An abnormality detection method and system based on real-time monitoring data of a mine

Abstract

The application belongs to the technical field of anomaly detection, and discloses an anomaly detection method and system based on real-time monitoring data of mines. The method comprises the following steps: based on a feasible mechanism, key generation and real-name authentication are performed on all mine monitoring servers connected to a cloud data center; based on the cloud data center, data dimension reduction is performed on a plurality of historical monitoring data, and an anomaly detection model is constructed; based on the mine monitoring server, the collected real-time monitoring data is encrypted and signed, and uploaded to the cloud data center; based on the cloud data center, signature authentication and decryption are performed, and the anomaly detection model is used to perform anomaly detection on the decrypted real-time monitoring data, to obtain a real-time anomaly detection result. The application solves the problems of poor anomaly detection accuracy, low efficiency, low storage reliability and low transmission security in the prior art.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of anomaly detection, and particularly relates to an anomaly detection method and system based on real-time monitoring data of mines. BACKGROUND

[0002] The real-time monitoring system of mines can monitor the production environment, equipment operation state, worker operation safety and the like of mines in real time, and provide important data support for mine safety management. However, in a large amount of monitoring data, how to quickly and accurately find abnormal conditions becomes a problem to be solved.

[0003] At present, common anomaly detection methods include statistical methods and machine learning methods, etc., to solve the problems of high labor cost and heavy workload caused by relying on manual anomaly data analysis. Among them, the statistical method cannot grasp the potential relationship between real-time monitoring data and abnormal conditions, the accuracy of anomaly detection is poor, and it cannot meet the actual requirements; the machine learning method has great advantages in processing complex data structures and extracting features, but it consumes a lot of computing time and has low anomaly detection efficiency. Moreover, the existing anomaly detection methods are usually based on local servers, which have high requirements for the hardware configuration of local servers, are prone to hardware crashes leading to data loss, and have low data storage reliability; real-time monitoring data are prone to malicious interception during transmission, leading to data leakage, and have low data transmission security. SUMMARY

[0004] In order to solve the problems of poor anomaly detection accuracy, low efficiency, low storage reliability and low transmission security existing in the prior art, the application aims to provide an anomaly detection method and system based on real-time monitoring data of mines.

[0005] The technical scheme adopted by the application is as follows:

[0006] An anomaly detection method based on real-time monitoring data of mines, comprising the following steps:

[0007] Based on the feasible mechanism, the key generation and real-name authentication are performed on all mine monitoring servers connected to the cloud data center to obtain the public-private key pair and registration information of each mine monitoring server, the private key in the public-private key pair is returned to the corresponding mine monitoring server, and the public key in the public-private key pair is published to the cloud data center;

[0008] Based on the cloud data center, the data dimension reduction is performed on a plurality of historical monitoring data to obtain a plurality of reduced historical monitoring data, and an anomaly detection model is constructed using a deep learning algorithm according to the plurality of reduced historical monitoring data;

[0009] Based on the mine monitoring server, the collected real-time monitoring data is encrypted and signed according to the private key in the public-private key pair and the registration information, and the encrypted real-time monitoring data and signature data are obtained, and the encrypted real-time monitoring data and signature data are uploaded to the cloud data center;

[0010] Based on the cloud data center, the signature data is subjected to signature authentication, and after the signature authentication is passed, the encrypted real-time monitoring data is decrypted according to the public key in the public-private key pair to obtain decrypted real-time monitoring data, and the decrypted real-time monitoring data is subjected to anomaly detection using an anomaly detection model to obtain real-time anomaly detection results.

[0011] Further, based on the feasible organization, the key generation and real-name authentication are performed on all mine monitoring servers connected to the cloud data center to obtain the public-private key pair and the registration information of each mine monitoring server, the private key in the public-private key pair is returned to the corresponding mine monitoring server, and the public key in the public-private key pair is published to the cloud data center, including the following steps:

[0012] The server IP, attribute information and entity ID of all mine monitoring servers connected to the cloud data center are collected, and a plurality of server IPs, a plurality of attribute information and a plurality of corresponding entity IDs are sent to the feasible organization;

[0013] Based on the feasible organization, the key generation is performed using an asymmetric encryption algorithm according to the attribute information of the mine monitoring server to obtain the corresponding public-private key pair;

[0014] Real-name authentication is performed according to the private key in the public-private key pair and the corresponding entity ID to obtain the registration information of the corresponding mine monitoring server;

[0015] According to the server IP, the private key and the registration information in the public-private key pair are returned to the corresponding mine monitoring server, and the public key in the public-private key pair is published to the cloud data center.

[0016] Further, based on the cloud data center, the data dimensionality reduction is performed on a plurality of historical monitoring data to obtain a plurality of reduced historical monitoring data, and the anomaly detection model is constructed using a deep learning algorithm according to the plurality of reduced historical monitoring data, including the following steps:

[0017] Based on the cloud data center, a plurality of historical monitoring data are collected, and each historical monitoring data is preprocessed to obtain a plurality of corresponding preprocessed historical monitoring data;

[0018] The PCA method is used to perform data dimensionality reduction on the plurality of preprocessed historical monitoring data to obtain a plurality of corresponding reduced historical monitoring data and a monitoring key indicator set;

[0019] The label adding is performed on the historical monitoring data after dimension reduction to obtain a plurality of anomaly detection samples provided with a preset anomaly detection label;

[0020] According to the plurality of anomaly detection samples, an anomaly detection model is constructed using an IPCO-BiLSTM algorithm.

[0021] Further, the PCA method is used to perform data dimension reduction on the plurality of preprocessed historical monitoring data to obtain corresponding historical monitoring data after dimension reduction and a monitoring key indicator set, including the following steps:

[0022] The matrix conversion is performed on each preprocessed historical monitoring data to obtain a corresponding preprocessed historical monitoring data matrix;

[0023] The standardization processing is performed on the preprocessed historical monitoring data matrix to obtain a corresponding standardized historical monitoring data matrix;

[0024] The covariance matrix of the standardized historical monitoring data matrix is obtained, and according to the standardized historical monitoring data matrix and the covariance matrix, a corresponding candidate principal component matrix is obtained; the candidate principal component matrix includes a plurality of candidate column vectors;

[0025] The plurality of candidate column vectors with a cumulative variance contribution rate of 90% in the candidate principal component matrix are taken as a plurality of principal component column vectors to obtain a historical monitoring data matrix after dimension reduction composed of the plurality of principal component column vectors;

[0026] The historical monitoring data matrix after dimension reduction is converted into corresponding historical monitoring data after dimension reduction, and the monitoring indicators corresponding to the principal component column vectors are integrated as monitoring key indicators to obtain a corresponding monitoring key indicator set.

[0027] Further, according to the plurality of anomaly detection samples, an anomaly detection model is constructed using an IPCO-BiLSTM algorithm, including the following steps:

[0028] The plurality of anomaly detection samples are divided into a model training sample set and a model test sample set according to a ratio of 7:3;

[0029] The optimal initial network parameters of the BiLSTM network are obtained using an IPCO optimization algorithm;

[0030] According to the optimal initial network parameters, an initial anomaly detection model is constructed using a BiLSTM algorithm;

[0031] The initial anomaly detection model is optimized and trained using the model training sample set to obtain an optimized anomaly detection model;

[0032] Input the model test sample set into the optimized anomaly detection model to perform anomaly detection, and obtain corresponding historical prediction anomaly detection labels;

[0033] Compare the historical prediction anomaly detection labels with corresponding preset anomaly detection labels to obtain a prediction accuracy of the optimized anomaly detection model;

[0034] If the prediction accuracy is greater than the accuracy threshold, output the optimal anomaly detection model, otherwise, continue optimization training.

[0035] Further, the optimal initial network parameters of the BiLSTM network are obtained using the IPCO optimization algorithm, including the following steps:

[0036] Encode the candidate initial network parameters of the BiLSTM network into the positions of the IPCO individuals of the IPCO optimization algorithm;

[0037] Set the IPCO population parameters, the maximum number of iterations, and the fitness function of the IPCO optimization algorithm;

[0038] According to the number of individuals in the IPCO population parameters, use the Circle chaotic mapping sequence for initialization to obtain the initial IPCO population;

[0039] Introduce a cyclic population reduction mechanism to limit the number of individuals in the IPCO population parameters to obtain updated IPCO population parameters for the next iteration;

[0040] According to the fitness function, calculate the initial fitness values of the initial IPCO individuals in the initial IPCO population;

[0041] According to the initial fitness values and the updated IPCO population parameters, use the first defense strategy, the second defense strategy, the third defense strategy, and the fourth defense strategy to update the initial IPCO population to obtain an updated IPCO population;

[0042] Use a dynamic backpropagation algorithm to perform dynamic backpropagation learning on the updated IPCO population to generate a dynamically backpropagated IPCO population;

[0043] According to the fitness function, calculate the fitness values of all IPCO individuals in the updated IPCO population and the dynamically backpropagated IPCO population, and take the IPCO individual with the minimum fitness value as the optimal individual;

[0044] If the number of iterations reaches the maximum number of iterations or the fitness value of the optimal individual meets the requirements, output the optimal solution corresponding to the current optimal individual to obtain the optimal initial network parameters of the BiLSTM network.

[0045] Further, based on the mine monitoring server, the collected real-time monitoring data is encrypted and signed according to the private key in the public-private key pair and the registration information, to obtain encrypted real-time monitoring data and signature data, and the encrypted real-time monitoring data and the signature data are uploaded to the cloud data center, including the following steps:

[0046] Based on the mine monitoring server, the real-time monitoring data is encrypted using an asymmetric encryption algorithm according to the private key in the public-private key pair sent by the feasible organization, to obtain corresponding encrypted real-time monitoring data;

[0047] According to the registration information sent by the feasible organization, the corresponding encrypted real-time monitoring data is signed to obtain the signature data of the corresponding encrypted real-time monitoring data;

[0048] The encrypted real-time monitoring data and the signature data are uploaded to the cloud data center.

[0049] Further, based on the cloud data center, the signature data is subjected to signature authentication, and after the signature authentication passes, the encrypted real-time monitoring data is decrypted according to the public key in the public-private key pair to obtain decrypted real-time monitoring data, and an anomaly detection model is used to detect anomalies in the decrypted real-time monitoring data to obtain real-time anomaly detection results, including the following steps:

[0050] Based on the cloud data center, the feasible organization is called to perform signature authentication on the signature data according to the registration information of the mine monitoring server, and if the signature authentication passes, the next step is entered, otherwise, the corresponding encrypted real-time monitoring data is blocked, an intrusion alarm signal is issued, and the anomaly detection method is ended;

[0051] After the signature authentication passes, the encrypted real-time monitoring data uploaded by the mine monitoring server is received, and the encrypted real-time monitoring data is decrypted according to the public key in the public-private key pair to obtain decrypted real-time monitoring data;

[0052] According to the monitoring key indicator set, the decrypted real-time monitoring data is subjected to data dimension reduction to obtain corresponding reduced real-time monitoring data;

[0053] An anomaly detection model is used to detect anomalies in the reduced real-time monitoring data to obtain real-time anomaly detection results;

[0054] If the real-time anomaly detection result is that there is data anomaly, an abnormal data alarm signal is issued, and the anomaly detection method is ended, otherwise, the next encrypted real-time monitoring data and signature data are received.

[0055] An anomaly detection system based on real-time mine monitoring data is provided to implement anomaly detection methods. The system includes a cloud data center, a feasible organization, and several mine monitoring servers. The cloud data center and the feasible organization are respectively connected to the several mine monitoring servers, and the cloud data center is connected to the feasible organization.

[0056] Furthermore, the cloud data center includes a data dimensionality reduction unit, a model building unit, a data decryption unit, and an anomaly detection unit connected in sequence. The data decryption unit is communicatively connected to the feasible organization and several mine monitoring servers, respectively.

[0057] The beneficial effects of this invention are as follows:

[0058] This invention discloses an anomaly detection method and system based on real-time mine monitoring data. It achieves automated and intelligent real-time anomaly detection of mine site monitoring data, reducing labor costs and workload. By using a cloud data center for unified management, storage, and anomaly detection of massive amounts of monitoring data, it lowers the hardware configuration requirements for local servers. The anomaly detection model, built based on deep learning algorithms, can uncover deep connections between monitoring data and anomalies, improving anomaly detection efficiency and accuracy while avoiding the low storage reliability issues inherent in local server storage. In data transmission, the combination of asymmetric encryption technology and digital identity authentication enhances data transmission security.

[0059] Other beneficial effects of the present invention will be further explained in the specific embodiments. Attached Figure Description

[0060] Figure 1 This is a flowchart of the anomaly detection method based on real-time monitoring data of mines in this invention.

[0061] Figure 2 This is a structural block diagram of the anomaly detection system based on real-time mine monitoring data in this invention. Detailed Implementation

[0062] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments.

[0063] Example 1:

[0064] like Figure 1 As shown in the figure, this embodiment provides an anomaly detection method based on real-time monitoring data of a mine, including the following steps:

[0065] S1: based on the feasible organization, all the mine monitoring servers connected to the cloud data center are subjected to key generation and real-name authentication, the public-private key pair and registration information of each mine monitoring server are obtained, the private key in the public-private key pair is returned to the corresponding mine monitoring server, and the public key in the public-private key pair is published to the cloud data center, including the following steps:

[0066] S1-1: collect the server IP, attribute information and entity ID of all mine monitoring servers connected to the cloud data center, and send a plurality of server IPs, a plurality of attribute information and a plurality of corresponding entity IDs to the feasible organization;

[0067] S1-2: based on the feasible organization, according to the attribute information of the mine monitoring server, the key generation is carried out using an asymmetric encryption algorithm, and the corresponding public-private key pair is obtained, including the following steps:

[0068] S1-2-1: key initialization is carried out to generate public parameters GP, master key MSK and initial key PK, and the formula is:

[0069]

[0070]

[0071]

[0072] In the formula, GP is the public parameter; MSK is the master key; PK is the initial key; a is a random number in the integer domain; are target hash functions; are random numbers of cyclic group generators; is a bilinear mapping of random number g;

[0073] S1-2-2: according to the public parameters GP, the master key MSK, the initial key PK and the attribute information V u of the mine monitoring server, the public-private key pair of the corresponding mine monitoring server is generated, the public-private key pair includes the private key SK u and the public key PK u , and the formula is:

[0074]

[0075]

[0076] In the formula, is the private key of the mine monitoring server u; b is a random number in the integer domain Z p ; Lu, are private key parameters; H3 is a target hash function of public parameter GP; u is a mine monitoring server indication quantity; MSK is a master key; PK is an initial key; PK u is a public key of mine monitoring server u; g b , g a , g ab is a random number of a generator of cyclic group G; V u is attribute information of mine monitoring server u;

[0077] S1-3: Real-name authentication is performed according to the private key in the public-private key pair and the corresponding entity ID, and the registration information of the corresponding mine monitoring server is obtained, and the formula is:

[0078]

[0079] In the formula, k is a random number; K u is a registration parameter of mine monitoring server u; KID u is a registration ID of mine monitoring server u; KID u and the corresponding K u constitute registration information {K u , KID u}; H1 is a target hash function; ID u is an entity ID of mine monitoring server u; SK u is a private key of mine monitoring server u; is a prime field base point; is a prime number order;

[0080] S1-4: According to the server IP, the private key SK u in the public-private key pair and the registration information {K u , KID u} are returned to the corresponding mine monitoring server, and the public key PK u in the public-private key pair is published to the cloud data center;

[0081] S2: Based on the cloud data center, a plurality of historical monitoring data are dimensionally reduced to obtain a plurality of reduced historical monitoring data, and an anomaly detection model is constructed using a deep learning algorithm according to the plurality of reduced historical monitoring data, including the following steps:

[0082] S2-1: Based on the cloud data center, a plurality of historical monitoring data are collected, and each historical monitoring data is preprocessed to obtain a plurality of corresponding preprocessed historical monitoring data;

[0083] S2-2: Using Principal Component Analysis (PCA), dimensionality reduction is performed on several preprocessed historical monitoring data sets to obtain corresponding sets of dimensionality-reduced historical monitoring data and key monitoring indicators. This includes the following steps:

[0084] S2-2-1: Perform matrix transformation on each preprocessed historical monitoring data to obtain the corresponding preprocessed historical monitoring data matrix. ,in, Let p be the row vector of the p-th preprocessed historical monitoring data, where p is the row vector indicator, n is the total number of preprocessed historical monitoring data, and T is the transpose identifier.

[0085] S2-2-2: Standardize the preprocessed historical monitoring data matrix to obtain the corresponding standardized historical monitoring data matrix. The formula is:

[0086]

[0087] In the formula, σ represents the standardized historical monitoring data matrix; μ represents the mean of the preprocessed historical monitoring data matrix; σ represents the variance of the preprocessed historical monitoring data matrix.

[0088] S2-2-3: Obtain the covariance matrix of the standardized historical monitoring data matrix, and based on the standardized historical monitoring data matrix and the covariance matrix, obtain the corresponding candidate principal component matrix; the candidate principal component matrix includes several candidate column vectors; the candidate column vectors of the candidate principal component matrix are the candidate key indicator data of historical monitoring, and the formula is:

[0089]

[0090] In the formula, D is the covariance matrix of the standardized historical monitoring data matrix; Y is the candidate principal component matrix; P is the transformation matrix; E is the unit eigenvector matrix; and n is the total number of preprocessed historical monitoring data.

[0091] Y = PX'

[0092] In the formula, Y is the candidate principal component matrix; P is the transformation matrix; and X' is the standardized historical monitoring data matrix.

[0093] S2-2-4: Select principal component matrices Several candidate column vectors representing the top 90% of the cumulative contribution rate of the variance are used as corresponding principal component column vectors. Let l be the l-th candidate column vector, l be the column vector indicator, and L be the total number of candidate column vectors; this yields a dimensionality-reduced historical monitoring data matrix composed of several principal component column vectors. wherein, is the lth principal component column vector, l is the column vector indicator, K is the total number of principal component column vectors, and the formula is:

[0094] The formula is:

[0095]

[0096] In the formula, G is the cumulative variance contribution rate; The lth alternative principal component y l The variance of the lth principal component column vector;

[0097] S2-2-5: Convert the dimensionality-reduced historical monitoring data matrix into corresponding dimensionality-reduced historical monitoring data, and integrate the monitoring indicators corresponding to the principal component column vectors as monitoring key indicators to obtain a corresponding monitoring key indicator set;

[0098] Data dimensionality reduction on monitoring data can find the main features in the monitoring data, and the dimensionality reduction is achieved by retaining the features that explain most of the variance, thereby retaining the main information of the monitoring data to some extent. By reducing the dimension of the monitoring data, it can help to simplify the training difficulty of the subsequent model, reduce the computational complexity, and at the same time, it can improve the prediction speed and efficiency of the model;

[0099] S2-3: Adding labels to the dimensionality-reduced historical monitoring data to obtain a plurality of anomaly detection samples provided with a preset anomaly detection label;

[0100] S2-4: According to the plurality of anomaly detection samples, an Improved Crested Porcupine Optimizer (ICPO) optimization algorithm-Bidirectional Long Short-Term Memory (BiLSTM) algorithm is used to construct an anomaly detection model, including the following steps:

[0101] S2-4-1: Divide the plurality of anomaly detection samples into a model training sample set and a model test sample set according to a ratio of 7:3;

[0102] S2-4-2: Use the IPCO optimization algorithm to obtain the optimal initial network parameters of the BiLSTM network, including the following steps:

[0103] S2-4-2-1: Encode the alternative initial network parameters of the BiLSTM network into the positions of the IPCO individuals of the IPCO optimization algorithm;

[0104] S2-4-2-2: Set the IPCO population parameters, maximum iteration number, and fitness function of the IPCO optimization algorithm;

[0105] S2-4-2-3: According to the number of individuals in the initial IPCO population, the initial IPCO population is initialized using the Circle chaotic mapping sequence, and the formula is:

[0106]

[0107] In the formula, is the initial IPCO individual of the Circle chaotic mapping; is the initial IPCO individual generated randomly; is the IPCO individual indicator;

[0108] S2-4-2-4: A cyclic population reduction mechanism is introduced to limit the number of individuals in the initial IPCO population, and the updated IPCO population parameter of the next iteration is obtained, and the formula is:

[0109]

[0110] In the formula, S t+1 is the number of individuals in the initial IPCO population; S t is the number of individuals in the initial IPCO population; S min is the minimum number of individuals in the initial IPCO population; a% is the function evaluation parameter; V is the function evaluation cycle parameter; V max is the maximum function evaluation cycle parameter;

[0111] S2-4-2-5: According to the fitness function, the initial fitness value of the initial IPCO individual in the initial IPCO population is calculated, and the formula is:

[0112]

[0113] In the formula, is the fitness value of the IPCO individual ; MSE is the prediction mean square error function; , are the predicted value and the true value of the IPCO individual respectively; S is the number of individuals in the initial IPCO population;

[0114] S2-4-2-6: According to the initial fitness value and the updated IPCO population parameter, the initial IPCO population is updated using the first defense strategy, the second defense strategy, the third defense strategy and the fourth defense strategy, and the updated IPCO population is obtained;

[0115] The formula of the first defense strategy is:

[0116]

[0117] wherein, is the updated IPCO individual in the first defense range; is the initial IPCO individual in the first defense range; is a random number based on normal distribution; is a random value in the interval [0, 1]; is the optimal solution in the first defense range; is the generated vector between the real optimal solution and the randomly selected optimal solution from the IPCO population in the first defense range; is the IPCO individual indicator; t is the iteration indicator;

[0118] The formula of the second defense strategy is:

[0119]

[0120] wherein, is the updated IPCO individual in the second defense range; is the initial IPCO individual in the second defense range; is the search upper limit vector of the second defense range; is a random value in the interval [0, 1]; , are the r1, r2 initial IPCO individuals respectively; r1, r2 are both random integers between [0, S]; is the generated vector between the real optimal solution and the randomly selected optimal solution from the IPCO population in the second defense range;

[0121] The formula of the third defense strategy is:

[0122]

[0123] wherein, is the updated IPCO individual in the third defense range; is the initial IPCO individual in the third defense range; is the search upper limit vector of the third defense range; , are the r2, r3 initial IPCO individuals respectively; r3 is a random integer between [1, S]; is the smell diffusion factor defined by the fitness function; is the defense factor; is the search direction control parameter;

[0124] The formula of the fourth defense strategy is:

[0125]

[0126] wherein, is the updated IPCO individual in the fourth defense range; is the initial IPCO individual in the fourth defense range; is the optimal solution in the fourth defense range; , are random values in the interval [0, 1]; is the defense factor; is the search direction control parameter; is the average force affecting the search direction; is the convergence speed factor;

[0127] S2-4-2-7: using the dynamic reverse learning algorithm, the updated IPCO population is dynamically learned in reverse to generate a dynamically reversed IPCO population, and the formula is:

[0128]

[0129] wherein, is the dynamically reversed IPCO individual; γ is the decreasing inertia coefficient; , are the maximum and minimum values of the vector space respectively; is the updated IPCO individual;

[0130] S2-4-2-8: according to the fitness function, the fitness values of all IPCO individuals in the updated IPCO population and the dynamically reversed IPCO population are calculated, and the IPCO individual with the minimum fitness value is taken as the optimal individual;

[0131] S2-4-2-9: if the number of iterations reaches the maximum number of iterations or the fitness value of the optimal individual meets the requirements, the optimal solution corresponding to the current optimal individual is output to obtain the optimal initial network parameters of the BiLSTM network;

[0132] The IPCO optimization algorithm can accurately optimize the initial network structure of the BiLSTM network, which is very important for the initialization of network parameters, because good initialization can improve the convergence speed and final performance of the algorithm. The IPCO optimization algorithm can find the global optimal solution of the integer programming problem, which means that the best initial parameters in all possible parameter configurations can be found for the BiLSTM network. By optimizing the initial network parameters of the BiLSTM network, the generalization ability of the BiLSTM model can be improved, and the risk of overfitting or underfitting can be reduced, so as to obtain better performance on unseen data;

[0133] S2-4-3: according to the optimal initial network parameters, using the BiLSTM algorithm, an initial anomaly detection model is constructed;

[0134] S2-4-4: using the model training sample set, the initial anomaly detection model is optimized and trained to obtain an optimized anomaly detection model;

[0135] S2-4-5: input the model test sample set into the optimized anomaly detection model, perform anomaly detection, and obtain a plurality of corresponding historical prediction anomaly detection labels;

[0136] S2-4-6: compare the plurality of historical prediction anomaly detection labels with a plurality of corresponding preset anomaly detection labels to obtain the prediction accuracy of the optimized anomaly detection model;

[0137] S2-4-7: if the prediction accuracy is greater than the accuracy threshold, output the optimal anomaly detection model, otherwise, continue to optimize and train;

[0138] S3: based on the mine monitoring server, according to the private key in the public-private key pair and the registration information, the collected real-time monitoring data is encrypted and signed to obtain encrypted real-time monitoring data and signature data, and the encrypted real-time monitoring data and signature data are uploaded to the cloud data center, including the following steps:

[0139] S3-1: based on the mine monitoring server, according to the private key in the public-private key pair sent by the feasible organization, the real-time monitoring data is encrypted using an asymmetric encryption algorithm to obtain corresponding encrypted real-time monitoring data, the formula is:

[0140]

[0141] In the formula, is the encrypted real-time monitoring data of the mine monitoring server u; E(*) is an asymmetric encryption function; is the real-time monitoring data of the mine monitoring server u; is the private key of the mine monitoring server u; u is the indication quantity of the mine monitoring server;

[0142] S3-2: according to the registration information sent by the feasible organization, the corresponding encrypted real-time monitoring data is signed to obtain the signature data of the corresponding encrypted real-time monitoring data, the formula is:

[0143]

[0144] In the formula, r is a random number; is the base point of the prime field; is the prime order; is the target hash function; is the registration parameter of the mine monitoring server u; is the registration ID of the mine monitoring server u; is the encrypted real-time monitoring data of the mine monitoring server u; is the entity ID of the mine monitoring server u; the signature data is are signature parameters of the mine monitoring server u;

[0145] S3-3: upload the encrypted real-time monitoring data Mu and the signature data to the cloud data center;

[0146] S4: based on the cloud data center, perform signature authentication on the signature data, and after the signature authentication passes, decrypt the encrypted real-time monitoring data based on the public key in the public-private key pair to obtain decrypted real-time monitoring data, and use an anomaly detection model to perform anomaly detection on the decrypted real-time monitoring data to obtain real-time anomaly detection results, including the following steps:

[0147] S4-1: based on the cloud data center, call a feasible mechanism to perform signature authentication on the signature data based on the registration information of the mine monitoring server, and if the signature authentication passes, proceed to the next step, otherwise, block the corresponding encrypted real-time monitoring data, issue an intrusion alarm signal, and end the anomaly detection method;

[0148] The formula for signature authentication is:

[0149]

[0150] In the formula, is the signature authentication parameter of the mine monitoring server u; is the public key of the mine monitoring server u; if the left side equals the right side, the signature authentication passes;

[0151] S4-2: after the signature authentication passes, receive the encrypted real-time monitoring data uploaded by the mine monitoring server, and decrypt the encrypted real-time monitoring data based on the public key in the public-private key pair to obtain decrypted real-time monitoring data, and the formula is:

[0152]

[0153] In the formula, is the decrypted real-time monitoring data of the mine monitoring server u; is an asymmetric decryption function; is the public key of the mine monitoring server u; is the encrypted real-time monitoring data of the mine monitoring server u;

[0154] S4-3: perform data dimensionality reduction on the decrypted real-time monitoring data based on the monitoring key indicator set to obtain corresponding reduced real-time monitoring data;

[0155] S4-4: using the anomaly detection model, performing anomaly detection on the dimension-reduced real-time monitoring data to obtain real-time anomaly detection results;

[0156] S4-5: if the real-time anomaly detection result is that there is data anomaly, an abnormal data alarm signal is sent, and the anomaly detection method is ended, otherwise, the next encrypted real-time monitoring data and signature data are received.

[0157] Embodiment 2:

[0158] As shown in Figure 2 The embodiment provides an anomaly detection system based on mine real-time monitoring data, which is used to implement an anomaly detection method. The system includes a cloud data center, a feasible mechanism, and a plurality of mine monitoring servers. The cloud data center and the feasible mechanism are in communication connection with the plurality of mine monitoring servers, and the cloud data center is in communication connection with the feasible mechanism.

[0159] The mine monitoring server is used to collect real-time monitoring data of a mine monitoring site; encrypt and sign the collected real-time monitoring data according to a private key in a public-private key pair and registration information, to obtain encrypted real-time monitoring data and signature data, and upload the encrypted real-time monitoring data and the signature data to the cloud data center;

[0160] The feasible mechanism is used to generate keys and perform real-name authentication for all mine monitoring servers connected to the cloud data center, to obtain a public-private key pair and registration information of each mine monitoring server, return the private key in the public-private key pair to the corresponding mine monitoring server, and publish the public key in the public-private key pair to the cloud data center; and perform signature authentication on the signature data received by the cloud data center;

[0161] The cloud data center is used to perform data dimension reduction on a plurality of historical monitoring data to obtain a plurality of dimension-reduced historical monitoring data and a monitoring key indicator set, and use a deep learning algorithm to build an anomaly detection model according to the plurality of dimension-reduced historical monitoring data; after the signature authentication passes, decrypt the encrypted real-time monitoring data according to the public key in the public-private key pair to obtain decrypted real-time monitoring data, and use the anomaly detection model to perform anomaly detection on the decrypted real-time monitoring data to obtain real-time anomaly detection results.

[0162] As a preferred, the cloud data center includes a data dimension reduction unit, a model building unit, a data decryption unit, and an anomaly detection unit connected in sequence, and the data decryption unit is in communication connection with the feasible mechanism and the plurality of mine monitoring servers;

[0163] The data dimension reduction unit is used to perform data dimension reduction on a plurality of historical monitoring data to obtain a plurality of dimension-reduced historical monitoring data and a monitoring key indicator set;

[0164] The model construction unit is configured to construct an anomaly detection model according to historical monitoring data after dimension reduction, using a deep learning algorithm.

[0165] The data decryption unit is configured to receive encrypted real-time monitoring data and signature data uploaded by the mine monitoring server, call a feasible mechanism to perform signature authentication on the signature data, and, after the signature authentication passes, decrypt the encrypted real-time monitoring data according to a public key in the public-private key pair to obtain decrypted real-time monitoring data.

[0166] The anomaly detection unit is configured to use the anomaly detection model to perform anomaly detection on the decrypted real-time monitoring data to obtain real-time anomaly detection results.

[0167] The application discloses an anomaly detection method and system based on mine real-time monitoring data, realizes automatic and intelligent real-time anomaly detection on mine site monitoring data, reduces labor cost investment and workload, uniformly manages, stores and performs anomaly detection on massive monitoring data through a cloud data center, reduces the hardware configuration requirement of a local server, and the anomaly detection model constructed based on a deep learning algorithm can mine deep connections between monitoring data and abnormal conditions, improve anomaly detection efficiency and accuracy, and avoid the problem of low storage reliability of local server storage.

[0168] The application is not limited to the optional embodiments described above, and anyone can derive other various forms of products under the inspiration of the application. The above specific embodiments should not be understood as limiting the protection scope of the application, and the protection scope of the application should be defined by the claims, and the specification can be used to interpret the claims.

Claims

1. A method for anomaly detection based on real-time monitoring data of a mine, characterized in that: The method comprises the following steps: Based on the feasible mechanism, the key generation and real-name authentication are performed on all mine monitoring servers connected to the cloud data center to obtain the public and private key pairs and registration information of each mine monitoring server, the private key in the public and private key pair is returned to the corresponding mine monitoring server, and the public key in the public and private key pair is published to the cloud data center; Based on the cloud data center, the historical monitoring data are reduced in dimension to obtain a plurality of reduced historical monitoring data, and an abnormality detection model is constructed using a deep learning algorithm according to the plurality of reduced historical monitoring data; Based on the mine monitoring server, the real-time monitoring data collected are encrypted and signed according to the private key in the public and private key pair and the registration information to obtain encrypted real-time monitoring data and signature data, and the encrypted real-time monitoring data and signature data are uploaded to the cloud data center; Based on the cloud data center, the signature data are subjected to signature authentication, and after the signature authentication passes, the encrypted real-time monitoring data are decrypted according to the public key in the public and private key pair to obtain decrypted real-time monitoring data, and the decrypted real-time monitoring data are subjected to abnormality detection using the abnormality detection model to obtain real-time abnormality detection results; Based on the cloud data center, the historical monitoring data are reduced in dimension to obtain a plurality of reduced historical monitoring data, and an abnormality detection model is constructed using a deep learning algorithm according to the plurality of reduced historical monitoring data, comprising the following steps: Based on the cloud data center, a plurality of historical monitoring data are collected, and each historical monitoring data is preprocessed to obtain a plurality of preprocessed historical monitoring data corresponding thereto; The PCA method is used to reduce the dimension of the plurality of preprocessed historical monitoring data to obtain a plurality of reduced historical monitoring data and a monitoring key indicator set corresponding thereto; The plurality of reduced historical monitoring data are subjected to label addition to obtain a plurality of abnormality detection samples provided with preset abnormality detection labels; An abnormality detection model is constructed using an IPCO-BiLSTM algorithm according to the plurality of abnormality detection samples; An abnormality detection model is constructed using an IPCO-BiLSTM algorithm according to the plurality of abnormality detection samples, specifically comprising the following steps: The plurality of abnormality detection samples are divided into a model training sample set and a model test sample set according to a ratio of 7:3; The optimal initial network parameters of the BiLSTM network are obtained using an IPCO optimization algorithm; An initial abnormality detection model is constructed using a BiLSTM algorithm according to the optimal initial network parameters; The initial abnormality detection model is subjected to optimization training using the model training sample set to obtain an optimized abnormality detection model; The model test sample set is input into the optimized abnormality detection model for abnormality detection to obtain a plurality of historical predicted abnormality detection labels corresponding thereto; The plurality of historical predicted abnormality detection labels are compared with a plurality of preset abnormality detection labels corresponding thereto to obtain the prediction accuracy of the optimized abnormality detection model; If the prediction accuracy is greater than an accuracy threshold, the optimal abnormality detection model is output, otherwise, the optimization training is continuously performed. A feasible mechanism is used to generate keys and conduct real-name authentication for all mine monitoring servers connected to the cloud data center, obtain the public-private key pair and registration information of each mine monitoring server, return the private key in the public-private key pair to the corresponding mine monitoring server, and publish the public key in the public-private key pair to the cloud data center; and conduct signature authentication on the signature data received by the cloud data center.

2. The method of claim 1, wherein the method is based on real-time monitoring data of a mine. Based on the feasible mechanism, keys are generated and real-name authentication is conducted for all mine monitoring servers connected to the cloud data center, the public-private key pair and registration information of each mine monitoring server are obtained, the private key in the public-private key pair is returned to the corresponding mine monitoring server, and the public key in the public-private key pair is published to the cloud data center, including the following steps: Collect the server IP, attribute information and entity ID of all mine monitoring servers connected to the cloud data center, and send the server IP, attribute information and corresponding entity ID to the feasible mechanism; Based on the feasible mechanism, use an asymmetric encryption algorithm to generate keys according to the attribute information of the mine monitoring server, and obtain the corresponding public-private key pair; Conduct real-name authentication according to the private key in the public-private key pair and the corresponding entity ID, and obtain the registration information of the corresponding mine monitoring server; According to the server IP, return the private key and registration information in the public-private key pair to the corresponding mine monitoring server, and publish the public key in the public-private key pair to the cloud data center.

3. The method of claim 1, wherein the method comprises: Using the PCA method, the pre-processed historical monitoring data is reduced in dimension, and the corresponding historical monitoring data after dimension reduction and the monitoring key indicator set are obtained, including the following steps: Convert each pre-processed historical monitoring data into a matrix to obtain the corresponding pre-processed historical monitoring data matrix; Standardize the pre-processed historical monitoring data matrix to obtain the corresponding standardized historical monitoring data matrix; Obtain the covariance matrix of the standardized historical monitoring data matrix, and obtain the corresponding candidate principal component matrix according to the standardized historical monitoring data matrix and the covariance matrix; the candidate principal component matrix includes a plurality of candidate column vectors; Take the plurality of candidate column vectors with a variance cumulative contribution rate of the top 90% in the candidate principal component matrix as a plurality of principal component column vectors to obtain a historical monitoring data matrix after dimension reduction composed of a plurality of principal component column vectors; Convert the historical monitoring data matrix after dimension reduction into a plurality of historical monitoring data after dimension reduction, and integrate the monitoring indicators corresponding to the principal component column vectors as monitoring key indicators to obtain the corresponding monitoring key indicator set.

4. The method of claim 1, wherein the method is based on real-time monitoring data of a mine. Using the IPCO optimization algorithm, the optimal initial network parameters of the BiLSTM network are obtained, including the following steps: Encode the candidate initial network parameters of the BiLSTM network into the positions of the IPCO individuals of the IPCO optimization algorithm; Set the IPCO population parameters, maximum iteration number and fitness function of the IPCO optimization algorithm; Initialize using the Circle chaotic mapping sequence according to the number of individuals in the IPCO population parameters to obtain an initial IPCO population; Introducing a cyclic population reduction mechanism, limiting the number of individuals in the IPCO population parameters, obtaining updated IPCO population parameters for the next iteration; According to the fitness function, the initial fitness value of the initial IPCO individual in the initial IPCO population is calculated; According to the initial fitness value and the updated IPCO population parameters, the initial IPCO population is updated using the first defense strategy, the second defense strategy, the third defense strategy and the fourth defense strategy, to obtain the updated IPCO population; Using a dynamic back learning algorithm, the updated IPCO population is dynamically back learned to generate a dynamically back IPCO population; According to the fitness function, the fitness values of all IPCO individuals in the updated IPCO population and the dynamically back IPCO population are calculated, and the IPCO individual with the minimum fitness value is taken as the optimal individual; If the number of iterations reaches the maximum number of iterations or the fitness value of the optimal individual meets the requirements, the optimal solution corresponding to the current optimal individual is output to obtain the optimal initial network parameters of the BiLSTM network.

5. The method of claim 1, wherein the method is based on real-time monitoring data of a mine. Based on the mine monitoring server, the private key in the public-private key pair and the registration information are used to encrypt and sign the collected real-time monitoring data to obtain encrypted real-time monitoring data and signature data, and the encrypted real-time monitoring data and signature data are uploaded to the cloud data center, including the following steps: Based on the mine monitoring server, the private key in the public-private key pair and the registration information are used to encrypt and sign the collected real-time monitoring data to obtain encrypted real-time monitoring data and signature data, and the encrypted real-time monitoring data and signature data are uploaded to the cloud data center, including the following steps: Based on the mine monitoring server, the private key in the public-private key pair and the registration information are used to encrypt and sign the collected real-time monitoring data to obtain encrypted real-time monitoring data and signature data, and the encrypted real-time monitoring data and signature data are uploaded to the cloud data center, including the following steps: Based on the cloud data center, the signature data is authenticated, and after the authentication is passed, the encrypted real-time monitoring data is decrypted according to the public key in the public-private key pair to obtain decrypted real-time monitoring data, and the decrypted real-time monitoring data is detected using an anomaly detection model to obtain real-time anomaly detection results, including the following steps:

6. The method of claim 1, wherein the method is based on real-time monitoring data of a mine. Based on the cloud data center, the signature data is authenticated, and after the authentication is passed, the encrypted real-time monitoring data is decrypted according to the public key in the public-private key pair to obtain decrypted real-time monitoring data, and the decrypted real-time monitoring data is detected using an anomaly detection model to obtain real-time anomaly detection results, including the following steps: After the signature authentication is passed, the encrypted real-time monitoring data uploaded by the mine monitoring server is received, and the encrypted real-time monitoring data is decrypted according to the public key in the public-private key pair to obtain decrypted real-time monitoring data; According to the monitoring key indicator set, the decrypted real-time monitoring data is dimensionally reduced to obtain corresponding reduced real-time monitoring data; The reduced real-time monitoring data is detected using an anomaly detection model to obtain real-time anomaly detection results; ​ If the real-time anomaly detection result is that there is data anomaly, an abnormal data alarm signal is sent, and the anomaly detection method is ended, otherwise, the next encrypted real-time monitoring data and signature data are received.

7. A system for anomaly detection based on real-time monitoring data of a mine, for implementing the anomaly detection method according to any one of claims 1-6, characterized in that: The system comprises a cloud data center, a feasibility mechanism and a plurality of mine monitoring servers, the cloud data center and the feasibility mechanism are respectively connected with the plurality of mine monitoring servers in communication, and the cloud data center is connected with the feasibility mechanism in communication.

8. The anomaly detection system based on real-time monitoring data of a mine according to claim 7, characterized in that: The cloud data center comprises a data dimension reduction unit, a model construction unit, a data decryption unit and an anomaly detection unit connected in sequence, and the data decryption unit is connected with the feasibility mechanism and the plurality of mine monitoring servers in communication.

Images