Urban multi-category security risk early warning method and system based on federated super network

Abstract

The invention discloses an urban multi-category security risk early warning method and system based on a federated super network, and the method comprises the steps: receiving first information which comprises model parameters transmitted by a plurality of risk early warning clients corresponding to different risks, the model parameters are obtained by training a preset SC Nor-Transform model through historical data collected by a sensor group of a corresponding risk, and the SC Nor-Transform model is used for processing input through a sequence normalization layer, a sequence conversion layer, an encoder, a feature mapping layer and a sequence de-normalization layer in sequence to obtain output; updating the model parameters corresponding to the risk early warning clients through a super network to obtain updated parameters; the corresponding update parameters are sent to the corresponding risk early warning clients; and obtaining second information, wherein the second information comprises the risk early warning score output by the update model corresponding to each risk early warning client. The method can effectively cope with the expansion of the city scale, the increase of the data volume and the influence of data isomerism, and determines the type or cause of the disaster.

Description

Technical Field

[0001] The present invention relates to the technical field of urban safety risk early warning, and in particular to an urban multi-category safety risk early warning method and system based on a federal super network. Background Art

[0002] As urban life becomes increasingly complex, traditional security monitoring methods can no longer meet the security needs of modern cities. Therefore, data-driven risk monitoring and early warning systems have emerged. However, such systems rely on the collection and analysis of a large amount of real-time data, and traditional centralized methods are not suitable for deployment in urban environments. For this reason, distributed anomaly detection methods have begun to attract attention.

[0003] Distributed anomaly detection has been applied to fields such as industrial equipment monitoring, financial risk control, and smart cities. Due to the heterogeneity of local data, it is challenging to obtain a global model that is applicable to all clients. However, due to the distribution drift of local time series data and client fluctuations, it is difficult for existing distributed anomaly detection methods to obtain the optimal global risk warning model by aggregating local risk warning client models. Time series data collected on edge devices are usually heterogeneous and non-homologous. Due to the distribution drift of different local time series data sets, it is difficult for local time series models to obtain the optimal global model by simply aggregating local models. Secondly, the time series fragmentation caused by the distributed environment will seriously affect the model's ability to capture time series information, resulting in a decrease in risk detection performance and the inability to quickly locate risk variables.

[0004] Therefore, a multi-category urban safety risk early warning method and system based on a federal super network was developed to solve the above problems. Summary of the invention

[0005] The present invention proposes a method and system for early warning of multi-category urban safety risks based on a federated hypernetwork to solve the problems of difficult aggregation and low risk detection capability of risk early warning models in the prior art.

[0006] The present invention achieves the above-mentioned purpose through the following technical solutions: The present invention provides a method and system for early warning of multi-category urban safety risks based on a federated hypernetwork, including: Receive first information, the first information including model parameters respectively sent by a plurality of risk warning clients corresponding to different risks, the model parameters being obtained by training a preset SCNor-Transformer model with historical data collected by a sensor group corresponding to the risk, the SCNor-Transformer model being used to sequentially process the input through a sequence normalization layer, a sequence conversion layer, an encoder, a feature mapping layer, and a sequence denormalization layer to obtain an output; In the SCNor-Transformer model training process, in order to improve the accuracy of the model, data standardization is used to process the training set and test set, and data of different specifications are converted to a unified specification to reduce the impact of scale, feature, and distribution differences on the model. standardization.

[0007] The model parameters corresponding to each of the risk warning clients are updated through a hypernetwork to obtain updated parameters; Sending the corresponding updated parameters to the corresponding risk warning client; Acquire second information, where the second information includes a risk warning score output by an update model corresponding to each risk warning client, where the update model is a model updated by the SCNor-Transformer model according to the update parameters, and the risk warning score is an output obtained by inputting the real-time data collected by the sensor group into the update model, and determine whether there is a corresponding risk according to the risk warning score of the corresponding risk warning client; A directed acyclic graph is generated based on a root cause location algorithm according to each risk warning score corresponding to the input sequence of the risk warning client at each moment, a ranking list is obtained according to the directed acyclic graph, and a risk diagnosis result is obtained from the ranking list.

[0008] Specifically, the data processing process of the sequence normalization layer is expressed as:

[0009]

[0010]

[0011] in represents the historical data collected by the sensor group corresponding to the risk in the input sequence, represents the sequence obtained after the input sequence is translated and scaled, , represents the average value, represents the standard deviation, S is the length of the sequence, C is the dimension, , Represents element-wise multiplication.

[0012] Specifically, the data processing process of the encoder includes multi-head attention mechanism processing, layer normalization processing and feedforward layer processing, wherein: The multi-head attention mechanism processing is expressed as:

[0013]

[0014] Among them, Multihead-Atten() represents the multi-head attention mechanism, cat() represents the tensor splicing operation; Atten() represents the self-attention mechanism, q, k, and v represent the query matrix, key matrix, and value matrix in the self-attention mechanism respectively. denote the query matrix, key matrix, and value matrix in the t-th self-attention mechanism, respectively, and H t represents the output of the t-th self-attention mechanism, and h represents the number of heads of the multi-head attention mechanism. , represents the output of each attention mechanism head; The layer normalization process is expressed as:

[0015] The feedforward layer processing process is expressed as:

[0016] in, The result of layer normalization, H n represents the output of the multi-head attention mechanism, Represents the output of the encoder.

[0017] Specifically, the feature mapping layer is used to reconstruct the output of the encoder to obtain a reconstructed sequence, and the risk warning score is calculated by the input sequence and the reconstructed sequence. The calculation formula of the risk warning score is as follows:

[0018] in, A represents the risk warning score, represents the input sequence, Represents a reconstruction sequence.

[0019] Specifically, the data processing process of the sequence denormalization layer is expressed as:

[0020] In it Indicates the output, indicating is the output data after denormalization.

[0021] Further, judging whether there is a corresponding risk according to the risk warning score of the corresponding risk warning client includes: Setting an initial threshold range for the risk warning score; During the training of the SCNor-Transformer model, determining an optimal threshold as the preset risk score threshold based on a dynamic threshold search method according to the initial threshold range; The risk warning score is compared with the optimal threshold, and when the risk warning score is greater than the optimal threshold, a risk warning is issued.

[0022] Furthermore, several risk warning clients include an earthquake risk warning client, a gas leak risk warning client, a flood risk warning client and a fire risk warning client.

[0023] Further, generating a directed acyclic graph based on the root cause location algorithm according to each of the risk warning scores corresponding to the input sequence at each moment of the risk warning client, obtaining a ranking list according to the directed acyclic graph, and obtaining a risk diagnosis result from the ranking list, including: Connecting the risk warning scores of each input sequence to construct a directed acyclic graph, wherein a node of the directed acyclic graph represents an input sequence having the risk warning score, and an edge of the directed acyclic graph represents a causal relationship between the input sequences; Assigning a causal relationship score to each node of the directed acyclic graph based on the PageRank algorithm, is the probability score of node a moving to node b, is the weight of the edge from node a to node b. If there is no clear weight, it can be assumed that the weights of all edges are equal, and finally a transition probability matrix is ​​obtained. The following is a detailed description of the PageRank algorithm:

[0024] Iteratively update the causality score:

[0025] Among them, PR(a) is the causal score of node a, d is the damping factor, L(b) is the out-degree of node b, that is, the number of connections from node b, and m represents the number of nodes; Finally, based on the order of causality scores from high to low, the input sequence with the highest score is determined as the root cause.

[0026] The present invention also discloses a system for a city multi-category safety risk early warning method based on a federated hypernetwork, comprising: Different sensor groups are deployed in various areas of the city corresponding to the risks: used to collect sensor data corresponding to the risks in real time and store the sensor data in a data server; Risk warning client: configured with a preset SCNor-Transformer model as a local model, the SCNor-Transformer model is used to process the input through a sequence normalization layer, a sequence conversion layer, an encoder, a feature mapping layer, and a sequence denormalization layer in sequence to obtain an output, and the SCNor-Transformer model is used to send model parameters, and the model parameters are obtained by training the SCNor-Transformer model with historical data collected by the sensor group corresponding to the risk; The base station edge computing unit is used to communicate with each of the risk warning clients, including a super network, a risk warning module and a risk diagnosis module, wherein the super network is used to update the model parameters corresponding to each of the risk warning clients to obtain the updated parameters, and the risk warning module is used to obtain the risk warning score output by the updated model corresponding to each of the risk warning clients, wherein the updated model is a model obtained by updating the SCNor-Transformer model according to the updated parameters, and the risk warning score is an output obtained by inputting the real-time data collected by the sensor group into the updated model, and the risk warning module is used to compare the risk warning score of the corresponding risk warning client with a preset risk score threshold to determine whether there is a corresponding risk, and output a risk warning result, and the risk diagnosis module is used to generate a directed acyclic graph based on the root cause location algorithm according to all the risk warning scores corresponding to the risk warning clients, obtain a ranking list according to the directed acyclic graph, and obtain a risk diagnosis result from the ranking list; Emergency cloud service platform: used to receive risk warnings and risk diagnosis results transmitted by each base station, and perform warning and response services.

[0027] The beneficial effects of the present invention are as follows: the urban multi-category safety risk early warning method and system based on the federated super network proposed in the present invention effectively overcomes various data sources such as various sensors and surveillance videos through the SCNor-Transformer model, constructs a comprehensive urban safety situation awareness, and can effectively cope with the impact of the expansion of urban scale, the increase in data volume and data heterogeneity, and can further determine the type of disaster or the cause of the disaster while detecting the disaster. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a method flow chart of the city multi-category security risk early warning method and system based on the federal super network in the embodiment of the present application; Figure 2 This is a schematic diagram of the SCNor-Transformer model in the embodiment of the present application; Figure 3This is a method logic diagram of the city multi-category safety risk early warning method and system based on the federal super network in the embodiment of the present application; Figure 4 A schematic diagram of the structure of a directed acyclic graph in an embodiment of the present application; Figure 5 A schematic diagram of an application scenario in an embodiment of the present application; Figure 6 This is a structural diagram of a distributed urban safety risk comprehensive monitoring and early warning system in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0030] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0032] In the description of the present invention, it should be understood that the terms "upper", "lower", "inside", "outside", "left", "right", etc. indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings, or are directions or positional relationships in which the product of the invention is usually placed when in use, or are directions or positional relationships commonly understood by those skilled in the art. These directions or positional relationships are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as a limitation on the present invention.

[0033] Furthermore, the terms “first”, “second”, etc. are merely used for distinguishing descriptions and are not to be understood as indicating or implying relative importance.

[0034] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms such as "setting" and "connection" should be understood in a broad sense. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0035] The specific implementation modes of the present invention are described in detail below in conjunction with the accompanying drawings.

[0036] Combination Figure 1 , Figure 2 and Figure 3 As shown, the city multi-category safety risk early warning method and system based on the federal super network includes: S1: Receive first information, which includes model parameters respectively sent by several risk warning clients corresponding to different risks, wherein the model parameters are obtained by training a preset SCNor-Transformer model with historical data collected by a sensor group corresponding to the risk, and the SCNor-Transformer model is used to process the input through a sequence normalization layer, a sequence conversion layer, an encoder, a feature mapping layer, and a sequence denormalization layer in sequence to obtain an output; S2: updating the model parameters corresponding to each of the risk warning clients through the hypernetwork to obtain updated parameters; Federated learning is an effective approach when local data cannot be shared due to privacy, storage, or communication constraints. The hypernetwork provides a mapping from the embedding input space to the client network parameter space, and each client model is constrained to this manifold and parameterized by the embedding vector. The hypernetwork parameters are never transmitted. Instead, each client only needs to receive its own network parameters to make predictions and compute gradients.

[0037] is a parameterized hypernetwork, It is parameterized Target network. Hypernetwork output i * The weight of the client, . Represents the local model parameters. Then the optimization goal of the hypernetwork is:

[0038] The client only needs to Passed back to the hypernetwork, its size is the same as the network parameters The update rule is ,in is the change in local model parameters after multiple local update steps. Then return the client model update .therefore, Updated by Given, represents the chain rule, which is used to update parameters. The update rule becomes:

[0039] in represents the hypernetwork loss function, Represents network parameters.

[0040] S3: sending the corresponding updated parameter to the corresponding risk warning client; S4: Acquire second information, where the second information includes a risk warning score output by an update model corresponding to each risk warning client, where the update model is a model updated by the SCNor-Transformer model according to the update parameters, and the risk warning score is an output obtained by inputting the real-time data collected by the sensor group into the update model, and determine whether there is a corresponding risk according to the risk warning score of the corresponding risk warning client; S5: Generate a directed acyclic graph based on a root cause location algorithm according to all the risk warning scores corresponding to the risk warning clients, obtain a ranking list according to the directed acyclic graph, and obtain a risk diagnosis result from the ranking list.

[0041] In some embodiments, the data processing process of the sequence normalization layer is expressed as:

[0042]

[0043]

[0044] in represents the historical data collected by the sensor group corresponding to the risk in the input sequence, represents the sequence obtained after the input sequence is translated and scaled, , represents the average value, represents the standard deviation, S is the length of the sequence, C is the dimension, , Represents element-wise multiplication.

[0045] The time series offset problem caused by model aggregation will lead to a decrease in detection performance. Collect statistics for each input sequence, and then convert the statistics into restored statistics and output them to obtain a better reconstructed sequence. Normalize the time series through a sliding window. For each input sequence , perform translation and scaling operations on it, and obtain

[0046] In some embodiments, the data processing process of the sequence conversion layer is expressed as:

[0047] in represents the time series of the sequence conversion layer input, where n represents the sequence length, Contains N embedding tags, T is the window size, and D represents the dimension. represents the embedded token, and R represents the real number domain. In a distributed environment that leads to fragmentation of time series, sequence embedding embeds each input sequence into a token through sequence transformation, thereby capturing time features more effectively.

[0048] In some embodiments, the data processing process of the encoder includes multi-head attention mechanism processing, layer normalization processing and feed-forward layer processing, wherein: The multi-head attention mechanism processing is expressed as:

[0049]

[0050] Among them, Multihead-Atten() represents the multi-head attention mechanism, cat() represents the tensor splicing operation; Atten() represents the self-attention mechanism, q, k, and v represent the query matrix, key matrix, and value matrix in the self-attention mechanism respectively. denote the query matrix, key matrix, and value matrix in the t-th self-attention mechanism, respectively, and H t represents the output of the t-th self-attention mechanism, and h represents the number of heads of the multi-head attention mechanism. , represents the output of each attention mechanism head; The layer normalization process is expressed as:

[0051] The feedforward layer processing process is expressed as:

[0052] in, The result of layer normalization, Hn represents the output of the multi-head attention mechanism, Represents the output of the encoder.

[0053] In some embodiments, the feature mapping layer is used to reconstruct the output of the encoder to obtain a reconstructed sequence, and the risk warning score is calculated by the input sequence and the reconstructed sequence. The calculation formula of the risk warning score is as follows:

[0054] in, A represents the risk warning score, represents the input sequence, Represents a reconstruction sequence.

[0055] In some embodiments, the data processing process of the sequence denormalization layer is expressed as:

[0056] In it Indicates the output, indicating is the output data after denormalization.

[0057] Series normalization can effectively reduce the time series deviation and scale disturbance caused by model aggregation.

[0058] In some embodiments, comparing the risk warning score of the corresponding risk warning client with a preset risk score threshold to determine whether a corresponding risk exists includes: Setting an initial threshold range for the risk warning score; During the training of the SCNor-Transformer model, determining an optimal threshold as the preset risk score threshold based on a dynamic threshold search method according to the initial threshold range; The risk warning score is compared with the optimal threshold, and when the risk warning score is greater than the optimal threshold, a risk warning is issued.

[0059] like Figure 6 As shown, in some embodiments, several risk warning clients include an earthquake risk warning client, a gas leak risk warning client, a flood risk warning client, and a fire risk warning client.

[0060] Combination Figure 5 and Figure 6 As shown, the present invention also provides a distributed urban safety risk comprehensive monitoring and early warning system comprising: Different sensor groups are deployed in various areas of the city corresponding to the risks: used to collect sensor data corresponding to the risks in real time and store the sensor data in a data server; Risk warning client: configured with a preset SCNor-Transformer model as a local model, the SCNor-Transformer model is used to process the input through a sequence normalization layer, a sequence conversion layer, an encoder, a feature mapping layer, and a sequence denormalization layer in sequence to obtain an output, and the SCNor-Transformer model is used to send model parameters, and the model parameters are obtained by training the SCNor-Transformer model with historical data collected by the sensor group corresponding to the risk; The base station edge computing unit is used to communicate with each of the risk warning clients, including a super network, a risk warning module and a risk diagnosis module, wherein the super network is used to update the model parameters corresponding to each of the risk warning clients to obtain the updated parameters, and the risk warning module is used to obtain the risk warning score output by the updated model corresponding to each of the risk warning clients, wherein the updated model is a model obtained by updating the SCNor-Transformer model according to the updated parameters, and the risk warning score is an output obtained by inputting the real-time data collected by the sensor group into the updated model, and the risk warning module is used to compare the risk warning score of the corresponding risk warning client with a preset risk score threshold to determine whether there is a corresponding risk, and output a risk warning result, and the risk diagnosis module is used to generate a directed acyclic graph based on the root cause location algorithm according to all the risk warning scores corresponding to the risk warning clients, obtain a ranking list according to the directed acyclic graph, and obtain a risk diagnosis result from the ranking list; Emergency cloud service platform: used to receive risk warnings and risk diagnosis results transmitted by each base station, and perform warning and response services.

[0061] The specific steps for the urban safety risk comprehensive monitoring and early warning system to implement disaster early warning are: Sensor data collection: The monitoring data collected by each sensor in real time is stored on the data client; Local model training: The SCNor-Transformer model on the data client is trained locally on the data server using historical data; Local model parameter transmission: Each regional local data client sends the trained model parameters to the base station; Base station reception: Base stations in the area receive model parameters from local data clients; Model update and distribution: The model is updated and distributed via the super network deployed on the base station; Local model update: The local data client receives the new model parameters sent back from the base station to complete the local model update; Iterative training: Repeat the previous steps until the preset number of training times is reached to obtain an optimized new model; Abnormal identification: The local data server obtains data collected in real time from sensors to identify risks; Result upload: Send local risk identification results to the base station; Disaster information collection: The base station collects disaster information from various regions and sends it to the emergency cloud platform; Early warning response: The emergency cloud platform responds to the early warning system and initiates a response.

[0062] In some embodiments, the historical data corresponding to the earthquake risk warning client is the historical data collected by the magnitude sensor, the historical data corresponding to the gas leakage risk warning client is the historical data collected by the gas sensor, the historical data corresponding to the flood risk warning client is the historical data collected by the water level sensor, and the historical data corresponding to the fire risk warning client is the historical data collected by the far infrared sensor and the video monitoring equipment.

[0063] In some embodiments, generating a directed acyclic graph based on a root cause location algorithm according to each of the risk warning scores corresponding to the input sequence of the risk warning client at each moment, obtaining a ranking list according to the directed acyclic graph, and obtaining a risk diagnosis result from the ranking list includes: like Figure 4 As shown, the risk warning scores of each input sequence are connected to construct a directed acyclic graph, wherein the nodes of the directed acyclic graph represent an input sequence with the risk warning score, and the edges of the directed acyclic graph represent the causal relationship between the input sequences; Assigning a causal relationship score to each node of the directed acyclic graph based on the PageRank algorithm, is the probability score of node a moving to node b, is the weight of the edge from node a to node b. If there is no clear weight, it can be assumed that the weights of all edges are equal, and finally a transition probability matrix is ​​obtained. The following is a detailed description of the PageRank algorithm:

[0064] Iteratively update the causality score:

[0065] Among them, PR(a) is the causal score of node a, d is the damping factor, L(b) is the out-degree of node b, that is, the number of connections from node b, and m represents the number of nodes; Finally, based on the order of causality scores from high to low, the input sequence with the highest score is determined as the root cause.

[0066] The process of performance evaluation of the present invention is as follows: Precision, Recall, F1 score, and AUROC are used to evaluate the performance of the method. Recall measures how many of the predicted anomalies are actually anomalies. Precision measures how many of the predicted anomalies are accurate. The F1 score is used to account for the sample imbalance that affects precision and recall. This score provides a balanced average of the two metrics. AUROC measures the performance of the model at different thresholds to show its ability to identify positive and negative samples.

[0067] Two metrics are used to evaluate the accuracy of anomaly diagnosis: AC@k and Avg@k. The AC@k metric indicates the probability that the top k results of a method contain the root cause. When the k value is low, the AC@k metric is more accurate. The calculation method of AC@k is as follows:

[0068] Among them, R[i] is the ranking result of all indicators. is the root cause set. The overall performance of the method can be evaluated by calculating the average AC@k, Avg@k, which is defined as follows:

[0069] Where m represents the number of AC@j indicators, and the AC@j indicator represents the probability that the first j results of a method contain the root cause. These two indicators are usually used in root cause localization tasks and can be used to fairly evaluate the localization performance.

[0070] The historical data set used in the present invention is shown in Table 1 below: Table 1

[0071] The experimental results of the present invention on the real data set are shown in Table 2 below: Table 2

[0072] Table 2 compares the present invention with six baseline methods in eight public datasets, where the local model of the baseline method is SCNor-Transformer. On the eight datasets, the average F1 score of the present invention is 0.8515, the AUROC is 0.9039, the average F1 score ranking of the eight datasets is 1.5, and the average AUROC ranking is 1.6. On PSM and SMAP, the present invention is slightly inferior to the baseline method; on MSL, the F1 score is inferior to the optimal baseline method; on SWaT, the present invention is inferior to the centralized method. In general, the F1 score of the present invention is improved by 9.19%, and the AUROC is improved by 5.19%.

[0073] The experimental results of communication overhead are shown in Table 3: Table 3

[0074] Table 3 Real-time detection capability is critical. The average overhead time for each round of communication is calculated by recording the time spent on 20 communications. The results are shown in the table. Each round of communication will train to get a test result. The average ranking of the present invention on eight data sets is 2.5, which is better than the baseline method. Among the baseline methods based on federated learning, MOON ranks the highest. Elastic can interpolate customer models based on parameter sensitivity. This is measured by the change in the overall prediction function output when each parameter changes.

[0075] The results of the scalability experiment are shown in Table 4: Table 4

[0076] In Table 4, the analysis also focuses on scalability. As the data set increases, the performance of the present invention remains unchanged, which shows that it can handle large data sets. This scalability is crucial when deploying this method in a distributed time series environment. The scalability of the distributed MTSAD method is also key to performance. The client sampling rate was changed to simulate the impact of changes in the number of clients in real scenarios on performance fluctuations. After setting the client sampling rate to 0.5, the F1 score results of are: the present invention is more affected on PSM, while it performs better on other data sets compared to other distributed baseline methods.

[0077] The results of the heterogeneity experiment are shown in Table 5: Table 5

[0078] In Table 5, in order to compare the effects of the present invention and other baseline methods in different heterogeneous environments, of . The smaller the size, the more heterogeneous the environment, and the more difficult it is to detect. Different The detection performance of the model is verified by using the value. The present invention has a good overall ranking of 2.13 in terms of stability, but is greatly affected by PSM and MSL. In general, the present invention can obtain more stable detection results in different heterogeneous environments. The present invention shows a high degree of adaptability in heterogeneous environments. It can maintain a high detection rate while managing the complexity of various data sources. This flexibility is crucial for applications that rely on data from different sensors or systems.

[0079] The results of the risk diagnosis experiment are shown in Table 6: Table 6

[0080] In Table 6, anomaly diagnosis experiments were conducted on a multi-source distributed system dataset (MSDS) for anomaly detection, root cause location, and repair. Comparing three baseline methods for root cause location, the present invention is able to perform anomaly detection while assisting staff in quickly troubleshooting. The present invention obtains the error size of each feature dimension by reconstructing the error, and then performs anomaly diagnosis through the root cause location algorithm. In all anomaly diagnosis cases, the present invention is more accurate than the baseline method.

[0081] Experiments show that the anomaly detection and diagnosis capabilities of the present invention are very effective, and perform best in multiple environments, demonstrating its robustness in a distributed environment.

[0082] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A multi-category urban safety risk early warning method based on a federated hypernetwork, characterized in that: include: Receive first information, the first information including model parameters respectively sent by a plurality of risk warning clients corresponding to different risks, the model parameters being obtained by training a preset SCNor-Transformer model with historical data collected by a sensor group corresponding to the risk, the SCNor-Transformer model being used to sequentially process the input through a sequence normalization layer, a sequence conversion layer, an encoder, a feature mapping layer, and a sequence denormalization layer to obtain an output; The model parameters corresponding to each of the risk warning clients are updated through a hypernetwork to obtain updated parameters; Sending the corresponding updated parameters to the corresponding risk warning client; Acquire second information, where the second information includes a risk warning score output by an update model corresponding to each of the risk warning clients, where the update model is a model updated by the SCNor-Transformer model according to the update parameters, and the risk warning score is an output obtained by inputting the real-time data collected by the sensor group into the update model, compare the risk warning score of the corresponding risk warning client with a preset risk score threshold to determine whether there is a corresponding risk, and output a risk warning result; A directed acyclic graph is generated based on a root cause location algorithm according to each risk warning score corresponding to the input sequence of the risk warning client at each moment, a ranking list is obtained according to the directed acyclic graph, and a risk diagnosis result is obtained from the ranking list.

2. The method for early warning of multi-category urban safety risks based on a federated hypernetwork according to claim 1 is characterized in that: The data processing process of the sequence normalization layer is expressed as: in represents the input sequence, i.e. the historical data collected by the sensor group corresponding to the risk, represents the sequence obtained after the input sequence is translated and scaled, , represents the average value, represents the standard deviation, S is the length of the sequence, C is the dimension, , Represents element-wise multiplication.

3. The method for early warning of multi-category urban safety risks based on a federated hypernetwork according to claim 2 is characterized in that: The data processing process of the sequence conversion layer is expressed as: in represents the time series of the sequence conversion layer input, where n represents the sequence length, Contains N embedding tags, T is the window size, and D represents the dimension. Represents an embedded tag.

4. The method for early warning of multi-category urban safety risks based on a federated hypernetwork according to claim 3 is characterized in that: The data processing process of the encoder includes multi-head attention mechanism processing, layer normalization processing and feedforward layer processing, where: The multi-head attention mechanism processing is expressed as: Among them, Multihead-Atten() represents the multi-head attention mechanism, cat() represents the tensor splicing operation; Atten() represents the self-attention mechanism, q, k, and v represent the query matrix, key matrix, and value matrix in the self-attention mechanism respectively. denote the query matrix, key matrix, and value matrix in the t-th self-attention mechanism, respectively, and H t represents the output of the t-th self-attention mechanism, and h represents the number of heads of the multi-head attention mechanism. , represents the output of each attention mechanism head; The layer normalization process is expressed as: The feedforward layer processing process is expressed as: in, The result of layer normalization, H n represents the output of the multi-head attention mechanism, Represents the output of the encoder.

5. The method for early warning of multi-category urban safety risks based on a federated hypernetwork according to claim 4 is characterized in that: The feature mapping layer is used to reconstruct the output of the encoder to obtain a reconstructed sequence, and the risk warning score is calculated by the input sequence and the reconstructed sequence. The calculation formula of the risk warning score is as follows: in, A represents the risk warning score, represents the input sequence, Represents a reconstruction sequence.

6. The method for early warning of multi-category urban safety risks based on a federated hypernetwork according to claim 5 is characterized in that: The data processing process of the sequence denormalization layer is expressed as: In it Indicates the output, indicating is the output data after denormalization.

7. The method for early warning of multi-category urban safety risks based on a federated hypernetwork according to claim 1 is characterized in that: Comparing the risk warning score of the corresponding risk warning client with a preset risk score threshold to determine whether there is a corresponding risk, including: Setting an initial threshold range for the risk warning score; During the training of the SCNor-Transformer model, determining an optimal threshold as the preset risk score threshold based on a dynamic threshold search method according to the initial threshold range; The risk warning score is compared with the optimal threshold, and when the risk warning score is greater than the optimal threshold, a risk warning is issued.

8. The method for early warning of multi-category urban safety risks based on a federated hypernetwork according to claim 1 is characterized in that: Several risk warning clients include an earthquake risk warning client, a gas leakage risk warning client, a flood risk warning client and a fire risk warning client. The historical data corresponding to the earthquake risk warning client is the historical data collected through the magnitude sensor, the historical data corresponding to the gas leakage risk warning client is the historical data collected through the gas sensor, the historical data corresponding to the flood risk warning client is the historical data collected through the water level sensor, and the historical data corresponding to the fire risk warning client is the historical data collected through the far infrared sensor and the video monitoring equipment.

9. The method for early warning of multi-category urban safety risks based on a federated hypernetwork according to claim 1 is characterized in that: Generating a directed acyclic graph based on a root cause location algorithm according to each of the risk warning scores corresponding to the input sequence of the risk warning client at each moment, obtaining a ranking list according to the directed acyclic graph, and obtaining a risk diagnosis result from the ranking list, including: Connecting the risk warning scores of each input sequence to construct a directed acyclic graph, wherein a node of the directed acyclic graph represents an input sequence having the risk warning score, and an edge of the directed acyclic graph represents a causal relationship between the input sequences; Assigning a causal relationship score to each node of the directed acyclic graph based on the PageRank algorithm, is the probability score of node a moving to node b, is the weight of the edge from node a to node b. If there is no clear weight, it can be assumed that the weights of all edges are equal, and finally a transition probability matrix is ​​obtained. The following is a detailed description of the PageRank algorithm: Iteratively update the causality score: Among them, PR(a) is the causal score of node a, d is the damping factor, L(b) is the out-degree of node b, that is, the number of connections from node b, and m represents the number of nodes; Finally, based on the order of causality scores from high to low, the input sequence with the highest score is determined as the root cause.

10. A system for the city multi-category safety risk early warning method based on a federated hypernetwork as claimed in any one of claims 1 to 9, characterized in that: include: Different sensor groups are deployed in various areas of the city corresponding to the risks: used to collect sensor data corresponding to the risks in real time and store the sensor data in a data server; Risk warning client: configured with a preset SCNor-Transformer model as a local model, the SCNor-Transformer model is used to process the input through a sequence normalization layer, a sequence conversion layer, an encoder, a feature mapping layer, and a sequence denormalization layer in sequence to obtain an output, and the SCNor-Transformer model is used to send model parameters, and the model parameters are obtained by training the SCNor-Transformer model with historical data collected by the sensor group corresponding to the risk; The base station edge computing unit is used to communicate with each of the risk warning clients, including a super network, a risk warning module and a risk diagnosis module, wherein the super network is used to update the model parameters corresponding to each of the risk warning clients to obtain the updated parameters, and the risk warning module is used to obtain the risk warning score output by the updated model corresponding to each of the risk warning clients, the updated model is the model obtained by updating the SCNor-Transformer model according to the updated parameters, and the risk warning score is the output obtained by inputting the real-time data collected by the sensor group into the updated model, and the risk warning module is used to compare the risk warning score of the corresponding risk warning client with a preset risk score threshold to determine whether there is a corresponding risk, and output a risk warning result, and the risk diagnosis module is used to generate a directed acyclic graph based on the root cause location algorithm according to each of the risk warning scores corresponding to the input sequence of the risk warning client at each moment, obtain a ranking list according to the directed acyclic graph, and obtain a risk diagnosis result from the ranking list; Emergency cloud service platform: used to receive risk warnings and risk diagnosis results transmitted by each base station, and perform warning and response services.

Images