths in the graph, and to complete the missing entity relationships in combination with relationship reasoning rules, to finally form a complete time sequence knowledge graph. The security element entity is taken as a node set, and each node is given an attribute vector according to an entity-feature mapping set; a directed edge set between nodes is constructed based on the relationship type between entities, and a relationship strength measurement value and a time sequence evolution constraint are attached to each directed edge; the node set, the attribute vector and the directed edge set are combined to form a topology structure of an initial time sequence knowledge graph; Topology integrity verification is performed on the initial time sequence knowledge graph, the in-degree and out-degree of each node are calculated by traversing the directed edge set, nodes with both in-degree and out-degree of zero are identified as isolated nodes, and broken paths caused by the lack of necessary intermediate nodes are detected through path connectivity analysis; For the isolated nodes identified in the topology integrity verification, potential associated relationships are queried in the domain ontology model based on the relationship type between entities, and associated edges are supplemented for the isolated nodes according to the query results to eliminate the isolated state; For the broken paths identified in the topology integrity verification, the semantic association between the starting point and the ending point of the path is analyzed, and the missing intermediate entities and their associated relationships are inferred using relationship reasoning rules to complete the broken paths in the initial time sequence knowledge graph.

[0009] An associated mapping between entities is established in the time sequence knowledge graph, and dynamic association weights between entities under different time windows are calculated; based on the dynamic association weights, the propagation path of the security risk is analyzed to obtain a risk propagation link set, including: The entity nodes and the edge relationships between them are extracted from the time sequence knowledge graph, an associated mapping matrix between entities is established based on semantic types and directionality, and for different time windows, dynamic association weight matrices between entities are calculated through a time sequence-aware graph attention mechanism according to the state change sequence of the entities in the time window and the causal dependency relationship between entities; Based on the dynamic association weight matrix, the corresponding entity pair positions in the associated mapping matrix are weighted, and the entity nodes, the edge relationships and their weights are combined to form a weighted graph structure associated with the time window; In the weighted graph structure, the identified risk source node is selected as the starting point, edges with weights exceeding a preset propagation threshold are selected based on dynamic association weights, the propagation trajectory of the risk from the source node to the downstream node is tracked through a path search strategy combining breadth-first traversal and depth-first traversal, and multiple paths involved in the propagation trajectory are aggregated and deduplicated, finally obtaining a risk propagation link set.

[0010] The propagation trajectory of the risk from the source node to the downstream node is tracked through a path search strategy combining breadth-first traversal and depth-first traversal, and multiple paths involved in the propagation trajectory are aggregated and deduplicated, including: The propagation trajectory of the risk from the source node to the downstream node is tracked by a path search strategy combining breadth-first traversal and depth-first traversal, wherein the breadth-first traversal sequentially accesses all adjacent nodes of each level based on a node queue to build the propagation range of the risk at the current level and obtain a node set of each level; the depth-first traversal preferentially explores the vertical extension direction of a single path along the weight edge based on a node stack until the propagation termination condition is reached to obtain a node sequence of each extended path; In each iteration, the breadth-first traversal is first performed to determine the level propagation range based on the node sequence, the depth-first traversal is performed to explore the extended path of each node, the propagation trajectory is integrated, and multiple paths involved in the propagation trajectory are aggregated and de-duplicated.

[0011] For each link in the set of risk propagation links, the risk development trend is obtained by recursive calculation, and the risk situation at the future time step is predicted based on the historical evolution law in the time sequence knowledge graph to generate a risk prediction result, including: For each link in the set of risk propagation links, a state transition matrix is constructed based on the weight relationship between adjacent nodes in the link, and a state migration probability distribution is trained in combination with the historical state sequence of the node, and the development trend value and trend confidence of the risk on the corresponding link are obtained by recursive operation of the chain condition probability; the sensitivity coefficient of each node in the link propagation process is calculated, and the development trend value is optimized based on the sensitivity coefficient to obtain an optimized trend value considering the influence degree of the node; In the time sequence knowledge graph, similar historical propagation paths and their evolution characteristics of the corresponding link are identified, the structural similarity and state similarity between the current link and the historical path are calculated, and the evolution contribution of each historical path is determined based on the structural similarity and the state similarity; the evolution law of the historical path is constructed according to the evolution contribution; the optimized trend value is associated and integrated with the evolution law, and the risk situation at the future time step is predicted based on the trend confidence to generate a risk prediction result.

[0012] According to the correlation degree of the risk prediction result and the risk propagation link, a differentiated early warning strategy is dynamically generated; at the same time, a closed-loop tracking system of early warning response is established, and the early warning result, disposal process and actual effect are included in the decision basis of system optimization, and the practical experience of emergency management in each region is deeply mined, including: According to the correlation degree of the risk prediction result and the risk propagation link, the early warning response rules are determined according to the risk level and the propagation range of different links, the risk threshold is set at multiple levels, the risk threshold is dynamically adjusted based on the spatio-temporal evolution characteristics of risk propagation, and a differentiated early warning strategy is generated; The differentiated early warning strategy is used to generate early warning information according to the early warning response rule, the emergency disposal process and the actual disposal effect of each early warning triggering are recorded as optimization data, the early warning information and the optimization data are time-matched, the early warning accuracy and the disposal effectiveness are calculated based on the time-matching result, the early warning response rule is perfected in a targeted manner, the early warning result, the disposal process and the actual effect in the optimization data are included in the decision basis of system optimization, and the practical experience of emergency management in each region is deeply mined.

[0013] In a second aspect, the embodiment of the present application provides a mine abnormal event real-time identification system based on time sequence characteristics, which comprises: An acquisition unit is configured to acquire multi-modal monitoring data collected by a mine distributed sensor, perform space-time alignment and semantic labeling on the multi-modal monitoring data, analyze and identify a safety element entity and attribute characteristics thereof, and construct a time sequence knowledge graph based on the safety element entity and the attribute characteristics. An analysis unit is configured to establish a correlation mapping between entities in the time sequence knowledge graph, and calculate dynamic correlation weights between entities in different time windows; analyze a risk propagation path based on the dynamic correlation weights, and obtain a risk propagation link set. A prediction unit is configured to obtain a risk development trend for each link in the risk propagation link set by recursive calculation, and predict a risk situation at a future time step based on a historical evolution rule in the time sequence knowledge graph, to generate a risk prediction result. An optimization unit is configured to dynamically generate a differentiated early warning strategy according to the risk prediction result and the correlation degree of the risk propagation link, and establish a closed-loop tracking system for early warning response, so as to include the early warning result, the disposal process and the actual effect in the decision basis of system optimization, and form a continuously optimized early warning and emergency management ecology by deeply mining practical experience of emergency management in each region.

[0014] In a third aspect, the embodiment of the present application provides an electronic device, which comprises: A processor; A memory for storing processor-executable instructions; The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0015] In a fourth aspect, the embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, and the computer program instructions are executed by a processor to implement the method described above.

[0016] The present application has the following beneficial effects: By constructing a time sequence knowledge graph, the mine multi-modal monitoring data is spatio-temporally aligned and semantically labeled, the effective identification and structured expression of safety element entities and their attribute characteristics are realized, and the problem that the traditional method is difficult to process multi-source heterogeneous data is solved.

[0017] The dynamic correlation weight calculation mechanism between entities is innovatively established, which can accurately depict the dynamic characteristics of safety risk propagation under different time windows, and is more consistent with the actual situation of mine risk evolution compared with the traditional static model.

[0018] The recursive calculation method based on the set of risk propagation links, combined with the historical evolution law for prediction, significantly improves the accuracy and timeliness of risk warning, and avoids the defects that the traditional single-point monitoring is difficult to find complex risk correlation.

[0019] The differential warning strategy generation mechanism and closed-loop tracking system are created, the warning results, disposal process and actual effect are organically combined, a continuous self-optimizing warning and emergency management ecology is formed, and the intelligent level and emergency disposal capacity of mine safety management are effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1 The flowchart of the mine abnormal event real-time identification method based on the time sequence characteristics of the embodiment of the present application is shown in Figure 2 The risk propagation situation prediction model flowchart based on the historical state of the embodiment of the present application is shown in DETAILED DESCRIPTION

[0021] In order to make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be described clearly and completely in combination with the drawings in the embodiment of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor belong to the scope of protection of the present application.

[0022] The technical scheme of the present application will be described in detail in the following specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in some embodiments.

[0023] Figure 1 The flowchart of the mine abnormal event real-time identification method based on the time sequence characteristics of the embodiment of the present application is shown in Figure 1 As shown, the method comprises: The multi-modal monitoring data collected by the distributed sensors in the mine is acquired, and the multi-modal monitoring data is spatio-temporally aligned and semantically labeled, safety element entities and their attribute features are analyzed and identified, a time-series knowledge graph is constructed based on the safety element entities and the attribute features; In the time-series knowledge graph, the correlation mapping between entities is established, and the dynamic correlation weight between entities in different time windows is calculated; based on the dynamic correlation weight, the propagation path of the safety risk is analyzed, and a risk propagation link set is obtained; For each link in the risk propagation link set, the risk development trend is obtained by recursive calculation, and based on the historical evolution rule in the time-series knowledge graph, the risk situation at the future time step is predicted to generate a risk prediction result; According to the correlation degree of the risk prediction result and the risk propagation link, a differentiated early warning strategy is dynamically generated; at the same time, a closed-loop tracking system of early warning response is established, the early warning result, the disposal process and the actual effect are included in the decision basis of system optimization, and through deep mining of the practical experience of emergency management in each region, a continuously optimized early warning and emergency management ecology is formed.

[0024] In an optional implementation, the spatio-temporal alignment and semantic labeling of the multi-modal monitoring data, the analysis and identification of safety element entities and their attribute features, and the construction of a time-series knowledge graph based on the safety element entities and the attribute features include: The different modal data streams in the multi-modal monitoring data are time-series calibrated according to the time stamp, and the data collected by different spatial nodes are spatially registered based on the spatial position mapping relationship, to obtain a unified data representation after spatio-temporal alignment; The data items in the unified data representation are semantically analyzed using a pre-trained domain knowledge base and ontology model to identify the entity types, inter-entity relationship types and entity attributes corresponding to the data items, and the accuracy of the labeling results is ensured through consistency checking and conflict resolution to obtain standardized data after semantic labeling; From the standardized data after semantic labeling, safety element entities are identified, and based on the entity types, the inter-entity relationship types and the entity attributes, the corresponding static attribute features and dynamic behavior features of each safety element entity are extracted to construct an entity-feature mapping set; Based on the safety element entities and their corresponding entity-feature mapping set, an initial time-series knowledge graph is constructed, and the topological integrity of the initial time-series knowledge graph is verified using the inter-entity relationship types to identify isolated nodes and broken paths in the graph, and the missing entity relationships are completed in combination with the relationship reasoning rules, to finally form a complete time-series knowledge graph.

[0025] The spatio-temporal alignment process of multi-modal monitoring data realizes data fusion by establishing a unified time reference and spatial coordinate system. The data collected by each sensor node carries a GPS timestamp with a precision of milliseconds, and the local clock bias of the device is also recorded. The time sequence calibration module receives the raw data stream from devices such as vibration sensors, gas detectors, temperature and humidity meters, and cameras. Each data packet contains device identification, timestamp, data type, sampling value, quality mark, and other fields. The calibration algorithm performs clock synchronization based on the Network Time Protocol, calculates the deviation of each device from the reference clock, and performs linear correction on all timestamps. When time jumps or abnormal drift are detected, the system activates the time interpolation mechanism, using linear or cubic spline interpolation at adjacent normal time points for compensation. Spatial registration is based on a pre-established three-dimensional coordinate system of the mine. Each sensor node has a fixed spatial position code, including roadway number, distance from the starting point in meters, relative height, and other information. The registration algorithm performs spatial interpolation on the same type of measurement data at different spatial positions according to the distance weight, generating a continuous data field covering the entire monitoring area. The interpolation radius is set to 50 meters, and when the number of sensors within a 50-meter radius around a certain point is less than 3, the search radius is expanded to 100 meters. The spatio-temporally aligned data is stored in a standardized format, including normalized timestamp, three-dimensional coordinates, data type identifier, value, confidence, and other fields, forming a unified data representation.

[0026] The semantic annotation process uses a pre-built ontology library in the mine safety field for data semantic analysis. The ontology library includes device entities, environmental parameters, safety states, abnormal events, and other core concept categories, as well as hierarchical relationships and attribute relationships between them. The semantic analysis engine receives the unified data representation, first performs preliminary entity type identification based on data type and source device. Vibration data corresponds to device vibration entities, gas concentration corresponds to gas environment entities, and image data corresponds to visual scene entities. Relationship identification between entities is achieved through a relationship extraction algorithm based on a pre-defined relationship template library, including "located in", "influence", "contains", "preceding", and other relationship types. The relationship extraction process considers spatio-temporal proximity, and establishes potential association relationships when two entities are adjacent in time and the spatial distance is less than a pre-set threshold. Entity attribute extraction includes numerical attributes such as measurement values, change rates, and fluctuation amplitudes, as well as symbolic attributes such as device status, abnormal type, and severity. The consistency verification module checks the logical reasonableness of the annotation results, verifies the matching relationship between entity types and attribute values, identifies conflicting annotations, and triggers a conflict resolution mechanism. The conflict resolution strategy is based on confidence weighted voting, preferentially adopting high confidence annotation results, and for conflicting annotations with similar confidence, introducing domain expert rules for arbitration. After semantic annotation, standardized data is generated, each data record containing entity identification, type label, attribute list, relationship direction, and confidence score.

[0027] The safety element entity identification filters the entity objects directly related to mine safety from the normalized data. The safety element entity categories include key safety components such as ventilation equipment, gas monitoring points, personnel positions, transportation equipment, and power supply systems. The identification algorithm filters based on entity type labels and safety importance scores. The scoring mechanism considers factors such as the influence of the entity on safety accidents, the attention of regulatory requirements, and the correlation frequency of historical accidents. Each safety element entity extracts two types of feature sets: static attribute features and dynamic behavior features. Static attribute features describe the inherent properties of the entity, including device model, rated parameters, installation location, maintenance period, and other information that does not change over time. Dynamic behavior features reflect the running state changes of the entity, including real-time measurement values, change trends, operating modes, and abnormal indicators. The feature extraction process uses a sliding time window mechanism with a window length of 1 hour and a sliding step of 15 minutes to ensure that the features can capture short-term fluctuations and long-term trends. For numerical features, statistical quantities such as mean, variance, maximum, minimum, and change rate are extracted. For symbolic features, state distribution and transition frequency are calculated. The entity-feature mapping set is organized in key-value pair form, with the key being the entity unique identifier and the value being the feature vector. The vector dimension is dynamically adjusted according to the entity type, usually containing 20 to 50 feature components.

[0028] The time series knowledge graph construction establishes a graph structure representation based on safety element entities and their feature mapping relationships. The initial graph takes entities as nodes and the relationships between entities as edges. Node attributes include entity identifier, type, static features, and current dynamic features. Edge attributes record relationship type, strength, and establishment time metadata. The graph construction process first creates nodes corresponding to all safety element entities, and then establishes edge connections based on the relationship types identified in the semantic annotation stage. Relationship types include physical connection, logical dependency, spatial proximity, and functional collaboration, each with different weight calculation methods. Physical connection relationship weight is based on connection strength, logical dependency relationship weight is based on dependency degree, spatial proximity relationship weight is based on distance inverse, and functional collaboration relationship weight is based on collaboration frequency. Topological integrity verification detects graph connectivity through graph traversal algorithms to identify isolated nodes and broken subgraphs. Isolated nodes refer to entity nodes without any edge connections, and broken paths refer to cases where necessary connection relationships between key entities are missing. Relationship reasoning rules are defined based on domain knowledge bases, including transitivity rules, symmetry rules, and hierarchical rules. Transitivity rules state that if entity A affects entity B and entity B affects entity C, then entity A indirectly affects entity C. Symmetry rules state that if entity A is spatially adjacent to entity B, then entity B is also spatially adjacent to entity A. The reasoning engine infers potential missing relationships based on existing relationships and reasoning rules. Newly derived relationships are added to the graph with low confidence, and the graph topology is iteratively refined until it stabilizes.

[0029] In an alternative embodiment, an initial temporal knowledge graph is constructed based on the security element entities and their corresponding entity-feature mapping sets, and a topological integrity verification is performed on the initial temporal knowledge graph using the inter-entity relationship types to identify isolated nodes and broken paths in the graph, comprising: The security element entities are taken as a node set, and each node is given an attribute vector according to the entity-feature mapping set. A directed edge set between nodes is constructed based on the inter-entity relationship types, and a relationship strength measure value and a temporal evolution constraint are attached to each directed edge. The node set, the attribute vector, and the directed edge set are combined to form the topological structure of the initial temporal knowledge graph. A topological integrity verification is performed on the initial temporal knowledge graph, the in-degree and out-degree of each node are calculated by traversing the directed edge set, nodes with both in-degree and out-degree of zero are identified as isolated nodes, and broken paths caused by the lack of necessary intermediate nodes are detected through path connectivity analysis. For the isolated nodes identified in the topological integrity verification, potential associated relationships are queried in the domain ontology model based on the inter-entity relationship types, and associated edges are supplemented for the isolated nodes according to the query results to eliminate the isolated state. For the broken paths identified in the topological integrity verification, the semantic association between the starting point and the ending point of the path is analyzed, and the missing intermediate entities and their associated relationships are inferred using relationship reasoning rules to complete the broken paths in the initial temporal knowledge graph.

[0030] The initial temporal knowledge graph construction process organizes security element entities and relationship information through a graph data structure. The node set construction module receives a list of security element entities and creates a graph node object for each entity. The node object includes entity unique identifier, entity type label, creation timestamp, and other basic fields. The attribute vector assignment process attaches a multi-dimensional feature vector to each node based on the entity-feature mapping set. The vector length is dynamically determined according to the entity type. The gas monitoring entity vector contains 32 features such as concentration value, change rate, and alarm threshold. The ventilation equipment entity vector contains 28 features such as air volume, power, and operating status. The personnel positioning entity vector contains 15 features such as position coordinates, movement speed, and stay duration. The attribute vector is stored as a floating-point array, and the numerical range is normalized to the interval [0, 1]. Missing feature values are marked with -1. The node attribute update mechanism supports two modes: incremental update and full replacement. Incremental update only modifies the changed feature components, and full replacement rewrites the entire attribute vector. The update operation records the timestamp and version number for change tracking.

[0031] The directed edge set establishes the connection relationship between nodes based on the relationship type between entities. The edge object includes core fields such as source node identifier, target node identifier, relationship type code, and creation time. The relationship type code uses integer enumeration. The physical connection relationship is coded as 1, the logical dependency relationship is coded as 2, the spatial proximity relationship is coded as 3, the functional synergy relationship is coded as 4, and the causal influence relationship is coded as 5. The relationship strength measurement considers the matching degree of relationship type and entity characteristics. The physical connection strength is calculated based on connection bandwidth and transmission delay. The logical dependency strength is calculated based on dependency frequency and importance weight. The spatial proximity strength is calculated based on distance reciprocal and accessibility. The functional synergy strength is calculated based on synergy effect and historical success rate. The causal influence strength is calculated based on influence range and propagation speed. The strength value range is limited between 0.1 and 1, and the precision is kept to 3 decimal places. The time evolution constraint describes the change law of the relationship over time, including effective time, invalid time, periodic mode, and change trend. The effective time and invalid time are stored in timestamp format. The periodic mode supports predefined modes such as daily cycle, weekly cycle, and monthly cycle. The change trend includes types such as increasing, decreasing, fluctuating, and stable.

[0032] The topology structure combination process integrates the node set, attribute vector, and directed edge set into a complete graph data structure. The graph uses an adjacency list representation, each node maintains an out-edge list and an in-edge list, and the edge list is sorted by target node identifier to support fast lookup. The graph metadata records the total number of nodes, the total number of edges, the creation time, the last update time, and other statistical information. The graph index mechanism establishes a hash mapping of node identifier to memory address, an index mapping of edge relationship to edge object, and a grouping mapping of entity type to node list, supporting efficient access of multiple query modes. The graph serialization uses a compact binary format for storage. The node attribute vector uses compressed encoding to reduce storage space, and the edge relationship uses differential encoding to optimize storage efficiency. The graph loading process supports a lazy loading strategy, preferentially loading core nodes and high-frequency access edges, and loading detailed attribute information and low-frequency edge relationships on demand.

[0033] Topology integrity verification detects the connectivity and integrity of graph structure through graph traversal algorithm. The in-degree and out-degree calculation module traverses the directed edge set, and counts the out-degree of each node as the starting point of the edge and the in-degree as the end point of the edge. The degree statistics result is stored in the degree field of the node object, including in-degree value, out-degree value, total degree and other information. The isolated node identification algorithm checks the in-degree and out-degree of each node. When the in-degree value and out-degree value of the node are both 0, the node is marked as an isolated node. The isolated node list maintains the identifier and discovery time of the isolated node, and supports grouping statistics according to entity type, importance and other dimensions. Path connectivity analysis uses depth-first search algorithm to detect connected components in the graph, and identifies node subsets that cannot reach each other through edge paths. The broken path detection algorithm is based on critical path analysis, which identifies the missing necessary intermediate connections between important entities. The critical path is defined as the critical information transmission path in the safety monitoring process, including the monitoring device to the control center path, the alarm signal to the response device path, the personnel location to the safety exit path, etc. The broken path judgment criteria include path length exceeding the expected threshold, path interruption causing information unable to be transmitted, missing key nodes causing process interruption, etc.

[0034] The isolated node association relationship supplement process queries potential relationship connections based on the domain ontology model. The ontology query module receives the entity type and attribute characteristics of the isolated node, and searches the relevant relationship patterns in the pre-constructed domain ontology knowledge base. The ontology knowledge base stores the relationship rules between entity types in the form of triples, including subject type, relationship type, object type and other elements. The query algorithm supports two matching modes: exact matching and fuzzy matching. Exact matching requires that the entity types be exactly the same, and fuzzy matching allows the parent or child classes of the entity types to be matched. The potential relationship score is calculated based on factors such as the frequency of the relationship appearing in the ontology library, the importance weight of the relationship, and the similarity of entity characteristics. The relationship candidate list is arranged in descending order of score, and the relationships with scores exceeding the threshold are selected as supplement candidates. The association edge supplement operation creates new edge connections for isolated nodes, and the relationship strength of the new edge is set to a low initial value, which will be adjusted later. The supplement process records operation logs, including supplement time, supplement basis, confidence, etc., supporting subsequent relationship verification and adjustment.

[0035] The broken path completion process identifies missing intermediate entities and relationships through semantic correlation analysis and relationship reasoning. The semantic correlation analysis between the start and end points of the path is based on the similarity calculation of entity semantic vectors. The semantic vectors map entity names and attribute features into high-dimensional vector representations through a pre-trained word embedding model. The similarity calculation uses cosine similarity measurement, with a similarity value ranging from 0 to 1. Entity pairs with a similarity greater than 0.8 are considered to have strong semantic correlation. The relationship reasoning rules are based on domain expert knowledge and historical data statistics, including transitivity reasoning, combination reasoning, and hierarchical reasoning. The transitivity reasoning rule describes that if entity A is connected to entity B through relationship R1 and entity B is connected to entity C through relationship R2, then entity A can be inferred to be connected to entity C through the combined relationship R1R2. The combination reasoning rule deduces complex relationships based on multiple simple relationships, and the hierarchical reasoning rule deduces superior-inferior relationships based on the hierarchical structure of entities. The reasoning engine uses a forward chain reasoning strategy, starting from known relationships and gradually deducing new relationships. The reasoning depth is limited to 5 layers to avoid infinite reasoning. The missing intermediate entity inference is based on path analysis and entity matching. When there is semantic correlation between the start and end points of the path but a lack of direct connection, intermediate entity candidates are searched. The intermediate entity candidates are selected from existing graph nodes, requiring potential correlation relationships with both the start and end points.

[0036] In an optional implementation, an association mapping between entities in the time sequence knowledge graph is established, and dynamic association weights between entities in different time windows are calculated; based on the dynamic association weights, a propagation path of a security risk is analyzed to obtain a risk propagation link set, including: An entity node and an edge relationship therebetween are extracted from the time sequence knowledge graph, an association mapping matrix between entities is established based on semantic types and directionality, and for different time windows, a dynamic association weight matrix between entities is calculated through a time sequence perception graph attention mechanism according to a state change sequence of an entity in the time window and a causal dependency relationship between entities; Based on the dynamic association weight matrix, a weight is assigned to a corresponding entity pair position in the association mapping matrix, and the entity node, the edge relationship, and their weights are combined to form a weighted graph structure associated with a time window; In the weighted graph structure, a recognized risk source node is selected as a starting point, edges with a weight exceeding a preset propagation threshold are selected based on dynamic association weights, a propagation trajectory of a risk from a source node to a downstream node is tracked through a path search strategy combining breadth-first traversal and depth-first traversal, and multiple paths involved in the propagation trajectory are aggregated and deduplicated, and finally a risk propagation link set is obtained.

[0037] The association mapping matrix construction process extracts entity node and edge relationship data structure from the time sequence knowledge graph. The entity node extraction module traverses the graph node set to obtain the unique identifier, entity type label, creation timestamp, attribute vector, and other basic information of each node. The node identifier uses 64-bit integer encoding, the entity type label includes predefined enumeration values such as device class, personnel class, environment class, and control class, the attribute vector dimension is dynamically determined according to the entity type, the device class entity attribute vector includes 32 features, the personnel class entity attribute vector includes 18 features, the environment class entity attribute vector includes 24 features, and the control class entity attribute vector includes 28 features. The edge relationship extraction module traverses the graph edge set to obtain the source node identifier, target node identifier, relationship type code, relationship strength value, creation time, and other relationship attributes. The relationship type code uses integer enumeration, the physical connection relationship code is 1, the logical dependency relationship code is 2, the spatial proximity relationship code is 3, the functional synergy relationship code is 4, and the causal influence relationship code is 5. The relationship strength value is limited in the range of 0.1 to 1.0, and the precision is maintained to 3 decimal places.

[0038] The semantic type mapping establishes semantic association rules between entities based on entity type labels. The mapping rules are stored in a two-dimensional association table, with row indexes as source entity types and column indexes as target entity types. The table element values are semantic association strengths. The semantic association strength between device class and environment class entities is set to 0.8, the semantic association strength between personnel class and control class entities is set to 0.7, the semantic association strength between entities of the same type is set to 0.9, and the semantic association strength between unrelated type entities is set to 0.1. The directionality establishment process determines the directionality weight between entities based on the directional properties of edge relationships. The forward relationship weight is set to 1.0, and the reverse relationship weight is differentiated according to the relationship type. The physical connection reverse weight is 0.6, the logical dependency reverse weight is 0.3, the spatial proximity reverse weight is 0.9, the functional synergy reverse weight is 0.7, and the causal influence reverse weight is 0.2. The association mapping matrix uses a sparse matrix storage format. The matrix dimension is equal to the total number of entity nodes, and the matrix element value is the product of the semantic association strength and the directionality weight. Matrix elements with values less than 0.05 are marked as sparse elements and not stored, reducing memory usage and improving access efficiency.

[0039] The time window division strategy determines the window boundary and sliding step based on the time dimension information of the time knowledge graph. The time window length is set to a range of 15 minutes to 240 minutes, and the default value is 60 minutes. The sliding step is set to a range of 25% to 50% of the window length, and the default value is 15 minutes. The window boundary alignment strategy adopts natural time boundary alignment, and the start time is aligned to the whole point or half point, and the end time is extended backward according to the window length. The entity state change sequence extraction module collects the change history record of the attribute vector in each time window for the entity node in the window. The state change sequence is stored in the list format of timestamp-value pair, the timestamp precision is second level, and the value is the normalized attribute vector component value. The state change detection is based on the difference calculation of adjacent time point attribute values. The change greater than the threshold of 0.05 is marked as a significant change event, and the change event includes change time, change attribute, change amplitude, change direction and other information.

[0040] The causal dependency relationship identification establishes the causal dependency matrix between entities based on the causal influence type in the edge relationship. The causal dependency matrix is the adjacency matrix representation of the directed graph, and the matrix element value is the strength weight of the causal relationship. The causal relationship strength calculation considers the directness and indirectness of the relationship. The direct causal relationship strength is equal to the relationship strength value of the edge relationship, and the indirect causal relationship strength is calculated by path propagation attenuation. The attenuation coefficient is set to 0.8, and the propagation path length is limited within 3 hops. The causal dependency time delay parameter is determined based on historical data statistical analysis. The causal propagation time delay between different types of entities is different. The average time delay of device fault propagation to environmental parameter is 180 seconds, the average time delay of personnel abnormality propagation to control instruction is 120 seconds, and the average time delay of environmental change propagation to device state is 240 seconds. The standard deviation of the time delay parameter is set to 30% of the average value.

[0041] The time sequence perception graph attention mechanism adopts a multi-head attention architecture to calculate the dynamic association weight between entities. The number of attention heads is set to 8, and the dimension of each attention head is 64. The query vector generation is based on the current state vector and the history state change sequence of the entity. The key vector generation is based on the history state sequence and the causal dependency strength of the entity. The value vector generation is based on the attribute vector and the semantic type encoding of the entity. The attention weight calculation is performed by the dot product operation of the query vector and the key vector, and the attention score is obtained by scaling and softmax normalization. The scaling factor is set to the square root of the attention head dimension, which is 8.0. The time sequence position encoding encodes the time position based on the sine and cosine functions, and the encoding dimension is 128. The encoding frequency parameter is set to a logarithmic uniform distribution in the range of 0.0001 to 10.0.

[0042] The dynamic correlation weight calculation fuses the outputs of multiple attention heads, and maps the multi-head attention output to the final correlation weight value through a linear transformation layer. The weight parameters of the linear transformation layer are obtained through pre-training, and the training data includes historical time series atlas data and manually labeled correlation strength labels. Correlation weight normalization ensures that the weight value is within the range of 0 to 1. Correlations with weight values less than 0.1 are considered weak correlations, and correlations with weight values greater than 0.7 are considered strong correlations. The time decay mechanism exponentially decays the correlation weights of historical time points, with a decay rate of 0.95, i.e. the correlation weight decays by 5% at each time step. The dynamic correlation weight matrix update frequency is consistent with the time window sliding frequency, and the weight matrix is updated every 15 minutes, with the matrix element value accuracy maintained to four decimal places.

[0043] The weighted graph structure construction process assigns weight values in the dynamic correlation weight matrix to corresponding entity pair positions in the correlation mapping matrix. The weight assignment strategy uses an overlay update method, where the newly calculated dynamic weight values directly replace the original static weight values. The weight fusion rule differentiates based on weight type, with static semantic weight and dynamic correlation weight fused through weighted averaging, with static weight accounting for 30% and dynamic weight accounting for 70%. The edge weight threshold filtering mechanism removes weakly correlated edges with weight values less than 0.08, reducing graph structure complexity and improving subsequent path search efficiency. The weighted graph uses an adjacency list storage structure, with each node maintaining an out-edge list and an in-edge list. The edge list is sorted in descending order of weight value to facilitate fast access to high-weight edges.

[0044] Node importance evaluation is based on node degree, weight sum, and centrality indicators to calculate node importance scores. Degree includes the weighted sum of in-degree and out-degree, weight sum is the cumulative value of all adjacent edge weights, and centrality indicators use a weighted combination of betweenness centrality and closeness centrality. Node importance scores are normalized to the range of 0 to 1. Nodes with scores above 0.8 are marked as key nodes, and nodes with scores below 0.2 are marked as edge nodes. Graph structure connectivity verification detects the connectivity properties of the weighted graph through a strongly connected component decomposition algorithm. Indicators such as the number of strongly connected components, the size of the largest component, and the number of isolated nodes are used to evaluate graph structure quality.

[0045] The risk source node selection is based on the mapping relationship between the identified security risk events and the corresponding entity nodes. The risk events include device failure, personnel violation, environmental anomaly, control failure, etc. Each risk event corresponds to a specific entity type and attribute feature mode. The device failure risk source node feature is a device entity with a state attribute value exceeding the upper limit of the normal range. The personnel violation risk source node feature is a personnel entity with a location attribute deviating from the predetermined path. The environmental anomaly risk source node feature is an environmental entity with a monitoring parameter exceeding the safety threshold. The control failure risk source node feature is a control entity with a response time exceeding the expected value. The risk source node confidence evaluation is based on the risk feature matching degree and historical risk statistical data. The confidence value ranges from 0 to 1. Nodes with a confidence value exceeding 0.6 are confirmed as risk source starting points.

[0046] The propagation threshold setting is based on statistical analysis of historical risk propagation cases. The propagation threshold is set to a range of 0.15 to 0.45, with a default value of 0.25. The threshold dynamic adjustment mechanism adjusts the threshold adaptively according to the current system risk level. The threshold is reduced by 10% to enhance sensitivity under high risk level, and the threshold is increased by 15% to reduce false positives under low risk level. The edge weight screening process starts from the adjacent edges of the risk source node, and selects edges with weights exceeding the propagation threshold as effective propagation paths. The screening results are stored in the candidate propagation edge list, which is sorted in descending order of weight value.

[0047] The breadth-first traversal strategy starts from the risk source node and expands layer by layer outward. Each layer traversal includes all reachable nodes at the current distance, and the traversal depth is limited to 6 layers to avoid excessive propagation. The queue data structure maintains a list of nodes to be accessed. When a node is enqueued, the arrival path and cumulative weight are recorded. When a node is dequeued, its adjacent nodes are expanded and the path information is updated. The depth-first traversal strategy searches along a single path until the termination condition is reached. The termination conditions include reaching the maximum depth, cumulative weight falling below the threshold, encountering a visited node, etc. The stack data structure maintains the current path state, supporting path backtracking and branch exploration.

[0048] The path search strategy combines breadth-first and depth-first traversal methods. First, identify all propagation regions through breadth-first traversal, and then refine the specific propagation paths within each region through depth-first traversal. The path weight calculation is based on the geometric mean of the edge weights in the path, which avoids the masking of the overall propagation ability of the path by a single high-weight edge. The path length constraint limits the propagation path to no more than 8 hops, and the path weight constraint requires the average path weight to be no less than 0.12.

[0049] The propagation trajectory record includes a complete node sequence and an edge weight sequence, the node sequence records the entity node identifiers passed by the propagation path, and the edge weight sequence records the dynamic weight value of each edge in the path. The trajectory evaluation index includes path length, average weight, propagation delay, and influence range, and the influence range is calculated based on the importance score and connectivity of the path endpoint node. The path similarity is calculated based on the node overlap and weight correlation, and the paths with a similarity greater than 0.75 are classified into the same cluster.

[0050] The deduplication process is based on the hash matching of the path start and end point pairs and the intermediate node set. Only one path is retained for completely identical paths, and partially overlapping paths are selected and retained based on the evaluation index. The risk propagation link set finally includes the effective propagation paths after screening and deduplication. Each link records the source node, target node, intermediate node sequence, path weight, propagation delay, confidence, and other attribute information. The link set is sorted according to the risk impact degree, and the impact degree is calculated based on the importance of the target node, the path weight, and the propagation speed. The sorting result is used to determine the risk response priority.

[0051] In an optional embodiment, the propagation trajectory of the risk from the source node to the downstream node is tracked by a path search strategy combining breadth-first traversal and depth-first traversal, and the multiple paths involved in the propagation trajectory are aggregated and deduplicated, including: The propagation trajectory of the risk from the source node to the downstream node is tracked by a path search strategy combining breadth-first traversal and depth-first traversal, wherein the breadth-first traversal sequentially accesses all adjacent nodes of each level based on a node queue, constructs the propagation range of the risk at the current level, and obtains a node set of each level; the depth-first traversal preferentially explores the vertical extension direction of a single path along the weight edge based on a node stack until the propagation termination condition is reached, and obtains the node sequence of each extended path; In each iteration, the breadth-first traversal is first performed based on the node sequence to determine the level propagation range, the depth-first traversal is performed to explore the extended path of each node, the propagation trajectory is integrated, and the multiple paths involved in the propagation trajectory are aggregated and deduplicated.

[0052] A network graph structure reflecting the association relationship between nodes is constructed, wherein each node represents an entity, the edge represents the association relationship between entities, and the weight of the edge represents the strength or probability of risk propagation. In this network graph structure, the risk propagation starts from one or more source nodes and spreads to downstream nodes along the edges.

[0053] In practical implementation, the source node set of risk is determined, which is marked as the starting point of risk propagation. At the same time, the termination condition of risk propagation is set, such as the propagation depth threshold, the cumulative risk value threshold or the specific target node set.

[0054] For the tracking of risk propagation, a strategy combining breadth-first traversal and depth-first traversal is adopted. Breadth-first traversal is based on node queue operation and is mainly used to build the propagation range of each level. Specifically, the source node is added to the queue, and then all its adjacent nodes are dequeued and visited in turn, and these adjacent nodes are added to the queue. This process is repeated until the queue is empty or the propagation termination condition is reached. In each iteration, the nodes in the queue constitute the propagation range of the current level, forming a level node set.

[0055] For each level node set, depth-first traversal is applied to explore the extended path from the current level node. Depth-first traversal is based on node stack operation and preferentially continues to explore the vertical extension direction of a single path along high weight edges. Specifically, the nodes of the current level are stacked in turn, and then the nodes are taken out from the top of the stack, and their adjacent nodes are visited, and the nodes connected by higher weight edges are preferentially selected for further exploration until the propagation termination condition is reached or the extension cannot continue. In this way, each path from the source node to the termination node constitutes a node sequence, representing a trajectory of risk propagation.

[0056] In practical application, different weight calculation rules can be defined for each edge, for example, in a financial risk propagation network, the weight of the edge can be calculated based on transaction amount, holding ratio or business frequency; in an epidemic propagation network, the weight of the edge can be calculated based on personnel flow frequency, spatial distance or contact time.

[0057] In each iteration, breadth-first traversal is performed to determine the propagation range of the current level, and depth-first traversal is performed for each node in the level to explore its extended path. This combined strategy makes full use of the advantages of breadth-first traversal in covering all propagation paths, while taking advantage of the characteristics of depth-first traversal in quickly locating high-risk propagation paths.

[0058] After obtaining all the propagation paths, these paths need to be aggregated and de-duplicated. Since the risk propagation network usually has loops or multiple paths connecting the same nodes, directly outputting all the paths will result in redundant results. The aggregation and de-duplication process first groups the paths with the same starting point and ending point into a group; then, within each group, the paths are de-duplicated according to their node composition and propagation weight, and the most representative or highest risk propagation probability path is retained.

[0059] The implementation of the aggregated deduplication can be based on a hash table structure, with key features of the path (such as the starting point, the ending point, the path length, key nodes, etc.) as the hash key, and similar paths are mapped into the same hash bucket. For the paths within each hash bucket, it is determined whether to merge or filter these paths according to a predefined similarity calculation rule. For example, the path with the highest cumulative risk weight can be retained, or multiple similar paths can be merged into a representative path.

[0060] Throughout the process, a global set of propagation trajectories is maintained, and newly discovered paths are continuously added to the set, and the set is periodically aggregated and deduplicated. The final output of the propagation trajectory set is the risk propagation path from the source node to each downstream node, which can be used for subsequent risk assessment and prevention and control decision-making.

[0061] Through this method, the key paths and nodes of risk propagation in a complex network can be efficiently identified, providing decision support for risk management and control. For example, in supply chain risk analysis, it can be identified how upstream supplier risks are transmitted to core enterprises and the risk intensity of different propagation paths is evaluated; in financial systemic risk analysis, it can be tracked how a crisis of a specific financial institution spreads to the entire financial network through asset correlation and liability correlation.

[0062] In summary, through the path search strategy combining breadth-first traversal and depth-first traversal, combined with path aggregation and deduplication processing, the risk propagation trajectory in a complex network can be effectively tracked and analyzed, providing a scientific basis for risk prevention and control.

[0063] In an optional implementation, for each link in the set of risk propagation links, the risk development trend is calculated by recursion, and based on the historical evolution rule in the time sequence knowledge graph, the risk situation at the future time step is predicted to generate a risk prediction result, including: For each link in the set of risk propagation links, a state transition matrix is constructed based on the weight relationship between adjacent nodes in the link, and a state migration probability distribution is trained in combination with the historical state sequence of the nodes, and the development trend value and trend confidence of the risk on the corresponding link are obtained through recursive operation of the chain condition probability; the sensitivity coefficient of each node in the link propagation process is calculated, and the development trend value is optimized based on the sensitivity coefficient to obtain an optimized trend value considering the influence degree of the node; In the time sequence knowledge graph, a historical propagation path similar to the corresponding link and its evolution characteristics are identified, a structural similarity and a state similarity between the current link and the historical path are calculated, and an evolution contribution of each historical path is determined based on the structural similarity and the state similarity; an evolution law of the historical path is constructed according to the evolution contribution; the optimization trend value is associated and integrated with the evolution law, and a risk situation at a future time step is predicted in combination with the trend confidence, to generate a risk prediction result.

[0064] The state transition matrix construction process establishes a probability model of node state transition based on the weight relationship between adjacent nodes in the risk propagation link, and the matrix dimension is equal to the number of state categories of the nodes in the link. The node state classification adopts a three-state model, including a normal state, a warning state and an abnormal state, and the state codes are 0, 1 and 2 respectively. The adjacent node weight relationship extraction module obtains the dynamic association weight between the node pair from the link data structure, and the weight value ranges from 0.1 to 1.0, with an accuracy of 3 decimal places. The state transition probability calculation is based on the normalization processing of the weight value, which normalizes the weights of different target nodes from the same source node, to ensure that the sum of the transition probabilities is equal to 1.0. The transition probability matrix adopts a sparse storage format, and the transition with a probability value lower than 0.05 is marked as an unreachable transition, to reduce the calculation complexity.

[0065] The node historical state sequence extraction module collects the state change records of each node in the past 30 days from the time sequence knowledge graph, and the state records include time stamp, state value, duration, transition reason and other attributes. The historical state sequence is arranged in chronological order, the time stamp has a minute-level accuracy, the state value is encoded by an integer, and the duration is in minutes. The state transition probability distribution training adopts the maximum likelihood estimation method, and the transition probability is calculated based on the historical state transition frequency statistics. The training data preprocessing includes steps such as missing value filling, abnormal value detection and sequence alignment, the missing values are filled by a forward filling strategy, the abnormal values are identified by a 3 times standard deviation rule and replaced by the sequence mean, and the sequence alignment is based on linear interpolation of the time stamp.

[0066] The training process adopts a sliding window strategy, the window length is set to 7 days, and the sliding step is set to 1 day. The state transition events in each window are used as a training sample. The state transition frequency statistics are based on the conditional probability framework, which counts the frequency of transition to each target state under the given source state condition, and the frequency matrix is normalized by row to obtain the probability distribution. The smoothing processing adopts the Laplace smoothing method, which adds a pseudo count of 0.01 to the zero frequency transition, to avoid the probability being zero. The probability distribution verification evaluates the goodness of fit of the distribution by chi-square test, and the significance level is set to 0.05. The distribution passing the test is used for subsequent recursive calculation.

[0067] The chain conditional probability recursive operation calculates the propagation probability of the risk on the link based on the Markov chain model. The recursive process starts from the starting node of the link and gradually calculates the state probability distribution of each subsequent node. The recursive formula is based on the matrix multiplication operation of the current node state probability and the state transition matrix to obtain the state probability vector of the next node. The recursive step is consistent with the length of the link, and the maximum recursive depth is limited to 10 steps to avoid calculation divergence. The probability vector normalization processing ensures that the probability sum is equal to 1.0, and the normalization error tolerance is set to 0.001.

[0068] The trend value calculation is based on the abnormal state probability of the end node of the link. If the abnormal state probability is greater than 0.3, it is considered that there is a high risk trend. If the probability is between 0.1 and 0.3, it is considered that there is a moderate risk trend. If the probability is less than 0.1, it is considered that the risk trend is low. The trend value is represented by a continuous value from 0 to 1. The calculation formula is the product of the abnormal state probability and the path propagation coefficient. The path propagation coefficient is calculated based on the length of the link and the average weight. The propagation coefficient of a link with a length of more than 5 nodes is set to 0.8. The propagation coefficient of a link with a length of 3 to 5 nodes is set to 0.9. The propagation coefficient of a link with a length of less than 3 nodes is set to 1.0.

[0069] The trend confidence evaluation is based on the comprehensive calculation of historical prediction accuracy and current data integrity. The historical prediction accuracy is obtained by comparing the prediction results with the actual results in the past 90 days. The accuracy is calculated with an accuracy of 100% and an integer precision. The data integrity evaluation is based on the missing rate and delay rate of the node state data in the link. If the missing rate is less than 5% and the delay rate is less than 10%, the data integrity is rated as excellent, and the confidence coefficient is 1.0. If the missing rate is between 5% and 15% or the delay rate is between 10% and 25%, the data integrity is rated as good, and the confidence coefficient is 0.85. If the missing rate exceeds 15% or the delay rate exceeds 25%, the data integrity is rated as general, and the confidence coefficient is 0.7.

[0070] The node sensitivity coefficient calculation is based on the performance statistics of the node in the historical risk events. The sensitivity coefficient reflects the influence of the node state change on the downstream nodes. The sensitivity statistics uses the mutual information method to quantify the correlation strength between the node state change and the downstream node state change. If the mutual information value is higher than 0.6, the node sensitivity coefficient is set to 1.2. If the mutual information value is between 0.3 and 0.6, the node sensitivity coefficient is set to 1.0. If the mutual information value is less than 0.3, the node sensitivity coefficient is set to 0.8. The node type sensitivity correction is based on the inherent characteristics of different entity types. The device class node sensitivity correction coefficient is 1.1, the personnel class node sensitivity correction coefficient is 0.9, the environment class node sensitivity correction coefficient is 1.0, and the control class node sensitivity correction coefficient is 1.2.

[0071] The development trend value optimization process fuses the original trend value with the sensitivity coefficients of each node in the link, and the weight distribution is based on the importance of the position of the node in the link. The weight of the starting node is 0.3, the remaining weight is evenly distributed among the intermediate nodes, and the weight of the terminal node is 0.2. The optimization trend value calculation uses a weighted average method, which multiplies the original trend value by the product of the sensitivity coefficients of each node and the corresponding weight, and then sums it up, with the result limited to the range of 0 to 1. The optimization process also considers the influence of the link topology. The optimization coefficient of linear link structure is 1.0, the optimization coefficient of branch link structure is 0.9, and the optimization coefficient of ring link structure is 1.1.

[0072] The historical propagation path recognition module searches for a historical path with similar characteristics to the current link in the time sequence knowledge graph, and the search time range covers the historical data of the past 180 days. The path similarity evaluation is based on the comprehensive calculation of structural similarity and state similarity. The structural similarity uses the graph edit distance algorithm to calculate the topological difference between the two paths, and the distance value is normalized to the range of 0 to 1, and the similarity is equal to 1 minus the normalized distance value. The state similarity uses the dynamic time warping algorithm to calculate the similarity of the node state sequence in the path. The sequence alignment is based on the minimum cost path search, and the cost function considers the state value difference and time offset penalty.

[0073] The structural similarity calculation process represents the path as a combination of node sequence and edge sequence. The node similarity is calculated based on entity type matching degree and attribute similarity. The entity type completely matches the score of 1.0, the type similar score of 0.6, and the type irrelevant score of 0.1. The edge similarity is calculated based on the relationship type matching degree and weight difference. The relationship type matching and weight difference less than 0.2 edge similarity is 0.9, the relationship type matching but weight difference greater than 0.2 edge similarity is 0.6, and the relationship type unmatched edge similarity is 0.2. The overall structural similarity of the path is the weighted average of the node similarity and the edge similarity, with the node weight accounting for 60% and the edge weight accounting for 40%.

[0074] The state similarity calculation is based on the Pearson correlation coefficient of the corresponding node state sequence in the path. The correlation coefficient absolute value greater than 0.8 state sequence similarity is 0.9, the correlation coefficient absolute value in the range of 0.5 to 0.8 state sequence similarity is 0.7, and the correlation coefficient absolute value less than 0.5 state sequence similarity is 0.3. The sequence length difference correction uses a negative exponential function of length ratio. The farther the length ratio deviates from 1.0, the smaller the correction coefficient. The minimum correction coefficient is limited to 0.5. The time alignment quality evaluation is based on the ratio of the total cost of the aligned path to the sequence length. The alignment quality is excellent when the ratio is less than 0.3, good when the ratio is in the range of 0.3 to 0.7, and general when the ratio is greater than 0.7.

[0075] The evolution contribution calculation is based on the geometric mean of the structural similarity and the state similarity. The evolution contribution of the historical path with a geometric mean greater than 0.7 is high contribution, the evolution contribution of the historical path with a geometric mean in the interval of 0.4 to 0.7 is medium contribution, and the evolution contribution of the historical path with a geometric mean less than 0.4 is low contribution. The contribution weight distribution is based on an exponential decay function. The closer the time distance, the greater the weight of the historical path. The decay coefficient is set to 0.95, that is, the weight decays by 5% per day. The evolution contribution normalization processing ensures that the total weight of all historical path contributions is equal to 1.0. The path with a normalized weight less than 0.05 is excluded from the contribution calculation.

[0076] The historical path evolution rule extraction is based on the evolution feature statistics of the high-contribution historical path. The evolution features include path length change, node state transition mode, propagation delay distribution, and end state probability. The path length change statistics the expansion or contraction trend of the historical path in the evolution process. If the expansion path proportion is more than 60%, it is considered that there is an expansion rule. If the contraction path proportion is more than 60%, it is considered that there is a contraction rule. If the proportion is in the interval of 40% to 60%, it is considered that the length is stable. The node state transition mode extracts the high-frequency state transition sequence in the historical path. The sequence with an appearance frequency of more than 30% is marked as a typical mode, which is used for evolution prediction of the current link.

[0077] The propagation delay distribution statistics the time distribution of the risk from the starting point to the end point in the historical path. The delay distribution is represented by a histogram, and the number of bins is set to 20. The bin width is automatically determined according to the delay range. The delay distribution feature parameters include mean, standard deviation, skewness, kurtosis, and other statistics. The mean reflects the average propagation delay, the standard deviation reflects the delay variability, the skewness reflects the distribution symmetry, and the kurtosis reflects the distribution sharpness. The end state probability statistics the final state distribution of the end node of the historical path. The normal state probability, the warning state probability, and the abnormal state probability are respectively statistics. The probability value accuracy is maintained to 2 decimal places.

[0078] The correlation integration process weights and fuses the optimization trend value and the historical evolution rule. The fusion weight is based on the trend confidence and the evolution rule reliability. When the trend confidence is higher than 0.8 and the evolution rule reliability is higher than 0.7, the optimization trend value weight is set to 0.6, and the evolution rule weight is set to 0.4. When the trend confidence is lower than 0.6 or the evolution rule reliability is lower than 0.5, the optimization trend value weight is set to 0.8, and the evolution rule weight is set to 0.2. The fusion result is nonlinearly transformed by a sigmoid function to enhance the discrimination and stability of the prediction result.

[0079] The future time step risk situation prediction is based on the fusion result to calculate the risk probability distribution of future 1 hour, 3 hours, 6 hours, 12 hours and 24 hours, the prediction time step is 15 minutes, and the maximum prediction time is 48 hours. The risk situation classification adopts a four-level system, and the low risk corresponds to a probability of 0 to 0.25, the low-medium risk corresponds to a probability of 0.25 to 0.5, the medium-high risk corresponds to a probability of 0.5 to 0.75, and the high risk corresponds to a probability of 0.75 to 1.0. The prediction uncertainty evaluation is based on the prediction confidence interval calculation, and the confidence level is set to 95%, and the confidence interval width reflects the prediction uncertainty.

[0080] The risk prediction result generation includes prediction time series, risk level sequence, confidence sequence, key influence factor and the like, and the data format adopts JSON structured representation. The prediction result verification module evaluates the prediction accuracy through historical data back testing, the back testing time window is the past 30 days, and the evaluation indexes include accuracy, recall rate, precision, F1 score and the like. The target value of the accuracy is set to be more than 85%, the target value of the recall rate is set to be more than 80%, the target value of the precision is set to be more than 75%, and the target value of the F1 score is set to be more than 80%.

[0081] In an optional implementation, according to the correlation degree of the risk prediction result and the risk propagation link, a differentiated early warning strategy is dynamically generated; and a closed-loop tracking system of early warning response is established, the early warning result, the disposal process and the actual effect are included in the decision basis of system optimization, and the practical experience of emergency management in each region is deeply mined, including: According to the correlation degree of the risk prediction result and the risk propagation link, the early warning response rules are determined according to the risk level and the propagation range of different links, the risk threshold of multiple levels is set, the risk threshold is dynamically adjusted based on the space-time evolution characteristics of risk propagation, and the differentiated early warning strategy is generated; The differentiated early warning strategy generates early warning information according to the early warning response rules, records the emergency disposal process and the actual disposal effect of each early warning trigger as optimization data, and performs time sequence matching on the early warning information and the optimization data; the early warning accuracy and the disposal effectiveness are calculated based on the result of the time sequence matching, the early warning response rules are perfected in a targeted manner, the early warning result, the disposal process and the actual effect in the optimization data are included in the decision basis of system optimization, and the practical experience of emergency management in each region is deeply mined.

[0082] As shown in Figure 2 The method comprises: The correlation degree calculation is based on the coupling analysis of the risk prediction result and the risk propagation link. The correlation degree quantification module extracts the risk level, influence range, time window and other attributes in the risk prediction result, and performs multi-dimensional matching with the length, weight, node type and other characteristics of the risk propagation link. The correlation strength calculation adopts the weighted Euclidean distance method to comprehensively evaluate the correlation between the predicted risk level and the average weight of the link, the matching degree between the predicted influence range and the number of link nodes, and the consistency of the predicted time window and the link propagation time delay. The correlation calculation is based on the Pearson correlation coefficient. The absolute value of the coefficient greater than 0.7 is considered strong correlation, the absolute value of the coefficient in the interval of 0.4 to 0.7 is considered moderate correlation, and the absolute value of the coefficient less than 0.4 is considered weak correlation. The matching degree evaluation adopts the cosine similarity algorithm. The similarity greater than 0.8 is considered high matching, the similarity in the interval of 0.5 to 0.8 is considered moderate matching, and the similarity less than 0.5 is considered low matching.

[0083] The risk level classification is based on the link propagation ability and the potential influence to establish a four-level risk level system. The first level risk corresponds to the link average weight greater than 0.8 and involves more than 3 key nodes. The second level risk corresponds to the link average weight in the interval of 0.6 to 0.8 and involves 2 to 3 key nodes. The third level risk corresponds to the link average weight in the interval of 0.4 to 0.6 and involves 1 to 2 key nodes. The fourth level risk corresponds to the link average weight less than 0.4 or the number of key nodes is 0. The key node identification is based on the comprehensive evaluation of the node importance score, connectivity, historical risk frequency and other indicators. The node with importance score greater than 0.8 and connectivity more than 10 is marked as a first level key node. The node with importance score in the interval of 0.6 to 0.8 and connectivity in the range of 5 to 10 is marked as a second level key node.

[0084] The propagation range determination is based on the link topology structure and the influence diffusion model to calculate the spatial boundary and time boundary of risk propagation. The spatial boundary is determined by the influence radius of the link endpoint node. The influence radius calculation considers node type, connection strength, physical distance and other factors. The influence radius of the device type node is set to a adjustable range of 200 to 500 meters. The influence radius of the personnel type node is set to a adjustable range of 50 to 150 meters. The influence radius of the environment type node is set to a adjustable range of 300 to 800 meters. The influence radius of the control type node is set to a adjustable range of 100 to 300 meters. The time boundary is calculated based on the link propagation time delay and the risk diffusion speed. The propagation time delay is obtained by statistical average and standard deviation of historical data. The diffusion speed is based on the risk type and environmental conditions to determine the correction coefficient.

[0085] The early warning response rule is established based on a decision matrix of risk level and propagation range. The decision matrix is a 4x4 structure, the row index is the risk level, the column index is the propagation range level, and the matrix element is the early warning response strategy code. The first level risk and large range propagation correspond to the immediate response strategy, the response time limit is within 5 minutes, the response level is the highest level, and measures such as personnel evacuation, equipment shutdown, and emergency linkage are involved. The second level risk and medium range propagation correspond to the rapid response strategy, the response time limit is within 15 minutes, the response level is high, and measures such as on-site control, equipment inspection, and personnel allocation are involved. The third level risk and small range propagation correspond to the standard response strategy, the response time limit is within 30 minutes, the response level is medium, and measures such as state monitoring, preventive maintenance, and personnel reminders are involved.

[0086] The multi-level risk threshold setting establishes a threshold system based on the cascading effect and cumulative effect of risk propagation, including node level threshold, link level threshold, and regional level threshold. The node level threshold is set based on the degree of state abnormality of a single node. The state value deviates from the normal range by 2 standard deviations to trigger node early warning, and deviates by 3 standard deviations to trigger node alarm. The link level threshold is set based on the proportion of abnormal nodes in the link and the propagation speed. The proportion of abnormal nodes exceeds 30% or the propagation speed exceeds 1.5 times the average value to trigger link early warning, and the proportion of abnormal nodes exceeds 50% or the propagation speed exceeds 2 times the average value to trigger link alarm. The regional level threshold is set based on the number of active links in the region and the risk density. The number of active links exceeds 40% of the total number of links in the region or the risk density exceeds 0.6 to trigger regional early warning.

[0087] The dynamic adjustment mechanism updates the threshold parameters in real time based on the spatio-temporal evolution characteristics of risk propagation. The temporal evolution characteristics include risk development speed, duration, periodicity, etc. The spatial evolution characteristics include propagation direction, diffusion range, and aggregation degree. The risk development speed is calculated by the risk level change rate of the continuous time window. The change rate exceeds 0.2 per hour is considered as fast development, the change rate is in the interval of 0.1 to 0.2 is considered as medium development, and the change rate is less than 0.1 is considered as slow development. In the case of fast development, the threshold is reduced by 20% to improve sensitivity, and in the case of slow development, the threshold is increased by 10% to reduce false positives. The duration is the length of time that the risk maintains at a high level. The threshold of long-term risk is increased by 15% to avoid fatigue warning when the duration exceeds 2 hours.

[0088] The propagation direction analysis is based on the spatial coordinates of the link nodes and the time sequence of the activation order to calculate the dominant direction of risk propagation. The propagation direction is represented by an angle, with an angle range of 0 to 360 degrees and an accuracy of 1 degree. The stability of the propagation direction is evaluated by the standard deviation of the direction vector. If the standard deviation is less than 30 degrees, the direction is considered stable, and if the standard deviation exceeds 60 degrees, the direction is considered scattered. The risk propagation threshold adjustment for stable direction is based on the statistical characteristics of historical cases with the same direction, and the risk propagation threshold adjustment for scattered direction remains at the default setting to avoid excessive adjustment. The diffusion range change rate is calculated by the change of the influence radius at consecutive time points. If the change rate is greater than 1.2 per hour, it is considered to be rapidly spreading, and if the change rate is less than 0.8 per hour, it is considered to be shrinking. In the case of rapid spreading, the regional level threshold is reduced by 25%.

[0089] The differentiated early warning strategy generation is based on risk type, propagation characteristics, influence range, etc. to establish a strategy template library. The strategy template includes early warning level, response time, disposal measures, resource allocation, coordination mechanism, etc. The early warning level is divided into four levels: prompt, warning, alarm, and emergency. The prompt level corresponds to low risk and low impact scenarios, the warning level corresponds to medium risk or local impact scenarios, the alarm level corresponds to high risk or large-scale impact scenarios, and the emergency level corresponds to extremely high risk or global impact scenarios. The response time allocation is based on the early warning level and the propagation urgency. The response time for the prompt level is 60 minutes, the response time for the warning level is 30 minutes, the response time for the alarm level is 15 minutes, and the response time for the emergency level is 5 minutes.

[0090] The disposal measures are differentiated based on the risk source type and the propagation path characteristics. For device failure risks, measures such as device isolation, backup startup, and maintenance dispatch are adopted. For personnel violation risks, measures such as personnel interview, permission restriction, and training reinforcement are adopted. For environmental abnormality risks, measures such as environmental adjustment, monitoring encryption, and protection upgrade are adopted. For control failure risks, measures such as manual takeover, logic reset, and system switching are adopted. The resource allocation optimization is based on historical disposal experience and current resource availability. Human resource allocation considers professional skill matching and geographical location convenience. Device resource allocation considers device performance applicability and dispatch cost efficiency.

[0091] The early warning information generation module constructs a structured early warning message based on a differentiated early warning strategy and early warning response rule structure. The early warning message includes fields such as a unique identifier, generation time, risk level, impact range, early warning content, disposal suggestion, response time limit, and contact method. The unique identifier is generated by combining a timestamp and a random array to ensure global uniqueness and traceability. The risk level is represented by both numerical values and text, with numerical values ranging from 1 to 4 corresponding to text descriptions of low, medium, high, and very high. The impact range is represented by geographic coordinates and an impact radius, with coordinate precision at the meter level and impact radius precision at 10 meters. The early warning content is generated using templates, with template variables including risk type, occurrence location, consequences, and urgency level.

[0092] The emergency disposal process record adopts a full life cycle tracking mechanism, recording the entire process from the early warning trigger to the end of risk elimination. The disposal process data structure includes fields such as disposal stage, execution personnel, start time, end time, execution measures, resource consumption, and intermediate results. The disposal stage is divided into five standard stages: reception confirmation, on-site response, measure execution, effect evaluation, and resource recovery, with detailed time nodes and key events recorded for each stage. The execution personnel information includes personnel number, name, position, professional skill, and contact method. The execution measure record uses structured coding, with information such as measure type, specific content, execution parameter, and quality standard standardized.

[0093] The actual disposal effect evaluation is based on a combination of quantitative indicators and qualitative evaluation, with quantitative indicators including risk elimination time, resource consumption cost, impact range control, and personnel safety guarantee. The risk elimination time is the total time from the early warning trigger to the risk level being reduced to a safe level, with time precision at the minute level. The target control time is determined based on the risk level. The resource consumption cost includes human cost, equipment cost, material cost, and opportunity cost, with cost accounting based on standardized unit price and actual consumption. The impact range control effect is evaluated by the ratio of the final impact range to the expected impact range, with a ratio less than 1.0 considered effective and a ratio greater than 1.5 considered ineffective.

[0094] The time sequence matching algorithm accurately matches the timestamps of early warning information and optimization data, with a matching precision of minutes and a matching time window set to 30 minutes before and after the early warning trigger. The matching rule is based on the nearest neighbor principle, finding the closest time disposal record and effect evaluation for each early warning information. In the case of multiple-to-one matching, the time distance weighted average method is used to combine the disposal data, and in the case of one-to-many matching, the record with the best disposal effect is selected as the matching result. The matching quality is evaluated based on time interval, content relevance, and logical consistency, with a time interval of less than 10 minutes and a content relevance of greater than 0.8 considered excellent.

[0095] The early warning accuracy rate calculation is based on the early warning hit condition counted by the confusion matrix, the accuracy rate is equal to the number of correct early warnings divided by the total number of early warnings, the calculation period is counted once a week, and the accuracy rate is set to be more than 85%. The false positive rate is the proportion of false positive early warnings in the total early warnings, and the target false positive rate is controlled to be less than 10%. The false negative rate is the proportion of missed risk reports in the actual risks, and the target false negative rate is controlled to be less than 5%. The disposal effectiveness evaluation is based on the risk elimination efficiency, resource utilization efficiency, secondary risk control and other comprehensive indexes. The risk elimination efficiency is the ratio of the actual elimination time to the standard elimination time, and the resource utilization efficiency is the ratio of the standard resource consumption to the actual resource consumption.

[0096] The early warning response rule optimization is based on the accuracy rate and effectiveness analysis results for targeted optimization. The early warning type with an accuracy rate lower than 80% is re-calibrated with threshold parameters, and the response measure with an effectiveness lower than 75% is re-designed with a disposal process. The rule optimization adopts a machine learning method to mine optimization rules from historical data. Feature engineering extracts multi-dimensional variables such as risk features, disposal features and effect features. Model training adopts a random forest algorithm to establish a rule optimization model. Model verification evaluates the optimization effect based on a cross-validation method, and the verification accuracy rate target is more than 90%.

[0097] The emergency management practice experience mining is based on deep analysis of historical disposal cases in different regions. The region division is based on a region tag system established based on geographical location, industry type, risk features and other dimensions. The experience extraction algorithm adopts an association rule mining method to identify the association mode of disposal measures and disposal effects, with a support threshold of 0.1, a confidence threshold of 0.7 and an improvement threshold of 1.2. The experience knowledge is represented in the form of a rule base, and the rule contains elements such as premise conditions, execution actions and expected results. The rule priority is determined based on historical verification effect.

[0098] In a second aspect of the embodiment of the present application, a mine abnormal event real-time identification system based on time sequence features is provided, comprising: An acquisition unit is configured to acquire multi-modal monitoring data collected by a mine distributed sensor, perform space-time alignment and semantic labeling on the multi-modal monitoring data, analyze and identify safety element entities and attribute features thereof, and construct a time sequence knowledge graph based on the safety element entities and the attribute features. An analysis unit is configured to establish an association mapping between entities in the time sequence knowledge graph, and calculate dynamic association weights between entities in different time windows. Based on the dynamic association weights, a safety risk propagation path is analyzed to obtain a risk propagation link set. A prediction unit is configured to, for each link in the risk propagation link set, obtain a risk development trend through recursive calculation, and predict a risk situation at a future time step based on historical evolution rules in the time sequence knowledge graph to generate a risk prediction result. An optimization unit is used to dynamically generate differentiated early warning strategies according to the degree of association between the risk prediction result and the risk propagation link; a closed-loop tracking system of early warning response is established, the early warning result, the disposal process and the actual effect are included in the decision basis of system optimization, and the early warning emergency management ecology is continuously optimized by deeply mining the emergency management practical experience of each region.

[0099] In a third aspect, the present application provides an electronic device, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0100] In a fourth aspect, the present application provides a computer-readable storage medium having stored thereon computer program instructions, which, when executed by a processor, implement the method described above.

[0101] The present application can be a method, device, system and / or computer program product. The computer program product can include a computer-readable storage medium having stored thereon computer-readable program instructions that, when executed by a processor, implement various aspects of the present application.

[0102] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for real-time identification of mine abnormal events based on timing characteristics, characterized in that, The method comprises the following steps: acquiring multi-modal monitoring data collected by a distributed sensor of a mine, and performing spatio-temporal alignment and semantic labeling on the multi-modal monitoring data, analyzing and identifying safety element entities and their attribute characteristics, and constructing a time-series knowledge graph based on the safety element entities and the attribute characteristics; establishing a correlation mapping between entities in the time-series knowledge graph, and calculating dynamic correlation weights between entities in different time windows; analyzing the propagation path of a safety risk based on the dynamic correlation weights to obtain a risk propagation link set; for each link in the risk propagation link set, recursively calculating a risk development trend, and predicting a risk situation at a future time step based on historical evolution rules in the time-series knowledge graph to generate a risk prediction result; dynamically generating a differentiated early warning strategy according to the correlation degree between the risk prediction result and the risk propagation link; simultaneously establishing a closed-loop tracking system for early warning responses, incorporating early warning results, disposal processes, and actual effects into the decision basis for system optimization, and forming a continuously optimized early warning and emergency management ecosystem by deeply mining the practical experience of emergency management in each region.

2. The method of claim 1, wherein, The method of performing spatio-temporal alignment and semantic labeling on the multi-modal monitoring data, analyzing and identifying safety element entities and their attribute characteristics, and constructing a time-series knowledge graph based on the safety element entities and the attribute characteristics comprises the following steps: performing time-series calibration on different modal data streams in the multi-modal monitoring data according to timestamps, and performing spatial registration on data collected by different spatial nodes based on a spatial position mapping relationship to obtain a unified data representation after spatio-temporal alignment; performing semantic analysis on data items in the unified data representation using a pre-trained domain knowledge base and ontology model, identifying entity types, relationship types between entities, and entity attributes corresponding to the data items, and ensuring the accuracy of the labeling results through consistency checking and conflict resolution to obtain standardized data after semantic labeling; identifying safety element entities from the standardized data after semantic labeling, and extracting static attribute characteristics and dynamic behavior characteristics corresponding to each safety element entity based on the entity types, relationship types between entities, and entity attributes to construct an entity-feature mapping set; constructing an initial time-series knowledge graph based on the safety element entities and the entity-feature mapping set corresponding to the safety element entities, and performing topological integrity verification on the initial time-series knowledge graph using the relationship types between entities to identify isolated nodes and broken paths in the graph, and completing missing entity relationships in combination with relationship reasoning rules to finally form a complete time-series knowledge graph.

3. The method of claim 2, wherein, The method of constructing an initial time-series knowledge graph based on the safety element entities and the entity-feature mapping set corresponding to the safety element entities, and performing topological integrity verification on the initial time-series knowledge graph using the relationship types between entities to identify isolated nodes and broken paths in the graph comprises the following steps: The security element entity is taken as a node set, and an attribute vector is given to each node according to an entity-feature mapping set; a directed edge set between nodes is constructed based on the relationship type between entities, and a relationship strength measurement value and a time evolution constraint are added to each directed edge; the node set, the attribute vector and the directed edge set are combined to form a topology structure of an initial time sequence knowledge graph; Topology integrity verification is performed on the initial time sequence knowledge graph, the in-degree and out-degree of each node are calculated by traversing the directed edge set, nodes with both in-degree and out-degree of zero are identified as isolated nodes, and broken paths caused by the lack of necessary intermediate nodes are detected through path connectivity analysis; For the isolated nodes identified in the topology integrity verification, potential associated relationships are queried in the domain ontology model based on the relationship type between entities, and associated edges are supplemented for the isolated nodes according to the query results to eliminate the isolated state; For the broken paths identified in the topology integrity verification, the semantic association between the starting point and the ending point of the path is analyzed, and the missing intermediate entities and their associated relationships are inferred using relationship reasoning rules to complete the broken paths in the initial time sequence knowledge graph.

4. The method of claim 1, wherein, An associated mapping between entities is established in the time sequence knowledge graph, and dynamic association weights between entities under different time windows are calculated; Based on the dynamic association weights, the propagation path of the security risk is analyzed to obtain a risk propagation link set, including: From the time sequence knowledge graph, entity nodes and edge relationships between them are extracted, an associated mapping matrix between entities is established based on semantic types and directionality, and for different time windows, dynamic association weight matrices between entities are calculated through a time sequence-aware graph attention mechanism according to the state change sequence of the entities in the time window and the causal dependency relationship between entities; Based on the dynamic association weight matrix, the corresponding entity pair positions in the associated mapping matrix are weighted, and the entity nodes, edge relationships and their weights are combined to form a weighted graph structure associated with the time window; In the weighted graph structure, the identified risk source node is selected as the starting point, edges with weights exceeding a preset propagation threshold are selected based on dynamic association weights, the propagation trajectory of the risk from the source node to the downstream node is tracked through a path search strategy combining breadth-first traversal and depth-first traversal, and multiple paths involved in the propagation trajectory are aggregated and deduplicated, finally obtaining a risk propagation link set.

5. The method of claim 4, wherein, The propagation trajectory of the risk from the source node to the downstream node is tracked through a path search strategy combining breadth-first traversal and depth-first traversal, and multiple paths involved in the propagation trajectory are aggregated and deduplicated, including: The propagation trajectory of the risk from the source node to the downstream node is tracked by a path search strategy combining breadth-first traversal and depth-first traversal, wherein the breadth-first traversal sequentially accesses all adjacent nodes of each level based on a node queue to build the propagation range of the risk at the current level and obtain a node set of each level; the depth-first traversal preferentially explores the vertical extension direction of a single path along a weight edge based on a node stack until a propagation termination condition is reached to obtain a node sequence of each extended path; In each iteration, the breadth-first traversal is first performed to determine the level propagation range based on the node sequence, the depth-first traversal is performed to explore the extended path of each node, the propagation trajectory is integrated, and multiple paths involved in the propagation trajectory are aggregated and de-duplicated.

6. The method of claim 1, wherein, For each link in the set of risk propagation links, the risk development trend is obtained by recursive calculation, and the risk situation at the future time step is predicted based on the historical evolution law in the time sequence knowledge graph to generate a risk prediction result including: For each link in the set of risk propagation links, a state transition matrix is constructed based on the weight relationship between adjacent nodes in the link, and a state migration probability distribution is trained in combination with a historical state sequence of the node, and the development trend value and trend confidence of the risk on the corresponding link are obtained by recursive operation of the chain condition probability; the sensitivity coefficient of each node in the link propagation process is calculated, and the development trend value is optimized based on the sensitivity coefficient to obtain an optimized trend value considering the influence degree of the node; In the time sequence knowledge graph, a historical propagation path similar to the corresponding link and its evolution characteristics are identified, the structural similarity and state similarity between the current link and the historical path are calculated, and the evolution contribution of each historical path is determined based on the structural similarity and the state similarity; the evolution law of the historical path is constructed according to the evolution contribution; the optimized trend value is associated and integrated with the evolution law, and the risk situation at the future time step is predicted based on the trend confidence to generate a risk prediction result.

7. The method of claim 1, wherein, A closed-loop tracking system for early warning response is established, and the early warning result, disposal process and actual effect are included in the decision basis for system optimization, and through deep mining of the practical experience of emergency management in each region, a continuously optimized early warning and emergency management ecology is formed including: A closed-loop tracking system for early warning response is established, and a time sequence feature sequence is constructed for each early warning event, the early warning trigger time, response time limit and response level are recorded as the early warning result, the disposal personnel configuration, emergency resource scheduling and disposal steps are recorded as the disposal process, the risk elimination degree, target recovery state and subsequent monitoring data are recorded as the actual effect, and the early warning result, the disposal process and the actual effect are associated and mapped based on the time sequence feature sequence to form a closed-loop data link; extract historical early warning events from the closed-loop data link and group them according to regional attributes and early warning types, calculate timeliness indicators and effect evaluation indicators for early warning response data in each group, screen high-efficiency handling cases with the effect evaluation indicators in the front row, analyze early warning response links based on the high-efficiency handling cases, mine combination patterns of the handling step records and configuration features of the emergency resource scheduling, and construct the early warning results, the handling process, and the actual effect as decision basis for system optimization; by deeply mining the emergency management experience of each region, identify the difference characteristics of regional early warning response from the decision basis, extract the optimization direction of the handling scheme suitable for each region, continuously improve the early warning response strategy, and form a continuously optimized early warning emergency management ecology.

8. A mine abnormal event real-time identification system based on timing characteristics, for implementing the method of any one of the preceding claims 1-7, characterized in that, Comprise: an acquisition unit configured to acquire multi-modal monitoring data collected by a distributed sensor of a mine, perform spatio-temporal alignment and semantic labeling on the multi-modal monitoring data, analyze and identify safety element entities and their attribute features, and construct a time-series knowledge graph based on the safety element entities and the attribute features; an analysis unit configured to establish a correlation mapping between entities in the time-series knowledge graph and calculate dynamic correlation weights between entities in different time windows; analyze the propagation path of a safety risk based on the dynamic correlation weights to obtain a risk propagation link set; a prediction unit configured to, for each link in the risk propagation link set, obtain a risk development trend through recursive calculation, predict a risk situation at a future time step based on historical evolution rules in the time-series knowledge graph, and generate a risk prediction result; an optimization unit configured to dynamically generate a differentiated early warning strategy according to the risk prediction result and the correlation degree of the risk propagation link; Meanwhile, a closed-loop tracking system for early warning response is established, the early warning results, the handling process, and the actual effect are included in the decision basis for system optimization, and by deeply mining the emergency management experience of each region, a continuously optimized early warning emergency management ecology is formed.

9. An electronic device, comprising: Comprise: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to invoke the instructions stored in the memory to execute the method of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions are executed by the processor to implement the method of any one of claims 1 to 7. The computer program instructions are executed by the processor to implement the method of any one of claims 1 to 7.

Images