Alarm convergence method and device for abnormal events in rural human settlement environment, and medium

Abstract

The invention discloses a rural human settlement environment abnormal event alarm convergence method and device, and a medium. The method comprises the steps of data acquisition, data preprocessing and feature selection; the method comprises the following steps: independently executing a feature extraction process for input data from multiple sources, and eliminating redundant information by utilizing a Filter and embedded combined algorithm; the alarm data after preprocessing and feature selection are input into a machine learning fusion model, independent training and prediction are carried out through three different classifiers of SVM, KNN and Random Forest, and an Apache Flink stream processing framework is adopted to be in butt joint with an Internet of Things (IoT) alarm data stream screened by a pre-trained classifier; according to the method, the Flink stream processing technology is adopted, so that the alarm system can complete data processing in an extremely short time, the problem that time consumed for processing real-time data in a traditional technology is too long is effectively solved, the state change of an alarm event is reflected in real time, and convergence judgment is rapidly made.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a method, device and storage medium for alarm convergence of abnormal events in rural living environments. Background Art

[0002] With the deep integration of modern information technology, IoT sensor networks are widely deployed across rural areas, providing real-time monitoring and data collection for a wide range of environmental indicators, including but not limited to the operational status of waste disposal facilities, sewage treatment effectiveness, air quality indexes, and infrastructure availability. However, faced with the massive data streams generated by this large and complex monitoring system, the frequent occurrence of various potential environmental anomaly alerts can easily trigger an "avalanche effect" of alarm signals, leading to information overload. This makes it difficult for operations and maintenance personnel to quickly identify and prioritize truly urgent and important issues amidst the complex array of alerts, reducing work efficiency and potentially delaying decision-making.

[0003] The relevant terms are explained as follows:

[0004] SVM, short for Support Vector Machine, is an algorithm widely used in machine learning tasks such as classification, regression, and anomaly detection. The core idea of ​​SVM is to map data into a high-dimensional feature space and then find a hyperplane in this space (a line in two-dimensional space, a plane in three-dimensional space, and so on) that separates different classes of data while maximizing the margin (i.e., the margin) between the two classes. In SVM, data points are classified into two categories: support vectors and non-support vectors. Support vectors are the points closest to the hyperplane and determine the position of the hyperplane. Non-support vectors, on the other hand, have little influence on the position of the hyperplane. Because SVM relies solely on support vectors, it possesses excellent robustness and generalization capabilities, performing well even with high-dimensional data or a small number of samples. A key advantage of SVM is its use of the kernel trick to handle nonlinear problems. By mapping data into a higher-dimensional feature space, SVM can handle nonlinearly separable datasets. Furthermore, SVM has the advantages of low computational complexity and small memory usage. KNN, short for K-Nearest Neighbor, is a basic machine learning classification and regression method. The core idea of ​​the KNN algorithm is that if a majority of a sample's k nearest neighbors in a feature space belong to a particular category, then the sample also belongs to that category. Simply put, "birds of a feather flock together." The KNN algorithm can be used for both classification and regression. In classification problems, KNN uses a majority voting method to make predictions, selecting the category that appears most frequently among the K nearest neighbor samples as the prediction result. In regression problems, KNN uses an averaging method, calculating the average of the target variable across the K nearest neighbor samples as the prediction result. The advantages of the KNN algorithm are that it is simple to understand, does not require model training, and is applicable to a wide range of data types.

[0005] Random Forest, also known as Random Forest in Chinese, is a classifier that consists of multiple decision trees. Its output category is determined by the majority of the categories output by the individual trees. Each decision tree is a classifier, so a random forest actually has multiple classifiers. For classification problems, the random forest classifier uses a voting process where the minority obeys the majority, and the category with the most votes is designated as the final output. For regression problems, the random forest algorithm takes the average of the predictions from all decision trees as the final output.

[0006] Random forests have many advantages, such as being able to handle very high-dimensional (many features) data without feature selection; being able to determine which features are more important after training; using an unbiased estimate of the generlization error when creating a random forest; fast training speed and the ability to detect interactions between features; being easy to parallelize; and being relatively simple to implement.

[0007] Flink is a high-performance, distributed stream processing framework that supports both batch and stream processing and provides a rich set of APIs and libraries. It implements asynchronous messaging based on Akka, supports Extractor-once semantics and checkpointing for stateful computation, and offers lightweight fault-tolerance, high throughput, and low latency. Flink is suitable for a variety of real-time data processing scenarios, such as event-driven applications, data analysis applications, and data pipeline applications. Through flexible windowing, state management, and efficient resource utilization, Flink can process large-scale data streams and provide real-time analysis and decision support. Summary of the Invention

[0008] The present invention proposes a method, device and storage medium for convergence of alarms for abnormal events in rural residential environments, which can solve at least one of the technical problems in the background technology.

[0009] To achieve the above object, the present invention adopts the following technical solutions:

[0010] A method for converging alarms for abnormal events in rural residential environments, comprising executing the following steps via a computer device:

[0011] S1. Collect diversified and high-dimensional raw alarm data from real-time IoT device reports, and perform data preprocessing and feature selection.

[0012] S2, independently perform feature extraction process for input data from multiple sources, and use filter and embedded combination algorithm to eliminate redundant information;

[0013] S3: Input the alarm data that has undergone preprocessing and feature selection in step S2 into the machine learning fusion model. Three different classifiers, SVM, KNN, and Random Forest, are independently trained and predicted. The outputs of the three classifiers are then integrated using a voting method to determine whether an alarm event is generated. The final fused detection result is then fed into the Flink stream processing engine for further processing.

[0014] S4. Use the Apache Flink stream processing framework to connect to the IoT alarm data stream filtered by the pre-trained classifier;

[0015] S5. Apply the sliding window operator to the partitioned data stream to converge the alarm events, prevent alarms from being too frequent, filter out false alarms, and improve the accuracy of alarms.

[0016] Furthermore, step S3 specifically includes:

[0017] S31, select the current three classifiers SVM, KNN, Random Forest to predict the results of any sample X, respectively C SVM(x) , C KNN(x) , C RF(X) ;

[0018] S32, take the prediction result of each classifier as a new feature vector, and construct vector F for sample x. x =(C SVM(x) ,C KNN(x) ,C RF(X) );

[0019] S33. For each category C k ,k∈all possible categories, according to formula (1) statistics in F x The category label that appears most frequently in the prediction is sent to Flink as the final prediction result.

[0020]

[0021] In the above formula, H(x) represents the decision function, and argmax represents the selection of the maximum internal sum C j , and δ(C i =C j ) is the indicator function, when C i =C j Returns 1 if yes, otherwise returns 0.

[0022] Furthermore, step S4 specifically includes:

[0023] First, the Map operator is used to deconstruct and standardize the batch input alarm data. This process is like opening a letter and organizing its contents into a unified format. This ensures that each alarm record contains all relevant key attribute information: the device's unique identifier (deviceId), the alarm occurrence timestamp accurate to the millisecond level (timestamp), the alarm level (alertLevel) reflecting the alarm severity, the alertType that distinguishes different alarm types, the grid_code representing the device's geographic location, the device_category identifying the device's category, and the event code (event_code) detailing the nature of the alarm event.

[0024] Next, to aggregate and centrally process similar events, we use the keyBy operator in Flink to partition the data stream based on the event code (event_code) and the device location (grid_code). This ensures that all alarm instances with the same event code and device location are routed to the same concurrent task execution unit, facilitating efficient merging and statistical analysis of similar alarm events.

[0025] Furthermore, step S4 specifically includes:

[0026] Through Flink's union operator, different source data streams with the same event code and device location are merged to form a comprehensive alarm event stream, facilitating centralized monitoring and intelligent convergence of specific types of alarm events from a global system perspective.

[0027] Furthermore, step S5 specifically includes:

[0028] Count the time intervals between alarm events of each device, and record the cumulative number of consecutive occurrences of the same alarm type;

[0029] The alertConvergenceScore value is calculated according to formula (2), and a convergence threshold standard is set. Once the alarm convergence metric exceeds this threshold, it means that the secondary alarm event meets the standard. At this time, the system generates an event record representing the alarm convergence and sends it to the downstream system through the Sink interface for the next step of operation;

[0030]

[0031] In formula (2), alertConvergenceScore represents the alarm convergence index, intervalToLastAlert represents the time interval between consecutive identical alarm events, minInterval is the set minimum interval threshold to prevent the index from being too high due to a too short interval, and consecutiveSameAlertCount represents the number of consecutive alarms of the same type.

[0032] In another aspect, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0033] On the other hand, the present invention further discloses a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0034] It can be seen from the above technical solutions that, in view of the problems reported by the background technology, Apache Flink, as an advanced stream processing framework, has excellent real-time data processing capabilities, flexible time window mechanism and large-scale distributed computing advantages, which provide a solid foundation for solving such challenges. The present invention is used for the alarm convergence method and system for abnormal events in rural human settlements. It is precisely with the help of the powerful functions of Flink that a system for intelligent convergence alarms for abnormal events in rural human settlements is designed. The system integrates and uses machine learning models such as SVM (support vector machine), KNN (K nearest neighbor algorithm) and Random Forest. By performing refined screening, deep correlation analysis and aggregation operations on massive real-time environmental data, it can accurately lock the source of the problem, cleverly suppress non-core alarms, and quickly reveal the root cause of environmental anomalies, thereby effectively promoting the modernization of the rural human settlement environment governance system and governance capabilities, and significantly enhancing the emergency response speed and decision-making accuracy of environmental problems.

[0035] Given the limitations of traditional data processing technologies for multi-event correlation analysis, this paper proposes an innovative approach that integrates heterogeneous data from multiple sources, including but not limited to business systems and IoT devices, to achieve efficient and accurate analysis of event correlation relationships. This approach leverages the real-time computing engine Apache Flink, enabling real-time processing of massive amounts of concurrent data while ensuring sub-second performance when combined with large-scale static table data. It is suitable for real-time data interaction with big data components such as Hadoop, Spark, and Hive; relational databases such as MySQL and Oracle; unstructured databases such as Redis and ES; and IoT devices such as smart trash can sensors, odor detectors, and water quality monitors.

[0036] The core innovation of this invention lies in the design of a real-time stream processing architecture that is compatible with multiple data sources. By integrating selectors such as SVM, KNN and Random Forest, it can not only process single events efficiently and accurately, but also effectively identify and aggregate alarm information in multi-event related scenarios. For example, when the alarm of a smart trash can overflowing and the odor detector in the related area monitoring exceeding the standard occur at the same time, a comprehensive alarm is triggered by calculating the alarm convergence index, which greatly improves the accuracy of the alarm system and user perception.

[0037] Specifically, the advantages of the present invention are as follows:

[0038] By integrating learning models and feature optimization methods, the accuracy of IoT device alarm data classification has been significantly improved, and the scope of model application scenarios has been broadened.

[0039] The use of Flink stream processing technology enables the alarm system to complete data processing in a very short time, effectively solving the problem that traditional technologies take too long to process real-time data. It can immediately reflect the status changes of alarm events and quickly make convergence judgments.

[0040] Through real-time convergence assessment and alarm suppression strategies, meaningless repeated alarms are reduced, and the practicality of the alarm system and user experience are improved.

[0041] It supports the aggregation and fusion of event sources, reduces the redundant representation of alarm events, and is conducive to the rational use of resources and the improvement of the overall efficiency of the system.

[0042] The built-in Flink fault recovery mechanism ensures that the alarm processing system can continue to operate normally when encountering a fault, ensuring the continuity and reliability of data processing services.

[0043] The technical solution of the present invention demonstrates superior performance in real-time business scenarios, not only having low data processing latency but also being able to cope with the high throughput requirements of large-scale data streams.

[0044] This technical feature enables efficient processing of real-time data, with the characteristics of low latency and high throughput, and can meet the real-time requirements of data processing in real-time business scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flowchart of the present invention;

[0046] Figure 2 This is the Flink sliding window implementation process of an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0048] The method for converging alarms for abnormal events in rural residential environments according to an embodiment of the present invention comprises the following steps:

[0049] Step 1: Data preprocessing and feature selection. First, collect diversified and high-dimensional raw alarm data from the real-time IoT device reported data. Due to the large number of dimensions of the original features, it may burden the performance of the subsequent classifier, and not all features are decisive for identifying alarm events. Therefore, the embodiment of the present invention uses Filter and embedded combined algorithms to effectively remove redundancy and refine feature selection on the alarm data, thereby refining the key feature set, as shown in Table 1. These selected feature data are sent to the machine learning fusion model containing three classifiers: SVM, KNN, and Random Forest for training and learning.

[0050]

[0051] Table 1

[0052] Step 2: Independently perform feature extraction on the input data from multiple sources, using filters and embedded combination algorithms to remove redundant information and generate a streamlined feature set as shown in Table 1. During this process, a portion of representative data is labeled and used as training samples to improve the model's generalization and accuracy.

[0053] Step 3: The alarm data that has undergone preprocessing and feature selection in Step 2 is input into the machine learning fusion model. Three different classifiers, SVM, KNN, and Random Forest, are independently trained and predicted. The output results of the three classifiers are then integrated using a voting method to determine whether an alarm event has been generated. The final fused detection result is then sent to the Flink stream processing engine for further processing. The principle is as follows:

[0054] 1. Select the current three classifiers SVM, KNN, and Random Forest to predict the results of any sample X as C SVM(x) , C KNN(x) , C RF(X) .

[0055] 2. Take the prediction results of each classifier as a new feature vector. For sample x, construct vector F x =(C SVM(x) ,C KNN(x) ,C RF(X) )

[0056] 3. For each category C k (k∈all possible categories), according to formula (1), statistics in F x The category label with the most occurrences in the category is sent to Flink as the final prediction result.

[0057]

[0058] In the above formula, H(x) represents the decision function, and argmax represents the selection of the maximum internal sum C j , and δ(C i =C j ) is the indicator function, when C i =C j Returns 1 if yes, otherwise returns 0.

[0059] Step 4: Use the Apache Flink stream processing framework to connect to the IoT alarm data stream, filtered by the pre-trained classifier. First, use the Map operator to deconstruct and standardize the batch input alarm data. This process is similar to opening a letter and organizing the contents into a unified format. This ensures that each alarm record contains several key attributes, including but not limited to the device unique identifier (deviceId), the millisecond-accurate alarm occurrence timestamp (timestamp), the alarm level (alertLevel) reflecting the alarm severity, the alertType distinguishing different alarm types, the grid_code representing the device's geographic location, the device_category identifying the device's category, and the event code (event_code) detailing the nature of the alarm event.

[0060] Next, to aggregate and centrally process similar events, we use Flink's keyBy operator to partition the data stream based on the event code (event_code) and device location (grid_code). This ensures that all alarm instances with the same event code and device location are routed to the same concurrent task execution unit. This allows for efficient merging and statistical analysis of similar alarm events.

[0061] Furthermore, through Flink's union operator, the system merges data streams from different sources with the same event code and device location to form a comprehensive alarm event stream, facilitating centralized monitoring and intelligent convergence of specific alarm types from a global system perspective. This series of operations constitutes a key implementation step of the patented core technology, effectively improving the real-time processing capabilities for abnormal events in rural living environments and achieving precise integration and focus of alarm information.

[0062] Step 5: Apply the sliding window operator to the partitioned data stream, such as Figure 2As shown, the convergence of alarm events is carried out to prevent alarms from being too frequent. That is, by adjusting the sliding window size and the convergence scoring algorithm parameters, the system can flexibly respond to changes in alarm modes in different scenarios, judge and filter out false alarms, and improve the accuracy of alarms. That is, the alarms are classified and summarized in combination with geographic location information, which enhances the overall grasp of abnormal conditions in large-scale distributed environments. The adjacent time intervals between the alarm events of each device are counted, and the cumulative number of consecutive occurrences of the same alarm type is recorded. The alertConvergenceScore value is calculated according to formula (2), and an appropriate convergence threshold standard is set. Once the alarm convergence metric exceeds this threshold, it means that the alarm event meets the standard. At this time, the system generates an event record representing the alarm convergence and sends it to the downstream system through the Sink interface for the next step.

[0063]

[0064] In the above formula, alertConvergenceScore represents the alarm convergence index, intervalToLastAlert represents the time interval between consecutive identical alarm events, minInterval is the set minimum interval threshold to prevent the index from being too high due to a too short interval, and consecutiveSameAlertCount represents the number of consecutive alarms of the same type.

[0065] The following examples illustrate:

[0066] like Figure 1 As shown, in step 1, the raw alarm data generated by IoT devices undergoes feature selection and preliminary filtering. This initial filtering is performed using classifiers such as SVM, KNN, and Random Forest. This embodiment of the present invention generates two types of alarm events with specific event codes: smart trash bin overflow alarms and water quality monitor pH exceeding alarms. Each alarm event carries the following key attributes: device ID (deviceId), alarm timestamp (timestamp), alarm level (alertLevel), alarm type (alertType), device location (grid_code), device category (device_category), and event code (event_code). To facilitate sliding window processing, this embodiment of the present invention assigns alarm events with the same event code and device location to the same data stream using Flink's keyBy operator, allowing similar alarm events to be aggregated and processed within the same window. In this example, the two different types of alarm events (smart trash bin overflow alarms and water quality monitor pH exceeding alarms) are aggregated separately and not merged together.

[0067] Step 2: The specific aggregation method uses the time window of the flink program. For example, the size of each time window is defined as 10 minutes. The device ID is grouped using KeyedStream to ensure that the alarm data of each device is independently aggregated. When the time exceeds the end time of the window, the aggregation calculation is triggered, and all data in the time window can be obtained. The number of alarm events for each device is counted, and then based on the alarm count consecutiveSameAlertCount and the last alarm time of the device (the last alarm time of each device is maintained in the flink program) to the current time interval intervalToLastAlert, the above two calculation parameters are substituted into the above formula to calculate the alarm index of each device. If the alarm convergence index exceeds the set alarm convergence index, an alarm convergence event will be triggered. The corresponding device alarm urgency is relatively high and alarm processing is required. By analyzing this formula, it can be known that the larger the consecutiveSameAlertCount is, the larger the calculated alarm index is, which means the higher the alarm level is. Another metric, intervalToLastAlert, represents the time interval since the last alert. If an event triggers alerts frequently, even if the alert level is high, triggering multiple similar alerts in a short period of time is unnecessary and can cause inconvenience to business processing personnel. To prevent multiple triggering of the same or similar alerts in a short period of time, a minimum alert interval parameter, minInterval, is set.

[0068] In summary, the embodiments of the present invention have the following features:

[0069] 1. This paper constructs a unique ensemble learning model for processing IoT device alarm data by integrating multiple machine learning algorithms, including support vector machines (SVM), k-NN, and random forests. This model effectively improves classification accuracy by performing feature selection and de-redundancy processing on raw data, enhancing its universality and robustness across diverse scenarios and overcoming the limitations of single-model applications.

[0070] 2. This paper introduces the Apache Flink stream processing framework to achieve real-time and efficient data processing. Its innovation lies in the design of an algorithm (shown in Formula 2) that dynamically evaluates the convergence status of alarm events. When the alarm convergence indicator reaches a preset threshold, the system can determine in real time whether the alarm has converged and automatically suppress redundant alarms, thereby significantly improving the response speed and accuracy of the alarm system and enhancing user perception.

[0071] 3. This paper proposes a method for aggregating and fusing event sources using Flink, which can identify and merge event sources with common characteristics to form a unified event representation, thereby improving the integration and consistency of alarm data processing.

[0072] 4. This invention proposes a fault recovery mechanism using Flink in a distributed environment to ensure the correctness and integrity of data processing even in abnormal situations such as node failure or network interruption, thereby enhancing the robustness of the alarm system in the face of unforeseen problems.

[0073] In another aspect, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0074] On the other hand, the present invention further discloses a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0075] In another embodiment provided by the present application, a computer program product comprising instructions is also provided, which, when executed on a computer, enables the computer to execute any one of the above-mentioned embodiments for the alarm convergence method for abnormal events in rural living environments.

[0076] It is understandable that the system, device and storage medium provided in the embodiments of the present invention correspond to the method provided in the embodiments of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts of the above methods.

[0077] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0078] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0079] Each embodiment in this specification is described in a related manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiment is generally similar to the method embodiment, so the description is relatively simple. For related parts, refer to the description of the method embodiment.

[0080] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for alarm convergence of abnormal events in rural human settlement environment, characterized in that: The following steps are included: S1. Collect diversified and high-dimensional raw alarm data from real-time IoT device reporting data, and perform data preprocessing and feature selection; S2, independently perform feature extraction process for input data from multiple sources, and use filter and embedded combined algorithm to eliminate redundant information; S3: Input the alarm data that has been preprocessed and feature selected in step S2 into the machine learning fusion model, and perform independent training and prediction through three different classifiers: SVM, KNN, and Random Forest. Then, the voting method is used to integrate the output results of the three classifiers to finally determine whether an alarm event is generated. The final detection result after fusion processing is sent to the Flink stream processing engine for the next step of processing. S4, using the Apache Flink stream processing framework to connect to the IoT alarm data stream that has been filtered by the pre-trained classifier; S5. Apply the sliding window operator Sliding Window to the partitioned data stream to converge the alarm events, prevent the alarms from being too frequent, filter out false alarms, and improve the accuracy of alarms.

2. The method for alarm convergence of abnormal events in rural living environment according to claim 1 is characterized in that: Step S3 specifically includes: S31, select the current three classifiers SVM, KNN, Random Forest to predict the results of any sample X respectively C SVM(x) , C KNN(x) , C RF(X) ; S32, take the prediction result of each classifier as a new feature vector, and construct vector F for sample x x =(\ SVM(x) ,C KNN(x) ,C RF(X) ); S33. For each category C k , k∈ all possible categories, according to formula (1), statistics in F x The category label with the most occurrences in the category is sent to Flink as the final prediction result; In the above formula, H(x) represents the decision function, argmax represents the selection of the maximum internal and j , and δ(\ i =\ j ) is the indicator function, when \ i =C j Returns 1 if true, otherwise returns 0.

3. The method for alarm convergence of abnormal events in rural human settlement environment according to claim 1 is characterized in that: Step S4 specifically includes: First, the Map operator is used to deconstruct and standardize the batch input alarm data. This process is like opening a letter and organizing the content into a unified format, ensuring that each alarm record contains complete key attribute information: the device unique identifier deviceId, the alarm occurrence timestamp accurate to milliseconds, the alarm level alertLevel reflecting the severity of the alarm, the alertType distinguishing different alarm types, the grid_code representing the geographical location information of the device, the device_category identifying the category to which the device belongs, and the event code event_code detailing the nature of the alarm event. These are indispensable fields. Next, in order to achieve the aggregation and centralized processing of similar events, the keyBy operator in Flink is used to partition the data stream according to the event code event_code and the device location grid_code, ensuring that all alarm instances with the same event code and device location are routed to the same concurrent task execution unit, facilitating the subsequent efficient merging and statistical analysis of the same type of alarm events.

4. The method for alarm convergence of abnormal events in rural human settlement environment according to claim 3 is characterized in that: Step S4 specifically also includes: Through Flink's union operator, different source data streams with the same event code and device location are merged to form a comprehensive alarm event stream, which facilitates centralized monitoring and intelligent convergence of specific types of alarm events from a global perspective of the system.

5. The method for alarm convergence of abnormal events in rural living environment according to claim 1 is characterized in that: Step S5 specifically includes: Count the adjacent time intervals between alarm events of each device, and record the cumulative number of consecutive occurrences of the same alarm type; The alertConvergenceScore value is calculated according to formula (2), and a convergence threshold standard is set. Once the alarm convergence metric value exceeds this threshold, it means that the secondary alarm event meets the standard. At this time, the system generates an event record representing the alarm convergence and sends it to the downstream system through the Sink interface for the next step of operation; In formula (2), alertConvergenceScore represents the alarm convergence index, intervalToLastAlert represents the time interval of consecutive same alarm events, minInterval is the set minimum interval threshold to prevent the index from being too high due to the interval being too short, and consecutiveSameAlertCount represents the number of consecutive alarms of the same type.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 5.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the computer program is executed by the processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 5.

Images