Safety monitoring system, method, device, equipment and medium

Abstract

The embodiment of the invention provides a safety monitoring system, method, device and equipment, a medium and simulation equipment, which are used for building a simulation test platform for a computer monitoring system. Acquiring simulation operation data executed by the user on the simulation test platform, and sending the simulation operation data to the second safety monitoring equipment; the first safety monitoring equipment is used for collecting historical data and real-time monitoring pictures of the computer monitoring system and sending the historical data and the real-time monitoring pictures to the second safety monitoring equipment; the second safety monitoring equipment is used for training the pre-training model according to the simulation operation data and the historical data to obtain a target prediction model; and inputting the real-time monitoring picture into the target prediction model, and enabling the target prediction model to output a safety prediction result for the computer monitoring system. Therefore, safety monitoring can be carried out on the computer monitoring system, analysis based on experience does not need to be carried out by professional analysts, and the health states of the system and equipment can be reflected and early warned in real time.

Description

Technical Field

[0001] The present invention relates to the technical field of system security monitoring, and in particular to a security monitoring system, a security monitoring method, a security monitoring device, an electronic device and a computer-readable storage medium. Background Art

[0002] In the fields of hydropower, new energy, etc., safety monitoring is generally carried out through computer monitoring systems. However, the safety monitoring methods of computer monitoring systems in the existing technology require a lot of time to analyze each data of the equipment, and need to rely on professional analysts to analyze based on experience, and cannot reflect and warn the health status of the equipment in real time. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a security monitoring system, a security monitoring method, a security monitoring device, an electronic device and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0004] In order to solve the above problems, an embodiment of the present invention discloses a security monitoring system, which includes: a simulation device, a first security monitoring device, and a second security monitoring device; a computer monitoring system is deployed in the first security monitoring device; the second security monitoring device is connected to the simulation device and the first security monitoring device respectively; The simulation device is used to build a simulation test platform for the computer monitoring system; obtain simulation operation data for the computer monitoring system performed by the user on the simulation test platform, and send the simulation operation data to the second safety component monitoring device; The first security monitoring device is used to collect historical data of the computer monitoring system; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; the historical data is sent to the second security monitoring device; the real-time monitoring screen of the computer monitoring system is collected, and the real-time monitoring screen is sent to the second security monitoring device; The second security monitoring device is used to receive the simulated operation data and the historical data; train the pre-trained model according to the simulated operation data and the historical data to obtain a target prediction model; obtain the real-time monitoring screen, input the real-time monitoring screen into the target prediction model, and make the target prediction model output a security prediction result for the computer monitoring system.

[0005] Optionally, the second safety monitoring device is used to train the pre-trained model based on the simulated operation data, the historical interactive interface and the historical equipment operation data; and re-train the pre-trained model based on the historical operation video, the historical fault alarm screen and the historical equipment operation data to obtain a target prediction model.

[0006] Optionally, the simulation device is also used to check whether the configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the on-site hardware components of the computer monitoring system; if the configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the on-site hardware components of the computer monitoring system, then check whether the version information of the simulation test platform is the same as the version information of the computer monitoring system; if the version information of the simulation test platform is the same as the version information of the computer monitoring system, then perform a functional test on the simulation test platform according to the design documents and user manual of the computer monitoring system, and check whether the functional test passes; if the functional test passes, it is determined that the simulation test platform is completed.

[0007] Optionally, the system further includes a transfer device; the transfer device is connected to the first security monitoring device and the second security monitoring device respectively; an intelligent ferry system is deployed in the transfer device; The first security monitoring device is used to collect real-time monitoring images of the computer monitoring system and send the real-time monitoring images to the transfer device; The transfer device is used to obtain the real-time monitoring picture of the computer monitoring system and send the real-time monitoring picture to the second security monitoring device through the intelligent ferry system; The second security monitoring device is used to receive the real-time monitoring image sent by the transfer device.

[0008] Optionally, the second safety monitoring device is also used to transform the safety prediction result to obtain a safety monitoring report; the safety monitoring report includes: an operating parameter trend curve of the monitored equipment, a fault warning, and an operation report.

[0009] Optionally, the second security monitoring device is also used to evaluate the security prediction result to obtain an evaluation result; and optimize the parameters of the target prediction model based on the evaluation result.

[0010] Optionally, the second security monitoring device is provided with a first network card and a second network card; The first network card is used for the second security monitoring device to communicate with the first security monitoring device; The second network card is used for the second security monitoring device to communicate with other devices; the other communication devices are used to receive and display the security monitoring report.

[0011] The embodiment of the present invention discloses a security monitoring method, which is applied to a second security monitoring device; the second security monitoring device is connected to a simulation device and a first security monitoring device respectively; a computer monitoring system is deployed in the first security monitoring device; the method comprises: Acquiring simulated operation data for the computer monitoring system executed by a user on a simulation test platform; the simulation test platform is built for the computer monitoring system through the simulation device; Acquire historical data of the computer monitoring system collected by the first security monitoring device; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; Training the pre-trained model according to the simulated operation data and the historical data to obtain a target prediction model; Acquire the real-time monitoring picture of the computer monitoring system collected by the first security monitoring device, input the real-time monitoring picture into the target prediction model, and make the target prediction model output the security prediction result for the computer monitoring system.

[0012] Optionally, the training of a pre-trained model according to the simulated operation data and the historical data to obtain a target prediction model includes: Training the pre-trained model according to the simulated operation data, the historical interaction interface and the historical device operation data; According to the historical operation video, the historical fault alarm screen and the historical equipment operation data, the pre-trained model is re-trained to obtain a target prediction model.

[0013] Optionally, the configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the on-site hardware components of the computer monitoring system; the version information of the simulation test platform is the same as the version information of the computer monitoring system; and the simulation test platform complies with the design documents and user manual of the computer monitoring system.

[0014] Optionally, the acquiring the real-time monitoring screen of the computer monitoring system collected by the first security monitoring device includes: Acquire the real-time monitoring picture of the computer monitoring system sent by the first security monitoring device through the intelligent ferry system; the real-time monitoring picture of the computer monitoring system is collected by the first security monitoring device.

[0015] Optionally, the method further comprises: The safety prediction results are transformed to obtain a safety monitoring report; the safety monitoring report includes: an operating parameter trend curve of the monitored equipment, a fault warning, and an operation report.

[0016] Optionally, the method further comprises: Evaluating the safety prediction result to obtain an evaluation result; According to the evaluation results, the parameters of the target prediction model are optimized.

[0017] The embodiment of the present invention discloses a security monitoring device, which is applied to a second security monitoring device; the second security monitoring device is connected to a simulation device and a first security monitoring device respectively; a computer monitoring system is deployed in the first security monitoring device; the device comprises: A first acquisition module is used to acquire simulation operation data executed by a user on a simulation test platform for the computer monitoring system; the simulation test platform is built for the computer monitoring system through the simulation device; A second acquisition module is used to acquire the historical data of the computer monitoring system collected by the first security monitoring device; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; A training module, used to train the pre-training model according to the simulated operation data and the historical data to obtain a target prediction model; An output module is used to obtain the real-time monitoring screen of the computer monitoring system collected by the first security monitoring device, input the real-time monitoring screen into the target prediction model, and enable the target prediction model to output the security prediction result for the computer monitoring system.

[0018] Optionally, the training module includes: A first training submodule, used for training the pre-trained model according to the simulation operation data, the historical interaction interface and the historical device operation data; The second training submodule is used to retrain the pre-trained model according to the historical operation video, the historical fault alarm screen and the historical equipment operation data to obtain a target prediction model.

[0019] Optionally, the configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the on-site hardware components of the computer monitoring system; the version information of the simulation test platform is the same as the version information of the computer monitoring system; and the simulation test platform complies with the design documents and user manual of the computer monitoring system.

[0020] Optionally, the output module includes: The acquisition submodule is used to acquire the real-time monitoring picture of the computer monitoring system sent by the first security monitoring device through the intelligent ferry system; the real-time monitoring picture of the computer monitoring system is collected by the first security monitoring device.

[0021] Optionally, the device further comprises: The conversion module is used to convert the safety prediction results to obtain a safety monitoring report; the safety monitoring report includes: an operating parameter trend curve of the monitored equipment, a fault warning, and an operation report.

[0022] Optionally, the device further comprises: An evaluation module, used to evaluate the security prediction result to obtain an evaluation result; An optimization module is used to optimize the parameters of the target prediction model according to the evaluation results.

[0023] The present invention also discloses an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned security monitoring method when executing the computer program.

[0024] The present invention also discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the security monitoring method described above are implemented.

[0025] The embodiments of the present invention include the following advantages: In the embodiment of the present invention, the simulation device is used to build a simulation test platform for the computer monitoring system; obtain the simulation operation data for the computer monitoring system executed by the user on the simulation test platform, and send the simulation operation data to the second security monitoring device; the first security monitoring device is used to collect the historical data of the computer monitoring system; wherein the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; send the historical data to the second security monitoring device; collect the real-time monitoring screen of the computer monitoring system, and send the real-time monitoring screen to the second security monitoring device; the second security monitoring device is used to receive the simulation operation data and the historical data; according to the simulation operation data and the historical data, the pre-training model is trained to obtain the target prediction model; obtain the real-time monitoring screen, and input the real-time monitoring screen into the target prediction model, so that the target prediction model outputs the security prediction result for the computer monitoring system. Thus, the computer monitoring system can be safely monitored according to the real-time monitoring screen of the computer monitoring system through the target test model, without relying on professional analysts to analyze based on experience, and the health status of the system and equipment can be reflected and warned in real time. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 is a structural block diagram of a security monitoring system provided by an embodiment of the present invention; Figure 2 is a structural block diagram of a target prediction model provided by an embodiment of the present invention; Figure 3 is a structural block diagram of a second security monitoring device provided by an embodiment of the present invention; Figure 4 is a flow chart of steps of a security monitoring method provided by an embodiment of the present invention; Figure 5 It is a structural block diagram of a security monitoring device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0028] In the related art, when the computer monitoring system is security monitored, it takes a lot of time to analyze each data of the device, and it is necessary to rely on professional analysts to analyze based on experience, which cannot reflect and warn the health status of the device in real time. In order to solve the above technical problems, the present invention provides a security monitoring system, a simulation device, which is used to build a simulation test platform for the computer monitoring system; obtain the simulated operation data of the computer monitoring system performed by the user on the simulation test platform, and send the simulated operation data to the second security monitoring device; the first security monitoring device is used to collect historical data of the computer monitoring system; wherein the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; send the historical data to the second security monitoring device; collect the real-time monitoring screen of the computer monitoring system, and send the real-time monitoring screen to the second security monitoring device; the second security monitoring device is used to receive the simulated operation data and the historical data; according to the simulated operation data and the historical data, the pre-trained model is trained to obtain the target prediction model; obtain the real-time monitoring screen, input the real-time monitoring screen into the target prediction model, so that the target prediction model outputs the security prediction result for the computer monitoring system. Therefore, the computer monitoring system can be monitored for security through the target test model according to the real-time monitoring screen of the computer monitoring system. There is no need to rely on professional analysts to conduct analysis based on experience. The health status of the system and equipment can also be reflected and warned in real time.

[0029] Reference Figure 1 , shows a structural block diagram of a security monitoring system provided by an embodiment of the present invention, the system comprising: a simulation device 01, a first security monitoring device 02 and a second security monitoring device 03; the computer monitoring system 021 is deployed in the first security monitoring device 02; the second security monitoring device 03 is connected to the simulation device 01 and the first security monitoring device 02 respectively.

[0030] In the embodiment of the present invention, a computer monitoring system 021 may be deployed in the first security monitoring device 02. The monitoring system may be used in the field of clean energy such as hydropower and new energy. The computer monitoring system 021 is used to monitor the equipment to be monitored in real time. For example, the computer monitoring system 021 is used to monitor the generator equipment in real time. The specific monitored equipment may be set according to actual needs, and the present invention does not make specific limitations here.

[0031] In an embodiment of the present invention, the simulation device 01 is used to build a simulation test platform 011 for the computer monitoring system 021; obtain the simulation operation data performed by the user on the simulation test platform 011 for the computer monitoring system 021, and send the simulation operation data to the second security component monitoring device.

[0032] Specifically, before security monitoring is performed on the computer monitoring system 021, a simulation test platform 011 can be built on the simulation device 01 for the computer monitoring system 021. The simulation test platform 011 is consistent with the computer monitoring system 021, and can also be understood as building a simulated computer monitoring system 021 on the simulation device 01. After the simulation test platform 011 is built, the user can perform simulation operations on the computer monitoring system 021 on the simulation test platform 011 and obtain simulation operation data. The simulation operation in the present invention is the same as the common operation on the computer monitoring system 021, and the simulation operation data can be a simulation operation video recorded on the simulation test platform 011 during the simulation operation. After obtaining the simulation operation data, the simulation device 01 can send the simulation operation data to the second security monitoring device 03.

[0033] In an embodiment of the present invention, the simulation device 01 is also used to check whether the configuration parameters of the simulation hardware components in the simulation test platform 011 are the same as the configuration parameters of the on-site hardware components of the computer monitoring system 021; if the configuration parameters of the simulation hardware components in the simulation test platform 011 are the same as the configuration parameters of the on-site hardware components of the computer monitoring system 021, then check whether the version information of the simulation test platform 011 is the same as the version information of the computer monitoring system 021; if the version information of the simulation test platform 011 is the same as the version information of the computer monitoring system 021, then perform a functional test on the simulation test platform 011 according to the design documents and user manual of the computer monitoring system 021, and check whether the functional test passes; if the functional test passes, it is determined that the simulation test platform 011 is completed.

[0034] Specifically, after the simulation test platform 011 is built, it is necessary to first determine whether the built simulation test platform 011 is consistent with the computer monitoring system 021. When it is determined that the built simulation test platform 011 is consistent with the computer monitoring system 021, it can be determined that the construction of the simulation test platform 011 is complete. In determining whether the construction of the simulation test platform 011 is complete, that is, determining whether the built simulation test platform 011 is consistent with the computer monitoring system 021, the following method can be used: first check the configuration parameters of the simulation hardware components in the simulation test platform 011 to see if they are the same as the configuration parameters of the on-site hardware components of the computer monitoring system 021. If they are different, it means that the simulation test platform 011 is inconsistent with the computer monitoring system 021, and the configuration parameters of the simulation hardware components of the simulation test platform 011 need to be adjusted. If they are the same, continue to check whether the version information of the simulation test platform 011 is consistent with the version information of the computer monitoring system 021. The same; if different, it means that the simulation test platform 011 is inconsistent with the computer monitoring system 021, and the version information of the simulation test platform 011 needs to be adjusted. If they are the same, then according to the design documents and user manual of the computer monitoring system 021, the simulation test platform 011 is functionally tested, and check whether the functional test passes. If it fails, it means that the simulation test platform 011 is inconsistent with the computer monitoring system 021, and the function of the simulation test platform 011 needs to be adjusted. If it passes, it can be determined that the simulation test platform 011 is consistent with the computer monitoring system 021, and it can be determined that the simulation test platform 011 has been built.

[0035] In an embodiment of the present invention, the first security monitoring device 02 is used to collect historical data of the computer monitoring system 021; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system 021; the historical data is sent to the second security monitoring device 03; the real-time monitoring screen of the computer monitoring system 021 is collected, and the real-time monitoring screen is sent to the second security monitoring device 03.

[0036] Specifically, the first security monitoring device 02 in the present invention may be deployed with a computer monitoring system 021, and historical data of the computer monitoring system 021 may be collected, wherein the historical data may include: historical interaction interface, historical operation video, historical fault alarm screen, historical equipment operation data. The historical interaction interface may be a UI design diagram of the computer monitoring system 021, and the historical equipment operation data may be the operation data of the equipment monitored by the computer monitoring system 021, and the operation data of the monitored equipment may be an operation point table and operation record of the equipment, etc.

[0037] In an embodiment of the present invention, the second security monitoring device 03 is used to receive simulated operation data and historical data; train the pre-trained model 031 according to the simulated operation data and historical data to obtain the target prediction model 032; obtain the real-time monitoring screen, and input the real-time monitoring screen into the target prediction model 032, so that the target prediction model 032 outputs a security prediction result for the computer monitoring system 021.

[0038] Specifically, after receiving the simulated operation data and historical data, the second security monitoring device 03 in the present invention can train the pre-trained model according to the simulated operation data and historical data to obtain the target prediction model 032, and deploy the target prediction model 032 on the second security monitoring device 03, input the acquired real-time monitoring screen of the computer monitoring system 021 into the target prediction model 032, and output the security prediction results for the computer security monitoring system.

[0039] It should be noted that before training the pre-trained model 031, the present application can first select an open source AI big model as the basic model and select the parameters of the AI ​​big model, for example: select the reference parameters, Token, context length and temperature index of the AI ​​big model, where the parameters characterize the complexity and performance of the model. The parameter scale of the model selected by the present invention is in the tens of billions. Token is the basic unit of model understanding and processing. The present invention selects text-type Token. The context length characterizes the information capture ability of the model and is directly related to the number of Tokens. The present invention can reasonably select the context window length according to actual needs and model effects. The temperature index affects the tendency of the model between creativity and conservative certainty. The present invention can select 0.2-0.3 as the basic value of the model temperature index. After selecting the parameters of the AI ​​big model, the selected AI big model can be used as the pre-trained model 031, and the pre-trained model can be trained according to the simulated operation data and historical data to obtain the target prediction model 032.

[0040] In one embodiment, the second safety monitoring device 03 is used to train the pre-trained model 031 based on the simulated operation data, the historical interactive interface and the historical equipment operation data; and the trained pre-trained model 031 is re-trained according to the historical operation video, the historical fault alarm screen and the historical equipment operation data to obtain the target prediction model 032.

[0041] Specifically, the pre-trained model 031 is trained for the first time using the historical interactive interface, the operating point table in the historical equipment operating data, and the simulated operation data as the first training data, so that the pre-trained model 031 can learn the elements, signal quantity association relationship, and screen context in the interactive interface of the computer monitoring system 021. Then, the pre-trained model 031 is trained for the second time using the historical operating video, the historical fault alarm screen, and the operating records in the historical operating data as the second training data, and the target prediction model 032 is obtained. In the present invention, during the second training, manual labeling can be performed during the training process to improve the model accuracy and generalization ability.

[0042] In one embodiment, the security monitoring system of the computer monitoring system 021 may also include a transfer device, which is connected to the first security monitoring device 02 and the second security monitoring device 03 respectively; an intelligent ferry system is deployed in the transfer device; the first security monitoring device 02 is used to collect the real-time monitoring screen of the computer monitoring system 021, and send the real-time monitoring screen to the transfer device; the transfer device is used to obtain the real-time monitoring screen of the computer monitoring system 021, and send the real-time monitoring screen to the second security monitoring device 03 through the intelligent ferry system; the second security monitoring device 03 is used to receive the real-time monitoring screen sent by the transfer device.

[0043] Specifically, the transfer device of the present invention may be equipped with an intelligent ferry system, and after the first security monitoring device 02 collects the real-time monitoring screen of the computer monitoring system 021, it may send the real-time monitoring screen to the second security monitoring device 03 based on the intelligent ferry system of the transfer device, thereby performing data protection on the real-time monitoring screen.

[0044] In the embodiment of the present invention, the second security monitoring device 03 is also used to transform the security prediction results to obtain a security monitoring report; the security monitoring report includes: the operating parameter trend curve of the monitored equipment, fault warning, and operation report. The present invention can transform the security prediction results and distribute the transformed security monitoring report to the operation and maintenance personnel or the operation platform to support the needs of security monitoring and other services.

[0045] It should be noted that the target prediction model 032 in the present application includes an image text recognition module, a reasoning module, a context association mining module and a result conversion determination module. Figure 2 As shown, a structural block diagram of a target prediction model 032 provided in an embodiment of the present invention is shown.

[0046] In the present invention, the image text recognition module is used to identify and extract text information such as memory operation data, equipment status quantity, etc. in the real-time monitoring screen, such as generator speed, real-time power generation, reports, etc. The image text recognition module focuses on the conversion of multimodal information such as video, image, text, etc. into text information. The reasoning module is used to mine and analyze the association information between the text information output by the image text recognition module, such as the background status and the front-end interface equipment operation data association information, and infer the equipment status based on the association information. The equipment status may include: normal, fault, failure, etc. The reasoning module focuses on the association relationship between information in different pages in the near time area of ​​the computer monitoring system 021. The context association mining module is used to mine the association relationship between information in the same type of page in the time series, such as the change trend of the power curve of the turbine unit within 1-10h, and analyze the operation status of the computer monitoring system 021 on a larger time and space scale in combination with the reasoning module. The operation status of the computer monitoring system 021 may include: the operation status of the system and the operation status of the operation equipment. The context association mining module can be used to improve the scope of application of the reasoning module. The result conversion and determination module is used to clean and organize the output results of each module, and generate various information forms such as reports, operation reports, system warnings, etc. according to on-site needs. It is also used to display the operating status of the computer monitoring system 021, and can provide on-site operation and maintenance personnel with the operating status of the equipment and system under the computer monitoring system 021.

[0047] In the embodiment of the present invention, the second security monitoring device 03 is also used to evaluate the security prediction result to obtain the evaluation result; according to the evaluation result, the parameters of the target prediction model 032 are optimized.

[0048] Specifically, after the safety prediction results are output, users, i.e., operation and maintenance personnel, can evaluate the safety prediction results and optimize the model parameters based on the evaluation results to ensure the model's stability, prediction accuracy and other performance indicators. When evaluating, the operation and maintenance personnel can use network search, random search, Bayesian optimization and other methods to adjust the model parameters and improve the model performance based on their operation and maintenance experience. In combination with the actual on-site operation results, regularization technology can be used to constrain the model output results to prevent the model from overfitting. In combination with specific business scenarios, such as power prediction, self-distillation technology can be used to improve the model reasoning speed.

[0049] In an embodiment of the present invention, the second security monitoring device 03 may be provided with a first network card and a second network card; the first network card is used for the second security monitoring device 03 to communicate with the first security monitoring device 02; the second network card is used for the second security monitoring device 03 to communicate with other devices; and the other devices are used to receive and display security monitoring reports.

[0050] Specifically, the second security monitoring device 03 in the present invention can be provided with a first network card and a second network card, and the first security monitoring device 02 can communicate with the second security monitoring device through the first network card to transmit data. The second security monitoring device 03 communicates with other devices through the second network card to transmit data, so that the two network environments can be isolated, thereby ensuring the security of the network environment.

[0051] For example: the second security monitoring device 03 may include a central processing unit, a graphics processing unit, storage, memory, a storage system and a dual isolated network card, wherein the network card 1 (first network card) can be connected to a transfer device, the transfer device is connected to the first security monitoring device 02, and the network card 2 (second network card) is connected to an independent local area network to connect to other external devices, and other devices are physically isolated to ensure that the second security monitoring device 03 does not affect the information security of the original network environment. Network card 2 is also connected to a storage server for storing relevant data, etc. Among them, other devices can be devices used to display prediction results or case monitoring reports, such as: devices of other departments or other branches. Figure 3 As shown, a structural block diagram of a second security monitoring device 03 provided in an embodiment of the present invention is shown.

[0052] In an embodiment of the present invention, a simulation device is used to build a simulation test platform for a computer monitoring system; obtain the simulation operation data for the computer monitoring system executed by the user on the simulation test platform, and send the simulation operation data to the security monitoring device; the first security monitoring device is used to collect historical data of the computer monitoring system; wherein the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; send the historical data to the second security monitoring device; collect the real-time monitoring screen of the computer monitoring system, and send the real-time monitoring screen to the second security monitoring device; the second security monitoring device is used to receive the simulation operation data and the historical data; according to the simulation operation data and the historical data, the pre-training model is trained to obtain the target prediction model; obtain the real-time monitoring screen, and input the real-time monitoring screen into the target prediction model, so that the target prediction model outputs the security prediction result for the computer monitoring system. Thus, the computer monitoring system can be safely monitored according to the real-time monitoring screen of the computer monitoring system through the target test model, without relying on professional analysts to analyze based on experience, and the health status of the system and equipment can be reflected and warned in real time.

[0053] like Figure 4As shown, a flowchart of a security monitoring method provided by an embodiment of the present invention is shown, and the method is applied to a second security monitoring device; the second security monitoring device is connected to a simulation device and a first security monitoring device respectively; a computer monitoring system is deployed in the first security monitoring device; the specific steps of the method are as follows: Step 401, obtaining simulation operation data executed by a user on a simulation test platform for the computer monitoring system; the simulation test platform is built for the computer monitoring system through the simulation device.

[0054] In an embodiment of the present invention, before security monitoring is performed on a computer monitoring system, a simulation test platform can be built on a simulation device for the computer monitoring system. The simulation test platform is consistent with the computer monitoring system, and can also be understood as building a simulated computer monitoring system on the simulation device. After the simulation test platform is built, the user can perform simulated operations on the computer monitoring system on the simulation test platform and obtain simulated operation data. The simulated operations in the present invention are the same as the common operations on the computer monitoring system, and the simulated operation data can be simulated operation videos recorded on the simulation test platform for the simulated operation. After obtaining the simulated operation data, the simulation device can send the simulated operation data to the second security monitoring device.

[0055] In an embodiment of the present invention, the configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the on-site hardware components of the computer monitoring system; the version information of the simulation test platform is the same as the version information of the computer monitoring system; the simulation test platform complies with the design documents and user manual of the computer monitoring system.

[0056] In the present invention, after the simulation test platform is built, it is necessary to first determine whether the built simulation test platform is consistent with the computer monitoring system. When it is determined that the built simulation test platform is consistent with the computer monitoring system, it can be determined that the simulation test platform is built. When determining whether the simulation test platform is built, that is, determining whether the built simulation test platform is consistent with the computer monitoring system, it can be done in the following way: first check whether the configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the field hardware components of the computer monitoring system. If they are different, it means that the simulation test platform is inconsistent with the computer monitoring system, and the configuration parameters of the simulation hardware components of the simulation test platform need to be adjusted. If they are the same, continue to check whether the version information of the simulation test platform is the same as the version information of the computer monitoring system. If they are different, it means that the simulation test platform is inconsistent with the computer monitoring system, and the version information of the simulation test platform needs to be adjusted. If they are the same, then according to the design documents and user manual of the computer monitoring system, perform functional testing on the simulation test platform, and check whether the functional test passes. If it does not pass, it means that the simulation test platform is inconsistent with the computer monitoring system, and the function of the simulation test platform needs to be adjusted. If it passes, it can be determined that the simulation test platform is consistent with the computer monitoring system, that is, it can be determined that the simulation test platform is built. Complete.

[0057] Step 402, obtaining the historical data of the computer monitoring system collected by the first security monitoring device; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system.

[0058] In an embodiment of the present invention, a computer monitoring system may be deployed on the first security monitoring device in the present invention, and historical data of the computer monitoring system may be collected, wherein the historical data may include: historical interaction interface, historical operation video, historical fault alarm screen, and historical equipment operation data. The historical interaction interface may be a UI design diagram of the computer monitoring system, and the historical equipment operation data may be the operation data of the equipment monitored by the computer monitoring system, and the operation data of the monitored equipment may be an operation point table and operation record of the equipment, etc. After the first security monitoring device collects the historical data of the computer monitoring system, the historical data may be sent to the second security monitoring device.

[0059] Step 403: train the pre-trained model according to the simulated operation data and the historical data to obtain a target prediction model.

[0060] In an embodiment of the present invention, after receiving the simulated operation data and the historical data, the second security monitoring device can train the pre-trained model according to the simulated operation data and the historical data to obtain a target prediction model.

[0061] In one embodiment, a pre-trained model is trained according to simulated operation data and historical data to obtain a target prediction model, which may include: training the pre-trained model according to simulated operation data, historical interaction interfaces, and historical equipment operation data; and re-training the trained pre-trained model according to historical operation videos, historical fault alarm screens, and historical equipment operation data to obtain a target prediction model.

[0062] Specifically, the pre-trained model is trained for the first time using the historical interactive interface, the operating point table in the historical equipment operation data, and the simulated operation data as the first training data, so that the pre-trained model can learn the elements in the computer monitoring system interactive interface, the signal quantity association relationship, and the screen context. Then, the pre-trained model is trained for the second time using the historical operation video, the historical fault alarm screen, and the operation record in the historical operation data as the second training data to obtain the target prediction model. In the present invention, during the second training, manual labeling can be performed during the training process to improve the model accuracy and generalization ability.

[0063] Step 404, obtain the real-time monitoring picture of the computer monitoring system collected by the first security monitoring device, input the real-time monitoring picture into the target prediction model, and make the target prediction model output the security prediction result for the computer monitoring system.

[0064] In an embodiment of the present invention, after obtaining the target prediction model, the target prediction model can be deployed on the second security monitoring device. The first security monitoring device can collect real-time monitoring images of the computer monitoring system in real time and send the real-time monitoring images to the second security monitoring device. After receiving the real-time monitoring images, the second security monitoring device can input the real-time monitoring images into the target prediction model, thereby outputting the security prediction results for the computer monitoring system through the target prediction model.

[0065] In one embodiment, obtaining the real-time monitoring screen of the computer monitoring system collected by the first security monitoring device includes: obtaining the real-time monitoring screen of the computer monitoring system sent by the first security monitoring device through the intelligent ferry system; the real-time monitoring screen of the computer monitoring system is collected by the first security monitoring device.

[0066] Specifically, the transfer device of the present invention may be equipped with an intelligent ferry system, and after the first security monitoring device collects the real-time monitoring screen of the computer monitoring system, it may send the real-time monitoring screen to the second security monitoring device based on the intelligent ferry system of the transfer device, thereby protecting the data of the real-time monitoring screen.

[0067] In an embodiment of the present invention, the second safety monitoring device can also transform the safety prediction results to obtain a safety monitoring report; the safety monitoring report includes: operating parameter trend curves, fault warnings, and operation reports of the monitored equipment. The present invention can transform the safety prediction results and distribute the transformed safety monitoring reports to operation and maintenance personnel or operation platforms to support the needs of safety monitoring and other services.

[0068] It should be noted that the target prediction model in this application includes an image text recognition module, a reasoning module, a context association mining module and a result conversion determination module. Figure 2 As shown, a structural block diagram of a target prediction model provided by an embodiment of the present invention is shown.

[0069] In the present invention, the image text recognition module is used to identify and extract text information such as memory operation data, equipment status quantity, etc. in the real-time monitoring screen, such as generator speed, real-time power generation, report, etc. The image text recognition module focuses on the conversion of multimodal information such as video, image, text, etc. into text information. The reasoning module is used to mine and analyze the association information between the text information output by the image text recognition module, such as the background status and the front-end interface equipment operation data association information, and infer the equipment status based on the association information. The equipment status may include: normal, fault, failure, etc. The reasoning module focuses on the association relationship between information in different pages in the near time area of ​​the computer monitoring system. The context association mining module is used to mine the association relationship between information in the same type of page in the time series, such as the change trend of the power curve of the turbine unit within 1-10h, and analyze the operation status of the computer monitoring system on a larger time and space scale in combination with the reasoning module. The operation status of the computer monitoring system may include: the operation status of the system and the operation status of the operation equipment. The context association mining module can be used to improve the scope of application of the reasoning module. The result conversion determination module is used to clean and organize the output results of each module, and generate various information forms such as reports, operation reports, system warnings, etc. according to on-site needs. It is also used to display the operating status of the computer monitoring system, and can provide on-site operation and maintenance personnel with the ability to determine the operating status of equipment and systems under the computer monitoring system.

[0070] In the embodiment of the present invention, the second security monitoring device may also evaluate the security prediction result to obtain an evaluation result; and optimize the parameters of the target prediction model according to the evaluation result.

[0071] Specifically, after the safety prediction results are output, users, i.e., operation and maintenance personnel, can evaluate the safety prediction results and optimize the model parameters based on the evaluation results to ensure the model's stability, prediction accuracy and other performance indicators. When evaluating, the operation and maintenance personnel can use network search, random search, Bayesian optimization and other methods to adjust the model parameters and improve the model performance based on their operation and maintenance experience. In combination with the actual on-site operation results, regularization technology can be used to constrain the model output results to prevent the model from overfitting. In combination with specific business scenarios, such as power prediction, self-distillation technology can be used to improve the model reasoning speed.

[0072] In an embodiment of the present invention, the second security monitoring device may include a central processing unit, a graphics processing unit, storage, memory, a storage system and a dual-isolation network card, wherein the network card 1 may be connected to a transfer device, the transfer device is connected to the first security monitoring device, and the network card 2 is connected to an independent local area network to connect other external devices, and other devices are physically isolated to ensure that the second security monitoring device does not affect the information security of the original network environment. Among them, other network devices can be devices used to display prediction results or case monitoring reports, such as: devices of other departments or other branches. Figure 3 , which shows a structural block diagram of a second security monitoring device provided by an embodiment of the present invention.

[0073] In an embodiment of the present invention, the second security monitoring device obtains the simulated operation data of the computer monitoring system executed by the user on the simulation test platform; the simulation test platform is built for the computer monitoring system through the simulation device; the historical data of the computer monitoring system collected by the first security monitoring device is obtained; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; according to the simulated operation data and historical data, the pre-trained model is trained to obtain the target prediction model; the real-time monitoring screen of the computer monitoring system collected by the first security monitoring device is obtained, and the real-time monitoring screen is input into the target prediction model, so that the target prediction model outputs the security prediction result for the computer monitoring system. Therefore, the computer monitoring system can be safely monitored according to the real-time monitoring screen of the computer monitoring system through the target test model, without relying on professional analysts to analyze based on experience, and the health status of the system and equipment can be reflected and warned in real time.

[0074] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0075] Reference Figure 5 , shows a structural block diagram of a security monitoring device provided by an embodiment of the present invention, the device is applied to a second security monitoring device; the second security monitoring device is connected to a simulation device and a first security monitoring device respectively; a computer monitoring system is deployed in the first security monitoring device; the device may specifically include the following modules: The first acquisition module 501 is used to acquire the simulated operation data executed by the user on the simulation test platform for the computer monitoring system; the simulation test platform is built for the computer monitoring system through the simulation device; The second acquisition module 502 is used to acquire the historical data of the computer monitoring system collected by the first security monitoring device; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; A training module 503 is used to train the pre-training model according to the simulated operation data and the historical data to obtain a target prediction model; The output module 504 is used to obtain the real-time monitoring picture of the computer monitoring system collected by the first security monitoring device, input the real-time monitoring picture into the target prediction model, and make the target prediction model output the security prediction result for the computer monitoring system.

[0076] In one embodiment, the training module 503 includes: A first training submodule, used for training the pre-trained model according to the simulation operation data, the historical interaction interface and the historical device operation data; The second training submodule is used to retrain the pre-trained model according to the historical operation video, the historical fault alarm screen and the historical equipment operation data to obtain a target prediction model.

[0077] In one embodiment, the configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the on-site hardware components of the computer monitoring system; the version information of the simulation test platform is the same as the version information of the computer monitoring system; and the simulation test platform complies with the design documents and user manual of the computer monitoring system.

[0078] In one embodiment, the output module 504 includes: The acquisition submodule is used to acquire the real-time monitoring picture of the computer monitoring system sent by the first security monitoring device through the intelligent ferry system; the real-time monitoring picture of the computer monitoring system is collected by the first security monitoring device.

[0079] In one embodiment, the device further comprises: The conversion module is used to convert the safety prediction results to obtain a safety monitoring report; the safety monitoring report includes: an operating parameter trend curve of the monitored equipment, a fault warning, and an operation report.

[0080] In one embodiment, the device further comprises: An evaluation module, used to evaluate the security prediction result to obtain an evaluation result; An optimization module is used to optimize the parameters of the target prediction model according to the evaluation results.

[0081] In an embodiment of the present invention, the first acquisition module is used to obtain the simulated operation performed by the user on the simulation test platform for the computer monitoring system; the simulation test platform is built for the computer monitoring system through the simulation device; the second acquisition module is used to obtain the historical data of the computer monitoring system collected by the first security monitoring device; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; the training module is used to train the pre-training model according to the simulated operation data and historical data to obtain the target prediction model; the output module is used to obtain the real-time monitoring screen of the computer monitoring system collected by the first security monitoring device, and input the real-time monitoring screen into the target prediction model, so that the target prediction model outputs the security prediction result for the computer monitoring system. Therefore, the computer monitoring system can be safely monitored according to the real-time monitoring screen of the computer monitoring system through the target test model, without relying on professional analysts to analyze based on experience, and the health status of the system and equipment can be reflected and warned in real time.

[0082] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0083] An embodiment of the present invention further provides an electronic device, including: It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned security monitoring system method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0084] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned security monitoring system method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0085] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0086] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0087] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0088] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0089] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0090] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0091] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0092] The security monitoring system, the security monitoring method, the security monitoring device, the electronic device and the computer-readable storage medium provided by the present invention are introduced in detail above. The principle and implementation mode of the present invention are explained in this article by using specific examples. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for the general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and the scope of application. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A security monitoring system, It is characterized in that The system comprises: a simulation device, a first security monitoring device and a second security monitoring device; the first security monitoring device is equipped with a computer monitoring system; the second security monitoring device is connected to the simulation device and the first security monitoring device respectively; The simulation device is used to build a simulation test platform for the computer monitoring system; obtain simulation operation data for the computer monitoring system performed by the user on the simulation test platform, and send the simulation operation data to the second safety component monitoring device; The first security monitoring device is used to collect historical data of the computer monitoring system; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; the historical data is sent to the second security monitoring device; the real-time monitoring screen of the computer monitoring system is collected, and the real-time monitoring screen is sent to the second security monitoring device; The second security monitoring device is used to receive the simulated operation data and the historical data; train the pre-trained model according to the simulated operation data and the historical data to obtain a target prediction model; obtain the real-time monitoring screen, input the real-time monitoring screen into the target prediction model, and make the target prediction model output a security prediction result for the computer monitoring system.

2. The security monitoring system according to claim 1, It is characterized in that The second safety monitoring device is used to train the pre-trained model according to the simulated operation data, the historical interactive interface and the historical equipment operation data; and re-train the pre-trained model according to the historical operation video, the historical fault alarm screen and the historical equipment operation data to obtain a target prediction model.

3. The security monitoring system according to claim 1, It is characterized in that The simulation device is also used to check whether the configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the on-site hardware components of the computer monitoring system; if the configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the on-site hardware components of the computer monitoring system, then check whether the version information of the simulation test platform is the same as the version information of the computer monitoring system; if the version information of the simulation test platform is the same as the version information of the computer monitoring system, then perform a functional test on the simulation test platform according to the design documents and user manual of the computer monitoring system, and check whether the functional test passes; if the functional test passes, it is determined that the simulation test platform has been completed.

4. The security monitoring system according to claim 1, It is characterized in that The system further includes a transfer device; the transfer device is connected to the first security monitoring device and the second security monitoring device respectively; an intelligent ferry system is deployed in the transfer device; The first security monitoring device is used to collect real-time monitoring images of the computer monitoring system and send the real-time monitoring images to the transfer device; The transfer device is used to obtain the real-time monitoring picture of the computer monitoring system and send the real-time monitoring picture to the second security monitoring device through the intelligent ferry system; The second security monitoring device is used to receive the real-time monitoring image sent by the transfer device.

5. The security monitoring system according to claim 1, It is characterized in that The second safety monitoring device is also used to transform the safety prediction result to obtain a safety monitoring report; the safety monitoring report includes: an operating parameter trend curve of the monitored equipment, a fault warning, and an operation report.

6. The security monitoring system according to claim 1, It is characterized in that The second security monitoring device is also used to evaluate the security prediction result to obtain an evaluation result; and optimize the parameters of the target prediction model according to the evaluation result.

7. The security monitoring system according to claim 5, It is characterized in that The second security monitoring device is provided with a first network card and a second network card; The first network card is used for the second security monitoring device to communicate with the first security monitoring device; The second network card is used for the second security monitoring device to communicate with other devices; The other device is used to receive and display the security monitoring report.

8. A security monitoring method, It is characterized in that The method is applied to a second security monitoring device; The second safety monitoring device is connected to the simulation device and the first safety monitoring device respectively; A computer monitoring system is deployed in the first security monitoring device; the method comprises: Acquiring simulated operation data for the computer monitoring system executed by a user on a simulation test platform; the simulation test platform is built for the computer monitoring system through the simulation device; Acquire historical data of the computer monitoring system collected by the first security monitoring device; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; Training the pre-trained model according to the simulated operation data and the historical data to obtain a target prediction model; Acquire the real-time monitoring picture of the computer monitoring system collected by the first security monitoring device, input the real-time monitoring picture into the target prediction model, and make the target prediction model output the security prediction result for the computer monitoring system.

9. The security monitoring method according to claim 8, wherein the pre-training model is trained according to the simulated operation data and the historical data to obtain a target prediction model, include: Training the pre-trained model according to the simulated operation data, the historical interaction interface and the historical device operation data; According to the historical operation video, the historical fault alarm screen and the historical equipment operation data, the pre-trained model is re-trained to obtain a target prediction model.

10. The security monitoring method according to claim 8, It is characterized in that The configuration parameters of the simulation hardware components in the simulation test platform are the same as the configuration parameters of the on-site hardware components of the computer monitoring system; the version information of the simulation test platform is the same as the version information of the computer monitoring system; the simulation test platform complies with the design documents and user manual of the computer monitoring system.

11. The security monitoring method according to claim 8, It is characterized in that The step of obtaining the real-time monitoring image of the computer monitoring system collected by the first security monitoring device includes: Acquire the real-time monitoring picture of the computer monitoring system sent by the first security monitoring device through the intelligent ferry system; the real-time monitoring picture of the computer monitoring system is collected by the first security monitoring device.

12. The security monitoring method according to claim 8, It is characterized in that The method further comprises: The safety prediction results are transformed to obtain a safety monitoring report; the safety monitoring report includes: an operating parameter trend curve of the monitored equipment, a fault warning, and an operation report.

13. The security monitoring method according to claim 8, It is characterized in that The method further comprises: Evaluating the safety prediction result to obtain an evaluation result; According to the evaluation results, the parameters of the target prediction model are optimized.

14. A security monitoring device, It is characterized in that The device is applied to a second security monitoring device; The second safety monitoring device is connected to the simulation device and the first safety monitoring device respectively; A computer monitoring system is deployed in the first security monitoring device; the device comprises: A first acquisition module is used to acquire simulation operation data for the computer monitoring system executed by a user on a simulation test platform; the simulation test platform is built for the computer monitoring system through the simulation device; A second acquisition module is used to acquire historical data of the computer monitoring system collected by the first security monitoring device; the historical data includes: historical interactive interface, historical operation video, historical fault alarm screen, historical equipment operation data; the historical equipment operation data is the operation data of the equipment monitored by the computer monitoring system; A training module, used to train the pre-training model according to the simulated operation data and the historical data to obtain a target prediction model; An output module is used to obtain the real-time monitoring picture of the computer monitoring system collected by the first security monitoring device, input the real-time monitoring picture into the target prediction model, and enable the target prediction model to output the security prediction result for the computer monitoring system.

15. An electronic device, It is characterized in that include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the security monitoring method according to any one of claims 8 to 13 are implemented.

16. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the security monitoring method according to any one of claims 8 to 13 are implemented.

Images