Energy supply station security protection method and system based on edge computing

Abstract

The present invention relates to the field of data processing, and specifically provides a method and system for protecting the safety of energy supply stations based on edge computing. By acquiring the monitoring flow data of the target edge computing node, the monitoring flow data is input into the flow monitoring intelligent body to obtain the abnormal flow monitoring result. The abnormal flow monitoring result includes the abnormal data range, core abnormal data items, abnormal types corresponding to the abnormal data items, and abnormal support corresponding to the abnormal types obtained from the monitoring flow data. When training the flow monitoring intelligent body, each sub-model is trained separately, and then combined for collaborative training, and monitoring flow annotation data is generated based on the abnormal flow monitoring results and the monitoring flow data. The present invention can realize data detection, type detection and core abnormal data item detection with only one flow monitoring intelligent body, which can reduce the complexity of edge computing and reduce cost consumption.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a method and system for protecting energy supply stations based on edge computing. Background Art

[0002] With the rapid development of Internet of Things technology, edge computing, as a distributed computing architecture, plays an increasingly important role in the security protection of key infrastructure such as energy supply stations. Edge computing significantly reduces data latency and improves processing efficiency by pushing computing power and data storage to the edge of the network, that is, closer to the data source, making it possible to monitor and analyze data flows in and out of energy supply stations in real time. However, in a complex network environment, energy supply stations face challenges from various potential security threats, such as data tampering, malicious attacks, and equipment failures. These threats may cause data anomalies, which in turn affect the normal operation and security of energy supply stations.

[0003] Traditional security protection methods usually rely on a single security strategy or model, such as rule-based intrusion detection systems or statistical-based anomaly detection methods. These methods often have problems such as low detection accuracy, high false alarm rate and poor adaptability when dealing with complex and changeable abnormal traffic. In particular, when faced with new attack methods or unknown abnormal patterns, traditional methods are often difficult to deal with effectively. In addition, these methods usually require a lot of computing resources and time for data processing and analysis, which increases the complexity and cost consumption of edge computing. In order to overcome the limitations of traditional methods, in recent years, machine learning technology, especially deep learning technology, has shown great potential in the field of abnormal traffic detection. By constructing a neural network model, machine learning can automatically learn the inherent laws and characteristics of data from a large amount of data, thereby realizing accurate identification and classification of abnormal traffic. However, directly applying existing machine learning models to abnormal traffic detection in edge computing environments still faces many challenges. First, the computing resources and storage capacity of edge computing nodes are limited, making it difficult to support the training and reasoning of complex models. Second, the traffic data of different energy supply stations are diverse and heterogeneous, requiring the model to have good generalization and adaptability. Summary of the invention

[0004] The purpose of the present invention is to provide an energy supply station safety protection method and system based on edge computing. The present invention is implemented as follows:

[0005] In a first aspect, the present invention provides a method for protecting energy supply stations based on edge computing, comprising: obtaining monitoring flow data of a target edge computing node, wherein the target edge computing node is an edge computing node deployed at an energy supply station, and the monitoring flow data is a data flow entering and leaving the energy supply station during a target monitoring period; inputting the monitoring flow data into a flow monitoring intelligent body to obtain abnormal flow monitoring results, wherein the abnormal flow monitoring results include the abnormal data range, core abnormal data items, abnormal types corresponding to the abnormal data items, and abnormal support corresponding to the abnormal types obtained from monitoring the monitoring flow data, and the flow monitoring intelligent body is an initialization monitoring intelligent body. The neural network obtained by training the initialization monitoring intelligent agent, the initialization monitoring intelligent agent includes an initialization monitoring sub-model, an initialization core abnormal data item monitoring sub-model and an initialization classification sub-model, when the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model are separately trained and converged, the initialization monitoring intelligent agent is collaboratively trained to obtain the flow monitoring intelligent agent; based on the abnormal flow monitoring result and the monitoring flow data, monitoring flow annotation data is generated, wherein the monitoring flow annotation data has the following tags: the abnormal data range, the core abnormal data item, the abnormal type and the support corresponding to the abnormal type.

[0006] In a second aspect, the present invention provides a computer system comprising: one or more processors; a memory; one or more computer programs; wherein the one or more computer programs are stored in the memory and configured to be executed by the one or more processors, and when the one or more computer programs are executed by the processors, the method as described above is implemented.

[0007] The present invention obtains the monitoring flow data of the target edge computing node. The monitoring flow data is input into the flow monitoring agent to obtain the abnormal flow monitoring result, wherein the abnormal flow monitoring result includes the abnormal data range, the core abnormal data item, the abnormal type corresponding to the abnormal data item, and the abnormal support corresponding to the abnormal type obtained from the monitoring flow data. The flow monitoring agent is a neural network obtained by training the initialization monitoring agent. The initialization monitoring agent includes an initialization monitoring sub-model, an initialization core abnormal data item monitoring sub-model, and an initialization classification sub-model. When the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model, and the initialization classification sub-model are separately trained and converged, the initialization monitoring agent is collaboratively trained to obtain the flow monitoring agent. Based on the abnormal flow monitoring result and the monitoring flow data, the monitoring flow annotation data is generated, wherein the monitoring flow annotation data has the following tags: abnormal data range, core abnormal data item, abnormal type, and the support corresponding to the abnormal type. The initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model, and the initialization classification sub-model in the initialization monitoring agent are trained separately, and the three different neural networks in the initialization monitoring agent are collaboratively trained to obtain the flow monitoring agent. After the monitoring traffic data passes through the traffic monitoring intelligent agent, the abnormal traffic monitoring results are output. At the same time, the monitoring traffic annotation data is generated based on the monitoring traffic data. By inputting the monitoring traffic data, only one traffic monitoring intelligent agent can be used to realize data detection, type detection and core abnormal data item detection, which can reduce the complexity of edge computing and reduce cost consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for describing the embodiments of the present invention are briefly introduced below.

[0009] Figure 1 It is a flow chart of a method for protecting energy supply stations based on edge computing provided in an embodiment of the present invention.

[0010] Figure 2 It is a schematic diagram of the composition of a computer system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0011] The following describes the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. The terms used in the implementation method part of the embodiments of the present invention are only used to explain the specific embodiments of the present invention, and are not intended to limit the present invention.

[0012] In the embodiment of the present invention, the executor of the energy supply station security protection method based on edge computing is a computer system, including but not limited to servers, personal computers, laptops, etc.

[0013] like Figure 1 As shown, the method includes:

[0014] Step S110: Acquire monitoring flow data of a target edge computing node, where the target edge computing node is an edge computing node deployed at an energy supply station, and the monitoring flow data is the data flow entering and leaving the energy supply station during a target monitoring period.

[0015] In step S110, the target edge computing nodes refer to computing devices deployed in a specific geographical location, namely, an energy refueling station. Edge computing is a distributed computing architecture that pushes computing and data storage capabilities to the edge of the network, that is, closer to the data source, thereby reducing data latency and improving processing efficiency. In the scenario of an energy refueling station, edge computing nodes are, for example, one or more high-performance servers, small data centers, or dedicated edge computing devices, which are installed inside or near the refueling station to process data flows in and out of the refueling station in real time.

[0016] As an infrastructure, energy refueling stations provide energy refueling services for various devices (such as electric vehicles, drones, etc.). During the charging or refueling process, these devices interact with the refueling station's system and generate a large amount of data streams. These data streams contain a variety of information such as device information, charging status, transaction records, timestamps, etc., which are crucial for the safe operation and efficient management of refueling stations. In order to ensure the security and integrity of this data and to detect potential abnormal behaviors in a timely manner, these data streams need to be monitored and analyzed in real time.

[0017] Monitoring flow data is the collection of all data flows that enter and exit the energy refueling station within a specific time period (i.e., the target monitoring period). These data flows can be in the form of network packets, sensor readings, transaction records, etc., which record all interactions between devices and the refueling station system. For example, when an electric car enters a refueling station to start charging, its vehicle identification number (VIN), battery status, expected charging time, and other information will be recorded by the system to form a data flow. Similarly, when charging is completed, payment information, charging amount, etc. will also be recorded to form another data flow. All these data flows are continuously collected during the target monitoring period and constitute the main body of monitoring flow data. The target monitoring period refers to a period of time set by the computer system to determine which data should be collected and analyzed. This period can be fixed (such as hourly, daily, or weekly) or dynamically adjusted according to actual conditions. For example, during peak hours (such as at night or on weekends), due to the increase in the number of devices entering and leaving the refueling station, the data flow will also increase accordingly. At this time, the monitoring period can be shortened to collect and analyze data more frequently. Conversely, during off-peak periods, the monitoring cycle can be extended to reduce the amount of data processing while maintaining sensitivity to key abnormal behaviors.

[0018] In the process of obtaining monitoring traffic data, the computer system communicates with the edge computing node to collect data in real time or quasi-real time. For example, it involves multiple aspects such as network protocols, data transmission formats, and data storage mechanisms. For example, the edge computing node may establish a connection with the computer system through the TCP / IP protocol, transmit data in formats such as JSON or XML, and store the data in a local database or cloud storage service. The computer system obtains the latest monitoring traffic data from the edge computing node through API calls, polling, or event-driven methods.

[0019] After acquiring the monitored traffic data, the computer system pre-processes it, such as data cleaning, format conversion, and feature extraction, for subsequent analysis and processing.

[0020] Step S120: input the monitored traffic data into the traffic monitoring agent to obtain abnormal traffic monitoring results, wherein the abnormal traffic monitoring results include the abnormal data range, core abnormal data items, abnormal types corresponding to the abnormal data items, and abnormal support corresponding to the abnormal types obtained from the monitored traffic data. The traffic monitoring agent is a neural network obtained by training the initialized monitoring agent. The initialized monitoring agent includes an initialized monitoring sub-model, an initialized core abnormal data item monitoring sub-model, and an initialized classification sub-model. When the initialized monitoring sub-model, the initialized core abnormal data item monitoring sub-model, and the initialized classification sub-model are separately trained and converged, the initialized monitoring agent is collaboratively trained to obtain the traffic monitoring agent.

[0021] In step S120, the computer system inputs the preprocessed monitoring traffic data into a traffic monitoring agent, which is a carefully designed and trained neural network used to identify and analyze abnormal traffic patterns in the data. The output of the traffic monitoring agent is the abnormal traffic monitoring result, which contains four key elements: abnormal data range, core abnormal data items, abnormal types corresponding to abnormal data items, and abnormal support corresponding to abnormal types. These elements together constitute a comprehensive description of abnormal behavior in the monitoring traffic data, providing an important basis for subsequent security protection and response measures.

[0022] The traffic monitoring agent is obtained through a series of complex training processes for the initial monitoring agent. The initial monitoring agent itself is a complex system that integrates multiple sub-models, including the initial monitoring sub-model, the initial core abnormal data item monitoring sub-model, and the initial classification sub-model. These sub-models each undertake different tasks and work together to achieve a comprehensive analysis of the monitoring traffic data.

[0023] The initialization monitoring sub-model is mainly responsible for detecting abnormal ranges in the data. It can identify data segments that are significantly different from normal traffic patterns by performing feature extraction and pattern recognition on the input data. For example, in an electric vehicle charging scenario, if a vehicle takes an abnormally long time to charge or has an abnormally large amount of charge, these data segments may be marked as abnormal ranges by the initialization monitoring sub-model.

[0024] The initialization core abnormal data item monitoring sub-model goes further into the abnormal range and identifies the most representative and influential abnormal data items. These data items are usually the direct cause of abnormal behavior, so they are important for understanding and responding to abnormal behavior. In the electric vehicle charging scenario, core abnormal data items may include abnormal charging volume, abnormal payment amount, or abnormal vehicle status.

[0025] The initialization classification sub-model is responsible for assigning a specific anomaly type to the abnormal data item and calculating the anomaly support of the type. The anomaly type is a classification description of abnormal behavior, such as "charging fraud" and "equipment failure". The anomaly support is a quantitative indicator used to measure the probability of the anomaly type appearing in the overall data. In the electric vehicle charging scenario, if there are multiple events with abnormally large charging volume and abnormally low payment amount in a certain period of time, the initialization classification sub-model can classify these events as "charging fraud" and calculate a high anomaly support to reflect the prevalence and severity of this fraud.

[0026] In the process of training the traffic monitoring agent, each sub-model in the initialization monitoring agent is trained separately. This means that each sub-model receives training data independently and adjusts its internal parameters to optimize its performance. The purpose of separate training is to ensure that each sub-model can achieve the best performance on its specific task. For example, the initialization monitoring sub-model will receive a large amount of data containing normal and abnormal traffic patterns for training to learn how to accurately identify the abnormal range; the initialization core abnormal data item monitoring sub-model will receive data with labeled abnormal ranges for training to learn how to extract core abnormal data items from them; the initialization classification sub-model will receive data with labeled abnormal types and abnormal support for training to learn how to assign the correct type to the abnormal data items and calculate the support.

[0027] When each sub-model gradually converges and reaches stable performance during the separate training process, the initial monitoring agent begins to be collaboratively trained. Collaborative training is a joint optimization method that allows each sub-model to communicate and collaborate with each other during the training process to further optimize the overall performance. During the collaborative training process, the monitoring traffic data is input into all sub-models at the same time, and their output results are observed. If the output of a sub-model is inconsistent or conflicting with the output of other sub-models, the computer will adjust the parameters of the sub-model to make its output more in line with the overall expectations. Through continuous iteration and optimization, a traffic monitoring agent with excellent performance can eventually be obtained.

[0028] Taking the electric vehicle charging scenario as an example, assume that the computer system has collected a large amount of monitoring traffic data containing normal and abnormal charging behaviors. During the training process, the initialization monitoring sub-model will learn how to identify those data segments with abnormally long charging time or abnormally large charging amount; the initialization core abnormal data item monitoring sub-model will further extract specific abnormal charging behaviors from these abnormal data segments, such as abnormal charging amount or abnormal payment amount; the initialization classification sub-model will assign a specific abnormal type to these abnormal charging behaviors, such as "charging fraud" or "equipment failure", and calculate an abnormal support to reflect the prevalence and severity of this abnormal behavior.

[0029] During the collaborative training process, the computer system inputs new monitoring flow data into the flow monitoring agent and observes its output results. If the flow monitoring agent can accurately identify the abnormal data range, core abnormal data items, and the corresponding abnormal types and abnormal support, it can be considered that it has successfully learned the abnormal flow pattern in the monitoring flow data. At this point, the computer system can deploy the flow monitoring agent to the actual energy supply station for real-time monitoring and analysis of the data flow in and out of the supply station, and timely detection and response to potential security threats. It is worth noting that the performance of the flow monitoring agent depends not only on its internal structure and training process, but also on the quality of the input data and feature selection. Therefore, in practical applications, the computer system continuously optimizes the preprocessing process of the input data to ensure its accuracy and consistency; at the same time, it is necessary to continuously explore and try different feature selection and combination methods to improve the recognition ability and generalization performance of the flow monitoring agent. Through these efforts, the computer system can build a more intelligent, efficient and reliable energy supply station security protection system to provide strong protection for the safe operation of the energy supply station.

[0030] Step S130: Generate monitoring traffic annotation data based on the abnormal traffic monitoring results and the monitoring traffic data, wherein the monitoring traffic annotation data has the following tags: abnormal data range, core abnormal data items, abnormal type and support corresponding to the abnormal type.

[0031] In step S130, the computer system uses the abnormal traffic monitoring results obtained from the traffic monitoring agent and combines the original monitoring traffic data to generate a set of monitoring traffic annotation data. This set of data not only contains key information in the abnormal traffic monitoring results, such as abnormal data range, core abnormal data items, abnormal types and the support corresponding to the abnormal types, but also retains the integrity and context information of the original monitoring traffic data, providing a solid foundation for subsequent in-depth analysis, model optimization and formulation of security protection strategies.

[0032] In step S120, the traffic monitoring agent identifies the abnormal part of the data through in-depth analysis of the monitored traffic data, and annotates the abnormal data range, core abnormal data items, abnormal type and abnormal support in detail. The abnormal data range refers to the specific time period or data segment where the abnormality occurs in the data, which helps the computer system to quickly locate the problem; the core abnormal data items are the data items that contribute the most or are the most representative to the abnormal behavior within the abnormal data range, and they are often the key to understanding the cause of the abnormality and formulating countermeasures; the abnormal type is a classification description of the abnormal behavior, which helps to classify similar abnormal behaviors into one category, which is convenient for subsequent analysis and processing; the abnormal support is a quantitative indicator used to measure the probability of a certain abnormal type appearing in the overall data, which provides a basis for evaluating the prevalence and severity of abnormal behavior.

[0033] In step S130, the computer system integrates this information into the monitoring traffic annotation data. Specifically, for each monitoring traffic data record, the computer system checks whether it belongs to a certain abnormal data range. If so, the abnormal data range, core abnormal data items (if the record happens to be one of the core abnormal data items) and abnormal type corresponding to the record will be marked in the annotation data. At the same time, the computer system will also calculate the corresponding abnormal support for each annotated data based on the calculation formula of the abnormal support (such as a statistically based formula used to measure the proportion or probability of a certain abnormal type appearing in all abnormal records) or the neural network layer (such as a fully connected layer, softmax, etc.).

[0034] Taking the electric vehicle charging scenario as an example, suppose that the traffic monitoring agent discovers a set of abnormal charging behaviors during the monitoring process, in which the charging time of a certain electric vehicle is abnormally long and the charging amount is much greater than the normal level. In this case, the computer system marks the abnormal data range (i.e., the time period from the start to the end of charging of the electric vehicle), the core abnormal data items (such as charging time and charging amount), the abnormal type (such as "overcharging"), and the abnormal support (assuming that the calculation shows that the proportion of this type of abnormality in all abnormal records is 10%) for this charging record in the monitoring traffic annotation data.

[0035] In addition to these basic annotation information, the monitoring system can also add more metadata information to the monitoring traffic annotation data according to actual needs. For example, for each piece of annotated data, the computer system can record its source (such as which edge computing node provides the data), timestamp (the specific time when the data was generated), data quality assessment results (such as indicators such as data completeness and accuracy), etc. This information helps the computer system better understand the context and background of the data and improve the accuracy and efficiency of data analysis and processing.

[0036] In practical applications, monitoring traffic annotation data can be used in many aspects. First, it can be used as part of the training data to further optimize the performance of the traffic monitoring agent. Through continuous iterative training, the computer system can gradually improve the agent's ability and accuracy to identify abnormal traffic. Secondly, the annotation data can also be used to build or update the abnormal behavior knowledge base, providing more comprehensive and accurate abnormal behavior templates and rules for the security protection system. This helps the system to identify and respond to new abnormal behaviors more quickly and accurately for security protection. In addition, the annotation data can also be used for business analysis and decision support. Through in-depth analysis of the annotation data, the computer system can discover potential problems and risk points in business operations, and provide strong data support and decision-making basis for management.

[0037] In one implementation, step S120, inputting the monitored traffic data into the traffic monitoring agent to obtain abnormal traffic monitoring results includes:

[0038] Step S121: input the monitored traffic data into the data encoding sub-model, perform data encoding processing on the monitored traffic data, and obtain a coding feature representation. The traffic monitoring agent includes the data encoding sub-model.

[0039] The monitoring flow data is collected by the edge computing nodes in the energy supply station, which contains the data flow generated by various devices (such as electric vehicles, drones, etc.) entering and leaving the supply station during the charging or refueling process. These data may include multiple fields such as device identification information, charging status, transaction records, timestamps, etc., forming a complex and multi-dimensional data record. However, the original data format is often not suitable for direct input to machine learning models because they may contain redundant information, noise, or inconsistent data structures. Therefore, before the data is input into the subsequent sub-model, appropriate data encoding processing is required.

[0040] The data encoding sub-model is a machine learning model specifically designed to process monitoring traffic data, which can convert the original data into a more compact and meaningful encoded feature representation. This encoded feature representation is usually a low-dimensional vector or matrix, which retains the key information in the original data while removing redundancy and noise, making it easier for subsequent sub-models to extract useful features from it.

[0041] The implementation methods of the data encoding sub-model involve, for example, a variety of machine learning algorithms, such as autoencoders, principal component analysis (PCA) or deep neural networks (DNNs). Taking the autoencoder as an example, it is an unsupervised learning algorithm that learns a low-dimensional representation of the input data by training a neural network. During the training process, the autoencoder attempts to reconstruct its input data while minimizing the reconstruction error. In this way, the autoencoder can learn the key features in the input data and encode it into a low-dimensional vector. In step S121, if the data encoding sub-model is implemented using an autoencoder, the computer system will use the monitored traffic data as input, process it through the encoding layer of the autoencoder, and finally obtain a low-dimensional encoding feature representation as output.

[0042] In the encoded feature representation, each dimension represents a feature or a combination of features in the original data. These features may be a field in the original data (such as the device identification number) or a composite feature obtained through some transformation (such as the ratio of charging time and charging amount). It is important that these features are carefully selected and encoded to maximize the retention of useful information in the original data while removing redundancy and noise.

[0043] Taking the electric vehicle charging scenario as an example, assume that the monitored traffic data contains the following fields: vehicle identification number (VIN), charging start time, charging end time, charging amount (kWh), and payment amount (yuan). In step S121, the data encoding sub-model can convert these fields into a coded feature representation containing several dimensions. Some dimensions may directly correspond to the original fields, such as the vehicle identification number; while other dimensions may be composite features obtained through some transformation, such as charging time (charging end time minus charging start time) or charging rate (charging amount divided by charging time). These coded feature representations will be used as inputs to subsequent sub-models to detect abnormal traffic, identify core abnormal data items, and classify abnormal types.

[0044] It is worth noting that the performance of the data encoding sub-model has an important impact on the accuracy and efficiency of subsequent steps. If the encoded feature representation can well preserve the key information in the original data, then the subsequent sub-model will be able to more easily extract useful features from it, thereby improving the performance of the entire system. Conversely, if the encoded feature representation loses too much information or introduces too much noise, then the subsequent sub-model may not be able to accurately identify abnormal traffic, resulting in a decrease in system performance. Therefore, when designing and training the data encoding sub-model, its structure and parameter selection need to be carefully considered to ensure that it can generate high-quality encoded feature representations.

[0045] Step S122: input the coded feature representation into the target monitoring sub-model, detect abnormal information in the coded feature representation, and obtain the abnormal data range, wherein the traffic monitoring agent includes the target monitoring sub-model.

[0046] The encoded feature representation is the output of the data encoding sub-model after processing the original monitoring flow data. It is a low-dimensional vector or matrix that contains the key information in the original data while removing redundancy and noise. In the electric vehicle charging scenario, the encoded feature representation may include features of multiple dimensions such as vehicle identification number, charging time, charging rate, payment amount, etc. These features are carefully selected and encoded to reflect the key characteristics of charging behavior.

[0047] Next, the target monitoring sub-model comes into play. The target monitoring sub-model is an important component of the traffic monitoring agent, which is responsible for detecting anomalies in the encoded feature representation. Anomalies usually refer to data points or data segments that are significantly different from the normal pattern, which may represent potential safety threats or system failures. In the electric vehicle charging scenario, anomalies may include abnormally long charging time, abnormally high charging rate, or abnormally low payment amount.

[0048] The implementation of the target monitoring sub-model may involve a variety of machine learning algorithms, such as anomaly detection algorithms, time series analysis algorithms, or deep neural networks. Taking the anomaly detection algorithm as an example, it usually includes statistical-based methods (such as Z-score, IQR, etc.), distance-based methods (such as K-means, DBSCAN, etc.) and density-based methods (such as LOF, Isolation Forest, etc.). In step S122, if the target monitoring sub-model is implemented using a statistical-based Z-score algorithm, the computer system first calculates the mean and standard deviation of each feature in the encoded feature representation, and then calculates the standard deviation (Z-score) between each data point and the mean. If the Z-score of a data point exceeds a preset threshold (usually a percentile of a normal distribution, such as 3σ), it is considered abnormal. In this way, the target monitoring sub-model can identify abnormal data points in the encoded feature representation.

[0049] The abnormal data scope refers to the specific time period or data segment where the abnormal behavior occurs in the data, which helps to more accurately understand the nature and scale of the abnormal behavior. In the electric vehicle charging scenario, the abnormal data scope may include the entire charging process of a vehicle, or the charging behavior of multiple vehicles within a certain period of time. In order to determine the abnormal data scope, the target monitoring sub-model may need to adopt more complex algorithms, such as time series analysis algorithms or deep neural networks. These algorithms can analyze the time series data in the encoded feature representation, identify abnormal patterns, and determine the abnormal data scope.

[0050] Taking the time series analysis algorithm as an example, it usually includes ARIMA model, Holt-Winters model, etc. In step S122, if the target monitoring sub-model is implemented using the ARIMA model, the computer system first performs a stationarity test and a differential process on the time series data in the coded feature representation, and then fits the ARIMA model to predict future data points. If the difference between the actual data point and the predicted data point exceeds a preset threshold, then the time period is considered abnormal. In this way, the target monitoring sub-model can determine the range of abnormal data in the coded feature representation.

[0051] Step S123: input the encoded feature representation into the core abnormal data item monitoring sub-model, detect the core abnormal data items in the encoded feature representation, and obtain the core abnormal data items, wherein the traffic monitoring agent includes the core abnormal data item monitoring sub-model.

[0052] In step S123, the computer system inputs the coded feature representation obtained by the data coding sub-model processing into the core abnormal data item monitoring sub-model to detect the core abnormal data items therein. The core abnormal data items refer to the data items that contribute the most or are the most representative to the abnormal behavior within the range of abnormal data, and are the key to understanding the nature of abnormal behavior and formulating countermeasures. The coded feature representation is a low-dimensional vector or matrix obtained by the data coding sub-model after dimensionality reduction, feature extraction and conversion of the original monitoring traffic data. It contains the key information in the original data and removes redundancy and noise. The core abnormal data item monitoring sub-model is a component in the traffic monitoring intelligent body specifically used to detect core abnormal data items. Its task is to further mine and analyze the data items in the coded feature representation within the range of abnormal data to identify those data items that contribute the most or are the most representative to the abnormal behavior.

[0053] The implementation method of the core abnormal data item monitoring sub-model, for example, involves a variety of machine learning algorithms and techniques, such as clustering algorithms, classification algorithms, association rule mining algorithms, etc. Taking the clustering algorithm as an example, it can group the data items in the encoded feature representation according to similarity, thereby identifying a set of data items with similar features. In step S123, if the core abnormal data item monitoring sub-model is implemented using the K-means clustering algorithm, the computer system first determines the number of clusters K (i.e., the expected number of core abnormal data items), then randomly selects K initial centroids, and distributes the data items in the encoded feature representation to the cluster where the nearest centroid is located. Next, the new centroid of each cluster is calculated, and the data items are redistributed to the cluster where the nearest centroid is located. This process will be iterated continuously until the position of the centroid no longer changes significantly or reaches a preset number of iterations. Ultimately, the central data items of each cluster can be regarded as core abnormal data items because they represent the common features of the data items in their respective clusters.

[0054] Step S124: Input the encoded feature representation into the target classification sub-model to obtain an abnormal type set, the abnormal type set includes the type corresponding to the abnormal data item and the corresponding support, and the traffic monitoring agent includes the target classification sub-model.

[0055] In step S124, the computer system inputs the encoded feature representation obtained by the data encoding sub-model into the target classification sub-model to obtain an abnormal type set. This abnormal type set not only includes the type corresponding to the abnormal data item, but also provides the support corresponding to each abnormal type, which provides important information for understanding the nature and scale of abnormal behavior.

[0056] The task of the target classification sub-model is to classify the abnormal data items into predefined abnormal types according to the encoded feature representation, and calculate the support of each abnormal type. The abnormal type is a classification description of abnormal behavior, which helps to classify similar abnormal behaviors into one category for subsequent analysis and processing. For example, in the electric vehicle charging scenario, the abnormal types may include "charging fraud", "equipment failure", "cyber attack", etc. The support is a quantitative indicator used to measure the probability of a certain abnormal type appearing in the overall data.

[0057] The implementation of the target classification sub-model may involve a variety of machine learning algorithms, such as support vector machines (SVM), decision trees, random forests, neural networks, etc. These algorithms can learn the distribution patterns and characteristics of data from the encoded feature representation, thereby achieving the classification of abnormal data items. Taking neural networks as an example, the target classification sub-model may adopt structures such as multi-layer perceptrons (MLP) or convolutional neural networks (CNN), and continuously adjust network parameters through forward propagation and back-propagation algorithms to minimize classification errors. During the training process, the computer system uses labeled training data (i.e., data of known abnormal types) to train the target classification sub-model so that it can accurately classify new abnormal data items into the correct abnormal type.

[0058] In step S124, after the encoded feature representation is input into the target classification sub-model, the model will classify it into one of the predefined anomaly types based on the information in its feature representation. At the same time, the model will also calculate the support of each anomaly type, which usually involves complex calculations, including feature extraction, classification decision and support calculation steps.

[0059] Taking the electric vehicle charging scenario as an example, assume that the target classification sub-model has been trained and can identify three types of anomalies: "charging fraud", "equipment failure" and "cyber attack". When a new encoded feature representation (representing the charging behavior of a certain vehicle) is input into the model, the model analyzes the information in the feature representation, such as charging time, charging rate, payment amount, etc., and classifies it into the most likely anomaly type. Assume that the model classifies the feature representation as the "charging fraud" type and calculates a high support (such as 0.8), which indicates that the type appears frequently in the overall data and that the feature representation matches the characteristics of the "charging fraud" type very well.

[0060] Step S125: Generate monitoring traffic annotation data based on the abnormal data range, the core abnormal data items, the types corresponding to the abnormal data items and their corresponding supports, and the monitoring traffic data.

[0061] Monitoring traffic annotation data is a processed output data set that not only contains the original monitoring traffic data, but also adds rich annotation information to these data. These annotation information include abnormal data range, core abnormal data items, types corresponding to abnormal data items and their support, etc., which together constitute a comprehensive description of abnormal behavior in monitoring traffic data. Through monitoring traffic annotation data, computer systems can have a deeper understanding of the nature, scale and impact of abnormal behavior, so as to formulate more accurate and effective security protection strategies.

[0062] In step S125, the computer system integrates the output results of the previous steps. Specifically, the abnormal data range, core abnormal data items, types corresponding to abnormal data items and their support are associated and matched with the original monitoring traffic data. This process includes data alignment, feature fusion, etc. For example, in an electric vehicle charging scenario, the computer system can align the abnormal data range (such as a time period when a certain vehicle charges abnormally long) with the original charging record, find the corresponding charging data items within the time period, and mark them as abnormal data items. At the same time, the computer system will also assign a specific abnormality type (such as "charging fraud") to the abnormal data item and calculate the support based on its characteristics and contextual information.

[0063] After completing the data integration, the computer system generates monitoring flow annotation data. This set of data not only contains the original monitoring flow data, but also adds corresponding annotation information to each data record. For example, in a charging record, the computer system can add the following annotation information: abnormal data range (such as "2023-04-01 12:00:00 to 2023-04-01 16:00:00"), core abnormal data items (such as "charging time" and "payment amount"), abnormal type (such as "charging fraud"), and support (such as 0.9). These annotation information are attached to the original data records in a structured manner, making it easier for the computer system to perform subsequent data analysis and processing.

[0064] It is worth noting that the generation process of monitoring traffic annotation data is a dynamic and continuous process. With the continuous influx of new monitoring traffic data and the continuous optimization of traffic monitoring agents, the computer system continuously updates and improves the monitoring traffic annotation data. This usually involves steps such as annotation of new data, review of old data, and adjustment and optimization of annotation information. Through this process, the computer system can ensure the accuracy and timeliness of monitoring traffic annotation data, and provide reliable data support for subsequent in-depth analysis and formulation of security protection strategies.

[0065] In one implementation, step S121, inputting the monitored traffic data into the data encoding sub-model, performing data encoding processing on the monitored traffic data, and obtaining a coding feature representation, including:

[0066] Step S1211: input the monitored flow data into the first coding sub-model, perform dimensionality reduction processing on the monitored flow data, and obtain a first dimensionality reduction feature representation, wherein the feature length of the first dimensionality reduction feature representation is smaller than the monitored flow data;

[0067] Step S1212: input the first dimensionality reduction feature representation into the second encoding sub-model, expand and enhance the first dimensionality reduction feature representation, and obtain the encoding feature representation, wherein the feature length of the encoding feature representation is smaller than the monitoring flow data and larger than the first dimensionality reduction feature representation.

[0068] In step S1211, the computer system inputs the monitoring flow data into the first coding sub-model. The main task of the first coding sub-model is to perform dimensionality reduction processing on the monitoring flow data to generate a first dimensionality reduction feature representation with a feature length less than the original monitoring flow data. The data structure is simplified by reducing the dimension of the data while retaining important information in the data as much as possible. In the scenario of monitoring flow data, dimensionality reduction processing can help the computer system remove redundancy and noise and improve the processing efficiency and accuracy of subsequent models.

[0069] In order to achieve dimensionality reduction processing, the first encoding sub-model may adopt a variety of algorithms, such as principal component analysis (PCA), linear discriminant analysis (LDA) or autoencoder. Taking PCA as an example, it is an unsupervised linear dimensionality reduction technology that reduces the dimension of the data by finding the principal component in the data (i.e., the direction with the largest variance). In step S1211, if the first encoding sub-model adopts the PCA algorithm, the computer system first calculates the covariance matrix of the monitoring flow data, then solves the eigenvalues ​​and eigenvectors of the matrix, and selects the first k eigenvectors with the largest eigenvalues ​​as new basis vectors. Then, the computer system projects the original monitoring flow data onto these new basis vectors to obtain a k-dimensional first dimensionality reduction feature representation (where k is less than the dimension of the original data). This first dimensionality reduction feature representation contains most of the information in the original data, but has a lower dimension and is easier to process.

[0070] Next, in step S1212, the computer system inputs the first dimensionality reduction feature representation into the second encoding sub-model. The main task of the second encoding sub-model is to expand and enhance the first dimensionality reduction feature representation to generate a coding feature representation whose feature length is smaller than the original monitoring traffic data and larger than the first dimensionality reduction feature representation. Expansion and enhancement aims to introduce more information or features by increasing the dimension of the data, thereby improving the representation and generalization capabilities of the model. In the scenario of monitoring traffic data, expansion and enhancement can help the computer system extract more useful features from the reduced dimensionality data, and provide better support for subsequent classification, clustering and other tasks.

[0071] In order to achieve expansion and enhancement, the second encoding sub-model may adopt a variety of algorithms, such as neural networks, decision trees or random forests. Taking neural networks as an example, useful features can be extracted by learning the intrinsic representation of data. In step S1212, if the second encoding sub-model is implemented using a neural network, the computer system constructs a deep neural network containing multiple hidden layers. Then, the computer system uses the first dimensionality reduction feature representation as the input of the neural network and calculates the output of the network through a forward propagation algorithm. This output is an expanded and enhanced encoding feature representation, whose feature length is greater than the first dimensionality reduction feature representation but less than the original monitoring traffic data. This encoding feature representation not only contains important information in the original data, but also introduces more feature representation capabilities through the nonlinear transformation of the neural network.

[0072] It is worth noting that in steps S1211 and S1212, the selection and design of the first encoding sub-model and the second encoding sub-model depend on the specific application scenario and data characteristics. For example, in the electric vehicle charging scenario, the monitoring flow data may contain multiple fields such as vehicle identification number, charging time, charging rate, payment amount, etc. For such data, the first encoding sub-model may use the PCA algorithm for dimensionality reduction to remove redundancy and noise; while the second encoding sub-model may use a neural network for expansion and enhancement to extract more feature representations related to charging behavior.

[0073] Through the collaborative processing of dimensionality reduction and expansion enhancement, the computer system can convert the original monitoring traffic data into a more compact and more expressive coding feature representation. This coding feature representation will be used as input data for subsequent models for tasks such as abnormal traffic detection, core abnormal data item identification, and abnormal type classification.

[0074] In one implementation, in step S200, before inputting the monitored traffic data into the traffic monitoring agent and obtaining the abnormal traffic monitoring result, the method further includes a model training process, specifically including:

[0075] Step S10: Acquire example monitoring traffic data, wherein the example monitoring traffic data includes first example monitoring traffic data marked with example abnormal data range, second example monitoring traffic data marked with example core abnormal data items, and third example monitoring traffic data marked with example types corresponding to example data items and example support corresponding to example types;

[0076] Step S20: inputting the example monitored traffic data into the initialization encoding sub-model to obtain an example reduced dimension feature representation, wherein the example reduced dimension feature representation represents a reduced dimension feature representation of traffic features extracted from the example monitored traffic data;

[0077] Step S30: inputting the example dimensionality reduction feature representation into the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model for separate training to obtain a temporary monitoring agent, wherein the temporary monitoring agent includes the temporary monitoring sub-model, the temporary core abnormal data item monitoring sub-model and the temporary classification sub-model, the temporary monitoring sub-model, the temporary core abnormal data item monitoring sub-model and the temporary classification sub-model are each separately trained according to their corresponding model training objectives, and the initialization monitoring agent includes the initialization encoding sub-model;

[0078] Step S40: Perform collaborative training on the temporary monitoring agent to obtain a flow monitoring agent.

[0079] In step S10, the computer system obtains example monitoring traffic data as training samples. These data are carefully selected and labeled to reflect various abnormal behaviors that may occur in actual scenarios. The example monitoring traffic data includes three types: first example monitoring traffic data, second example monitoring traffic data, and third example monitoring traffic data. The first example monitoring traffic data is labeled with an example abnormal data range, which is used to train the initialization monitoring sub-model to identify the abnormal data range; the second example monitoring traffic data is labeled with an example core abnormal data item, which is used to train the initialization core abnormal data item monitoring sub-model to identify the core abnormal data item; the third example monitoring traffic data is labeled with an example type corresponding to the example data item and an example support corresponding to the example type, which is used to train the initialization classification sub-model to classify the abnormal type and calculate the support. For example, in an electric vehicle charging scenario, the first example monitoring traffic data may contain an abnormal charging time of a certain vehicle (such as too long or too short), the second example monitoring traffic data may highlight an abnormally high charging rate or an abnormally low payment amount, and the third example monitoring traffic data may mark these abnormal behaviors as "charging fraud" types and give corresponding support.

[0080] Next, in step S20, the computer system inputs the example monitoring flow data into the initialization coding sub-model to obtain an example dimensionality reduction feature representation. The initialization coding sub-model is a machine learning model responsible for data dimensionality reduction. It can convert high-dimensional example monitoring flow data into low-dimensional example dimensionality reduction feature representations while retaining important information in the data as much as possible. The purpose of this step is to reduce the dimensionality of the data, reduce the computational complexity of subsequent models, and improve the generalization ability of the model. For example, in an electric vehicle charging scenario, the initialization coding sub-model may reduce the dimensionality of example monitoring flow data containing multiple fields such as vehicle identification number, charging time, charging rate, payment amount, etc. into an example dimensionality reduction feature representation containing a few key features.

[0081] Then, in step S30, the computer system inputs the example dimensionality reduction feature representation into the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model for separate training. The purpose of this step is to allow each sub-model to focus on its specific task and optimize its internal parameters through training. The initialization monitoring sub-model is responsible for identifying the abnormal data range. It learns how to detect abnormal behavior by comparing the example dimensionality reduction feature representation with the marked abnormal data range; the initialization core abnormal data item monitoring sub-model is responsible for identifying the core abnormal data items. It locates the data items that contribute most to abnormal behavior by learning the key features in the example dimensionality reduction feature representation; the initialization classification sub-model is responsible for classifying abnormal types and calculating support. It predicts which abnormal type a new data item belongs to by learning the association between the example dimensionality reduction feature representation and the abnormal type, and gives the corresponding support. For example, in an electric vehicle charging scenario, the initialization monitoring sub-model may learn that the data segment with charging time exceeding a certain threshold is the abnormal data range, the initialization core abnormal data item monitoring sub-model may identify the data item with abnormally high charging rate as the core abnormal data item, and the initialization classification sub-model may classify this behavior as a "charging fraud" type and give a higher support degree.

[0082] During the separation training process, the computer system may use a variety of machine learning algorithms and techniques to optimize the performance of each sub-model. For example, for the initialization monitoring sub-model, the sliding window technology can be used to detect the abnormal data range, and the optimal abnormal detection threshold can be found by continuously adjusting the size and position of the window; for the initialization of the core abnormal data item monitoring sub-model, the attention mechanism can be used to highlight the key features, and the core abnormal data items can be determined by calculating the importance weight of each feature; for the initialization classification sub-model, classification algorithms such as support vector machine (SVM), random forest or neural network can be used to learn the mapping relationship between the example dimensionality reduction feature representation and the abnormal type.

[0083] It is worth noting that in the process of separate training, each sub-model is trained independently, and there is no direct interaction and collaboration between them. This separate training method helps to simplify the training process and improve training efficiency, but it may also lead to inconsistency and redundancy between sub-models. In order to solve this problem, in step S40, the computer system performs collaborative training on the temporary monitoring agent (i.e., a combination of a temporary monitoring sub-model, a temporary core abnormal data item monitoring sub-model, and a temporary classification sub-model, where temporary represents an intermediate state). Collaborative training is a joint training strategy that allows sub-models to communicate and collaborate with each other during the training process to further optimize the overall performance. During the collaborative training process, the computer system inputs the example monitoring traffic data into all sub-models at the same time and observes their output results. If the output of a sub-model is inconsistent or conflicting with the output of other sub-models, the computer system will adjust the parameters of the sub-model to make its output more in line with the overall expectations. Through continuous iteration and optimization, a traffic monitoring agent with excellent performance can be finally obtained. The specific implementation methods of collaborative training may vary depending on the application scenario and data characteristics. For example, in the field of computer vision, collaborative training may involve feature sharing and weight updates between different views (such as images at different angles or lighting conditions); in the field of natural language processing, it may involve knowledge transfer and model fusion between different tasks (such as text classification and sentiment analysis). In the scenario of traffic monitoring agents, collaborative training may involve feature alignment and weight adjustment between tasks such as abnormal data range detection, core abnormal data item identification, and abnormal type classification to ensure that the various sub-models can work together to improve the overall performance.

[0084] In one implementation, in step S30, the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model are separately trained in sequence in combination with the initialization encoding sub-model to obtain a temporary monitoring agent, including:

[0085] Step S301: respectively train the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model in sequence using a comprehensive cost function in combination with the initialization encoding sub-model to obtain a temporary monitoring intelligent agent, wherein the comprehensive cost function is obtained by integrating the first cost function, the second cost function and the third cost function. When the temporary monitoring sub-model is trained, the second cost function and the third cost function are shielded. When the temporary core abnormal data item monitoring sub-model is trained, the first cost function and the third cost function are shielded. When the temporary classification sub-model is trained, the first cost function and the second cost function are shielded.

[0086] In step S301, the computer system respectively combines the initialization coding sub-model and uses the comprehensive cost function to train the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model in sequence. The comprehensive cost function here is a composite function that integrates the first cost function, the second cost function and the third cost function, which is used to measure the overall performance of the model during the training process. In the process of separation training, in order to focus on the tasks of each sub-model, the computer system shields the cost functions that are not related to the current sub-model as needed.

[0087] Specifically, when training the initialization monitoring sub-model, the computer system shields the second cost function and the third cost function and only considers the first cost function. The first cost function is closely related to the detection task of the abnormal data range. It may be a function based on error metrics, such as mean square error (MSE) or mean absolute error (MAE), which is used to measure the difference between the abnormal data range predicted by the model and the actual abnormal data range. By minimizing the first cost function, the computer system can optimize the parameters of the initialization monitoring sub-model so that it can more accurately identify the abnormal data range in the monitoring flow data. For example, in an electric vehicle charging scenario, assume that there is a set of example monitoring flow data marked with abnormal charging duration. When training the initialization monitoring sub-model, the computer system attempts to predict the abnormal charging duration range of these data and compares it with the true value. By continuously adjusting the model parameters, the computer can minimize the first cost function, thereby improving the model's ability to identify the abnormal charging duration range.

[0088] Next, when training the initialization core abnormal data item monitoring sub-model, the computer system shields the first cost function and the third cost function and only considers the second cost function. The second cost function is related to the identification task of the core abnormal data item. It may be a function based on classification accuracy, which is used to measure the performance of the model in identifying the core abnormal data item. By maximizing the second cost function (or equivalently, minimizing its negative value), the computer system can optimize the parameters of the initialization core abnormal data item monitoring sub-model so that it can more accurately locate the data items that contribute most to abnormal behavior.

[0089] Continuing with the example of the electric vehicle charging scenario, assume that there is a set of sample monitoring flow data with abnormal charging rates marked. When training the initialization core abnormal data item monitoring sub-model, the computer system attempts to identify the abnormal charging rate as the core abnormal data item from these data. By continuously adjusting the model parameters and maximizing the second cost function (i.e., improving the classification accuracy), the computer can improve the model's ability to identify the core abnormal data items.

[0090] Finally, when training the initial classification sub-model, the computer system blocks the first cost function and the second cost function and only considers the third cost function. The third cost function is related to the classification task of the abnormal type. It may be a function based on cross entropy loss or negative log-likelihood loss, which is used to measure the performance of the model in classifying abnormal types. By minimizing the third cost function, the computer system can optimize the parameters of the initial classification sub-model so that it can more accurately classify new abnormal data items.

[0091] Taking the electric vehicle charging scenario as an example, suppose there is a set of sample monitoring traffic data labeled as "charging fraud". When training the initial classification sub-model, the computer system attempts to predict the abnormal type of these data and compares it with the true value. By continuously adjusting the model parameters and minimizing the third cost function (i.e. reducing the classification error rate), the computer can improve the model's ability to classify abnormal types.

[0092] After completing the separation training, a temporary monitoring agent is obtained, which includes a temporary monitoring sub-model, a temporary core abnormal data item monitoring sub-model, and a temporary classification sub-model. However, since each sub-model is trained independently during the separation training process, there may be inconsistencies and redundancies between them. In order to solve this problem, collaborative training is required.

[0093] Based on the above steps S301 and S40, the temporary monitoring agent is collaboratively trained to obtain a flow monitoring agent, including: using a comprehensive cost function to collaboratively train the temporary monitoring agent to obtain a flow monitoring agent, wherein in the collaborative training link, the first cost function, the second cost function and the third cost function are not shielded.

[0094] The computer system uses the comprehensive cost function to co-train the temporary monitoring agent to obtain the final traffic monitoring agent. Unlike separate training, the first cost function, the second cost function and the third cost function are not shielded during the co-training process. This means that when calculating the comprehensive cost function, the computer system considers the performance of all sub-models at the same time and minimizes the comprehensive cost function by optimizing the parameters of the entire temporary monitoring agent.

[0095] The specific implementation of collaborative training may involve multiple iterative steps. In each iterative step, the computer system inputs the sample monitoring traffic data into the temporary monitoring agent and observes the output results of each sub-model. Then, the computer system calculates the performance loss of the entire agent based on the comprehensive cost function and distributes the loss to the parameters of each sub-model through the back propagation algorithm. Then, the computer system updates these parameters to minimize the comprehensive cost function. This process is repeated until the comprehensive cost function converges to a stable value.

[0096] Through collaborative training, the computer system can further optimize the performance of temporary monitoring agents, so that their sub-models can work together to improve overall performance. For example, in the electric vehicle charging scenario, through collaborative training, the flow monitoring agent can more accurately identify the range of abnormal charging duration, locate core abnormal data items (such as abnormal charging rate) and classify abnormal types (such as "charging fraud"), thereby providing more powerful support for the safe operation of energy supply stations.

[0097] In one implementation, in step S30, the example dimension reduction feature representation is input into the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model for separate training to obtain a temporary monitoring agent, including:

[0098] Step S31: if the example dimensionality reduction feature representation is associated with the first example monitoring traffic data, the example dimensionality reduction feature representation is input into the initialization monitoring sub-model to generate an estimated abnormal data range;

[0099] Step S32: determining a first cost function based on the estimated abnormal data range and the example abnormal data range;

[0100] Step S33: when the first cost function does not meet the first training stop index, optimizing the model variables of the initialization encoding sub-model and the initialization monitoring sub-model;

[0101] Step S34: when the first cost function meets the first training stop indicator, the initialization monitoring sub-model is used as a temporary monitoring sub-model.

[0102] In step S31, the computer system determines whether the example dimensionality reduction feature representation is associated with the first example monitoring flow data. This judgment process is based on data tags or metadata to ensure the consistency and accuracy of the data. If the example dimensionality reduction feature representation is associated with the first example monitoring flow data, the computer system will input it into the initialization monitoring sub-model. The initialization monitoring sub-model is a machine learning model specifically used to detect the range of abnormal data. It predicts possible abnormal areas in the data by analyzing the characteristics of the input data. In the electric vehicle charging scenario, assuming that the first example monitoring flow data contains a set of data marked with abnormal charging duration, the task of the initialization monitoring sub-model is to predict which data segments belong to the abnormal charging duration range based on the example dimensionality reduction feature representation (which may include features such as charging duration and charging rate).

[0103] In step S32, the computer system determines a first cost function based on the estimated abnormal data range and the example abnormal data range generated by the initialization monitoring sub-model. The first cost function is a function that measures the prediction performance of the model, which is usually calculated based on some error metric, such as mean square error (MSE), mean absolute error (MAE), etc. In this example, the first cost function can calculate the difference between the estimated abnormal data range and the example abnormal data range to evaluate the accuracy of the initialization monitoring sub-model. If the estimated abnormal data range is highly consistent with the example abnormal data range, the value of the first cost function will be lower, indicating that the prediction performance of the model is better; conversely, if there is a large difference between the two, the value of the first cost function will be higher, indicating that the model needs to be further optimized.

[0104] Next, in step S33, the computer system checks whether the first cost function meets the first training stop indicator. The first training stop indicator is a preset threshold or condition used to determine whether the model has been trained well enough to stop training to avoid overfitting or other problems. If the first cost function does not meet the first training stop indicator (that is, its value is still high), the computer system will optimize the model variables of the initial encoding sub-model and the initial monitoring sub-model. This optimization process usually involves optimization techniques such as backpropagation algorithms and gradient descent, which minimize the first cost function by continuously adjusting parameters such as model weights and biases. In the electric vehicle charging scenario, this means that the computer system adjusts the parameters of the model based on the difference between the estimated abnormal data range and the example abnormal data range, in order to improve the model's prediction accuracy for the range of abnormal charging duration.

[0105] Finally, in sub-step S34, if the first cost function meets the first training stop indicator (i.e., its value has dropped below the preset threshold), the computer system will use the initialized monitoring sub-model as a temporary monitoring sub-model. This means that the initialized monitoring sub-model has passed the preliminary training and verification and can be used as a relatively stable component to construct a temporary monitoring agent. At this point, the computer system can continue to perform a similar separation training process on the initialized core abnormal data item monitoring sub-model and the initialized classification sub-model until they also meet their respective training stop indicators. Ultimately, these trained sub-models will be combined into a complete temporary monitoring agent for subsequent collaborative training and the final traffic monitoring task.

[0106] It is worth noting that throughout the separate training process, the computer system continuously monitors and evaluates the performance of the models to ensure that they can accurately identify and analyze abnormal behaviors in the monitored traffic data. This usually involves using methods such as validation sets or cross-validation to evaluate the generalization ability of the model and adjusting or retraining the model when necessary. In addition, since the initialization encoding sub-model is shared by multiple sub-models during the separate training process, its performance is critical to the quality of the entire temporary monitoring agent. Therefore, during the training process, the computer system also needs to pay special attention to the optimization and adjustment of the initialization encoding sub-model.

[0107] In one implementation, in step S31, if the example dimensionality reduction feature representation is associated with the first example monitoring traffic data, the example dimensionality reduction feature representation is input into the initialization monitoring sub-model to generate an estimated abnormal data range, including:

[0108] Step S311: inputting the example dimensionality reduction feature representation into the initialization monitoring sub-model, determining the estimated positioning data item, the estimated positioning data item fine-tuning amount, and the estimated length, wherein the estimated positioning data item and the estimated positioning data item fine-tuning amount are used to indicate the position of the estimated abnormal data range, and the estimated length is used to indicate the characteristic length of the estimated abnormal data range;

[0109] Step S312: Generate an estimated abnormal data range based on the estimated positioning data item, the estimated positioning data item fine-tuning amount, and the estimated length.

[0110] In sub-step S311, the computer system inputs the example dimensionality reduction feature representation into the initialization monitoring sub-model. The initialization monitoring sub-model is a pre-trained machine learning model that is specifically used to detect abnormal ranges in data. This model may be built based on a variety of algorithms, such as time series analysis, sliding window technology, or deep neural networks, depending on the application scenario and data characteristics. In this step, the initialization monitoring sub-model analyzes the input example dimensionality reduction feature representation to identify data segments that may contain abnormal behavior.

[0111] To achieve this goal, the initialization monitoring sub-model outputs three key parameters: estimated location data items, estimated location data item fine-tuning amount, and estimated length. The estimated location data item refers to the location of the data item where the model predicts that the abnormal behavior may start. In the electric vehicle charging scenario, this may correspond to a certain point in time or data point in the charging record of a certain vehicle. The estimated location data item fine-tuning amount is a small adjustment value used to fine-tune the location of the estimated location data item to improve the accuracy of the estimate. It may be based on the model's deep understanding of the abnormal behavior pattern, taking into account that the abnormal behavior may not start at a completely precise location, but has a small fluctuation range. The estimated length refers to the number of data items or the length of time that the model predicts that the abnormal behavior may last. It reflects the scale and duration of the abnormal behavior and is crucial to understanding the nature and impact of the abnormal behavior.

[0112] Taking the electric vehicle charging scenario as an example, assume a set of sample dimensionality reduction feature representations, including charging records of multiple vehicles. After inputting these feature representations into the initial monitoring sub-model, the model can output the following estimated parameters: for the charging record of a certain vehicle, the estimated location data item may be the 100th data point (corresponding to a specific time point), the estimated location data item fine-tuning amount may be plus or minus 5 data points (indicating that the abnormal behavior may start between the 95th and 105th data points), and the estimated length may be 20 data points (indicating that the abnormal behavior may last for 20 time units). Together, these parameters constitute a preliminary estimate of the possible range and duration of abnormal charging behavior.

[0113] In step S312, the computer system generates an estimated abnormal data range based on the estimated parameters obtained in step S311. This step involves combining the estimated positioning data items, the estimated positioning data item fine-tuning amount, and the estimated length to determine the specific data segment where the abnormal behavior may occur. Specifically, the computer system first determines the starting position range of the abnormal behavior based on the estimated positioning data items and the estimated positioning data item fine-tuning amount, and then determines the end position of the abnormal behavior in combination with the estimated length. In this way, an estimated abnormal data range that includes all data items where abnormal behavior may occur can be obtained.

[0114] Continuing with the electric vehicle charging scenario as an example, assume that the above-mentioned estimated parameters are obtained in step S311. In sub-step S312, the computer system converts these parameters into a specific abnormal data range. Specifically, it can add or subtract the estimated positioning data item fine-tuning amount (plus or minus 5 data points) from the estimated positioning data item (the 100th data point) to obtain a starting position range (95th to 105th data points). Then, it will start from this starting position range and extend the estimated length (20 data points) backward to obtain an estimated abnormal data range (95th to 125th data points). This range represents the data segment where the abnormal charging behavior predicted by the model may occur. The estimated abnormal data range is not the final determination result, but a preliminary estimate based on the current data and model prediction. In practical applications, this estimated range can be used to further analyze the data, trigger an alarm, or serve as an input for subsequent processing. At the same time, with the continuous influx of new data and the continuous optimization of the model, the estimated abnormal data range can also be continuously updated and adjusted to more accurately reflect the actual situation.

[0115] In summary, the two sub-steps S311 and S312 in step S31 together constitute the core mechanism for initializing the monitoring sub-model to estimate the range of abnormal data. By outputting key parameters such as estimated positioning data items, estimated positioning data item fine-tuning amounts, and estimated lengths, and combining these parameters to generate estimated abnormal data ranges, the computer system can provide strong support for subsequent abnormal behavior analysis and processing. This process not only relies on advanced machine learning algorithms and techniques, but also requires an in-depth understanding and analysis of application scenarios and data characteristics. By continuously optimizing and improving this process, the model's ability to identify abnormal behaviors and prediction accuracy can be improved, providing a more solid guarantee for the safe operation of energy supply stations.

[0116] In another implementation, in step S30, the example dimension reduction feature representation is input into the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model for separate training to obtain a temporary monitoring agent, including:

[0117] Step S30A: when the example dimensionality reduction feature representation is associated with the second example monitored traffic data, the example dimensionality reduction feature representation is input into the initialization core abnormal data item monitoring sub-model to generate an estimated core abnormal data item;

[0118] Step S30B: determining a second cost function based on the estimated core abnormal data item and the example core abnormal data item;

[0119] Step S30C: when the second cost function does not meet the second training stop index, optimizing the model variables of the initialization encoding sub-model and the initialization core abnormal data item monitoring sub-model;

[0120] Step S30D: when the second cost function meets the second training stop indicator, the initialized core abnormal data item monitoring sub-model is determined as a temporary core abnormal data item monitoring sub-model.

[0121] In sub-step S30A, the computer system determines whether the example dimensionality reduction feature representation is associated with the second example monitoring flow data. This judgment is based on data tags or metadata to ensure the consistency and accuracy of the data. If the example dimensionality reduction feature representation is associated with the second example monitoring flow data, the computer system will input it into the initialization core abnormal data item monitoring sub-model. The initialization core abnormal data item monitoring sub-model is a machine learning model specifically used to identify core abnormal items in data. It predicts which data items contribute the most or are most representative to abnormal behavior by analyzing the characteristics of the input data. In the electric vehicle charging scenario, assuming that the second example monitoring flow data contains a set of data marked with core abnormal charging rates, then the task of the initialization core abnormal data item monitoring sub-model is to predict which data items (such as specific charging rate values) are core abnormal items based on the example dimensionality reduction feature representation (which may include features such as charging time, charging rate, payment amount, etc.).

[0122] In sub-step S30A, the core abnormal data item monitoring sub-model is initialized to output the estimated core abnormal data items. These estimated core abnormal data items are based on the model's analysis of the current input data, and they represent the data items that the model believes contribute the most or are the most representative to the abnormal behavior. In the electric vehicle charging scenario, the estimated core abnormal data items may be a set of specific charging rate values ​​that the model considers to be the key factors leading to abnormal charging behavior. It is worth noting that these estimated core abnormal data items are not the final determined results, but a preliminary estimate based on the current data and model predictions, which can be further verified and optimized in subsequent steps.

[0123] In sub-step S30B, the computer system determines a second cost function based on the estimated core abnormal data item and the example core abnormal data item. The second cost function is a function that measures the prediction performance of the model, which is usually calculated based on some error metric, such as cross entropy loss, negative log-likelihood loss, or mean square error. In this example, the second cost function can calculate the difference between the estimated core abnormal data item and the example core abnormal data item to evaluate the accuracy of the initialized core abnormal data item monitoring sub-model. If the estimated core abnormal data item is highly consistent with the example core abnormal data item, the value of the second cost function will be lower, indicating that the prediction performance of the model is better; conversely, if there is a large difference between the two, the value of the second cost function will be higher, indicating that the model needs to be further optimized.

[0124] In sub-step S30C, the computer system checks whether the second cost function meets the second training stop indicator. The second training stop indicator is a preset threshold or condition used to determine whether the model has been trained well enough to stop training to avoid overfitting or other problems. If the second cost function does not meet the second training stop indicator (that is, its value is still high), the computer system will optimize the model variables of the initialization encoding sub-model and the initialization core abnormal data item monitoring sub-model. This optimization process usually involves optimization techniques such as backpropagation algorithms and gradient descent, which minimize the second cost function by continuously adjusting parameters such as model weights and biases. In the electric vehicle charging scenario, this means that the computer system adjusts the parameters of the model based on the difference between the estimated core abnormal data items and the example core abnormal data items, in order to improve the model's recognition accuracy of the core abnormal charging rate.

[0125] During the optimization process, the initialization encoding sub-model will also be optimized at the same time. This is because the initialization encoding sub-model is responsible for converting the original data into a reduced-dimensional feature representation, and the quality of the reduced-dimensional feature representation directly affects the prediction performance of the subsequent model. Therefore, while optimizing the initialization core abnormal data item monitoring sub-model, the initialization encoding sub-model also needs to be adjusted to ensure that it can generate more accurate and useful reduced-dimensional feature representations.

[0126] Finally, in sub-step S30D, if the second cost function meets the second training stop index (i.e., its value has dropped below the preset threshold), the computer system will determine the initialized core abnormal data item monitoring sub-model as a temporary core abnormal data item monitoring sub-model. This means that the initialized core abnormal data item monitoring sub-model has passed the preliminary training and verification, and can be used as a relatively stable component to build a temporary monitoring agent. At this point, the computer system can continue to perform a similar separation training process on the initialized monitoring sub-model and the initialized classification sub-model until they also meet their respective training stop indexes. Ultimately, these trained sub-models will be combined into a complete temporary monitoring agent for subsequent collaborative training and the final traffic monitoring task. Throughout the separation training process, the computer system continuously monitors and evaluates the performance of the models to ensure that they can accurately identify and analyze abnormal behaviors in the monitored traffic data. This usually involves using methods such as validation sets or cross-validation to evaluate the generalization ability of the model, and adjusting or retraining the model when necessary. In addition, since the initialized encoding sub-model is shared by multiple sub-models during the separation training process, its performance is crucial to the quality of the entire temporary monitoring agent. Therefore, during the training process, the computer system also needs to pay special attention to the optimization and adjustment of the initialization encoding sub-model.

[0127] In summary, the various sub-steps S30A~S30D in another implementation scheme of step S30 together constitute a sophisticated separation training process, which aims to ensure that the initialized core abnormal data item monitoring sub-model can accurately identify the core abnormal items in the data. Through this process, the computer system can gradually build a relatively stable temporary monitoring agent component, laying a solid foundation for subsequent collaborative training and the final flow monitoring task. This process not only relies on advanced machine learning algorithms and techniques, but also requires an in-depth understanding and analysis of application scenarios and data characteristics. By continuously optimizing and improving the separation training process, the performance and application effect of the temporary monitoring agent can be further improved, providing more powerful support for the safe operation of the energy supply station.

[0128] In one implementation, step S30A, when the example dimensionality reduction feature representation is associated with the second example monitored traffic data, the example dimensionality reduction feature representation is input into the initialization core abnormal data item monitoring sub-model to generate an estimated core abnormal data item, including:

[0129] Step S30A1: inputting the example dimensionality reduction feature representation into the initialization core abnormal data item monitoring sub-model to determine the number of estimated core abnormal data items and the position and support of each estimated core abnormal data item;

[0130] Step S30A2: Generate estimated core anomaly data items based on the number of estimated core anomaly data items and the position and support of each estimated core anomaly data item.

[0131] In sub-step S30A1, the computer system inputs the example dimensionality reduction feature representation into the initialized core abnormal data item monitoring sub-model. The initialized core abnormal data item monitoring sub-model is a pre-trained machine learning model that is specifically used to identify core abnormal data items in the data. This model may be built based on a variety of algorithms, such as attention mechanism, decision tree, random forest or deep neural network, depending on the application scenario and data characteristics. In this step, the initialized core abnormal data item monitoring sub-model analyzes the input example dimensionality reduction feature representation to predict which data items are core abnormal data items and determine their location, quantity and support.

[0132] To achieve this goal, the initialization of the core anomaly data item monitoring sub-model will output three key parameters: the estimated number of core anomaly data items, the position of each estimated core anomaly data item, and the support of each estimated core anomaly data item. The number of estimated core anomaly data items refers to the total number of core anomaly data items in the abnormal behavior predicted by the model, which reflects the complexity and scale of the abnormal behavior. The position of each estimated core anomaly data item refers to the specific position of each core anomaly data item predicted by the model in the data set (such as the index or timestamp of the data point), which helps to locate the key points of the abnormal behavior. The support of each estimated core anomaly data item is a quantitative indicator used to measure the reliability and importance of the data item as a core anomaly data item. It may be based on the model's in-depth understanding of the abnormal behavior pattern, taking into account that different data items may contribute differently to the abnormal behavior.

[0133] Taking the electric vehicle charging scenario as an example, suppose there is a set of sample dimensionality reduction feature representations that contain charging records of multiple vehicles. After inputting these feature representations into the initialization core abnormal data item monitoring sub-model, the model can output the following estimated parameters: the number of estimated core abnormal data items is 3, indicating that the model predicts that there are 3 key abnormal points; the position of each estimated core abnormal data item is the 50th, 150th and 250th data point (corresponding to a specific time point or charging record), indicating that the model believes that the data items at these positions contribute the most to abnormal behavior; the support of each estimated core abnormal data item is 0.8, 0.9 and 0.7, indicating the model's confidence in these predictions.

[0134] In sub-step S30A2, the computer system generates estimated core anomaly data items based on the estimated parameters obtained in sub-step S30A1. This step involves combining the number, position and support of the estimated core anomaly data items to construct a list or array containing the core anomaly data items. Specifically, the computer system first determines the size of the list or array based on the number of estimated core anomaly data items, then adds the corresponding data items to the list or array based on the position of each estimated core anomaly data item, and assigns a support value to each data item. In this way, a complete list or array containing the estimated core anomaly data items and their support can be obtained.

[0135] Continuing with the electric vehicle charging scenario as an example, assume that the above-mentioned estimated parameters are obtained in sub-step S30A1. In sub-step S30A2, the computer system constructs a list of estimated core abnormal data items based on these parameters. Specifically, it first creates a list of size 3, then adds the 50th, 150th, and 250th data points (corresponding to specific charging records) to the list, and assigns support values ​​of 0.8, 0.9, and 0.7 to each data item. Finally, the obtained list of estimated core abnormal data items may be as follows: [{data item: 50th data point, support: 0.8}, {data item: 150th data point, support: 0.9}, {data item: 250th data point, support: 0.7}]. This list represents the core abnormal data items predicted by the model and their support, which provides strong support for subsequent abnormal behavior analysis and processing.

[0136] The estimated core abnormal data items are not the final results, but a preliminary estimate based on the current data and model predictions. In practical applications, this estimated list can be used to further analyze data, trigger alarms, or serve as input for subsequent processing. At the same time, with the continuous influx of new data and continuous optimization of the model, the estimated core abnormal data items can also be continuously updated and adjusted to more accurately reflect the actual situation.

[0137] In summary, by outputting key parameters such as the number, location, and support of estimated core abnormal data items, and combining these parameters to generate a list of estimated core abnormal data items, the computer system can provide strong support for subsequent abnormal behavior analysis and processing. This process not only relies on advanced machine learning algorithms and technologies, but also requires in-depth understanding and analysis of application scenarios and data characteristics. By continuously optimizing and improving this process, the model's ability to identify core abnormal data items and its prediction accuracy can be improved, providing a more solid guarantee for the safe operation of energy supply stations.

[0138] In another implementation, in step S30, the example dimension reduction feature representation is input into the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model for separate training to obtain a temporary monitoring agent, including:

[0139] Step S30a: when the example dimensionality reduction feature representation is associated with the third example monitoring flow data, the example dimensionality reduction feature representation is input into the initialization classification sub-model to generate an estimated type corresponding to the estimated data item and an estimated support corresponding to the estimated type;

[0140] Step S30b: determining a third cost function based on the estimated type, the estimated support and the example type, and the example support;

[0141] Step S30c: when the third cost function does not meet the third training stop index, optimizing the model variables of the initialization encoding sub-model and the initialization classification sub-model;

[0142] Step S30d: When the third cost function meets the third training stop indicator, the initialized classification sub-model is used as a temporary classification sub-model.

[0143] In step S30a, the computer system determines whether the example dimensionality reduction feature representation is associated with the third example monitoring flow data. This judgment is based on data tags or metadata to ensure the consistency and accuracy of the data. If the example dimensionality reduction feature representation is associated with the third example monitoring flow data, the computer system will input it into the initialization classification sub-model. The initialization classification sub-model is a machine learning model specifically used to classify data items. It predicts the category to which each data item belongs by analyzing the characteristics of the input data and gives the support of the category. In the electric vehicle charging scenario, assuming that the third example monitoring flow data contains a set of charging records marked with abnormal types, such as "charging fraud", "equipment failure", etc., then the task of the initialization classification sub-model is to predict the abnormal type of each charging record based on the example dimensionality reduction feature representation (which may include features such as charging time, charging rate, payment amount, etc.) and give the corresponding support.

[0144] In step S30a, the initialization classification sub-model will output the estimated type corresponding to the estimated data item and the estimated support corresponding to the estimated type. The estimated type refers to the category to which the data item predicted by the model belongs, which reflects the model's classification result of the abnormal behavior of the data item. The estimated support is a quantitative indicator used to measure the model's confidence or reliability in the estimated type. It may be based on the model's in-depth understanding of abnormal behavior patterns, taking into account that different data items may belong to multiple categories and the support for each category may be different. In the electric vehicle charging scenario, the estimated type may be "charging fraud" or "equipment failure", and the estimated support is a value between 0 and 1, indicating the model's confidence in the estimated type.

[0145] In step S30b, the computer system determines a third cost function based on the estimated type, estimated support and example type, example support. The third cost function is a function that measures the classification performance of the model, which is usually calculated based on some error metric, such as cross entropy loss, negative log-likelihood loss, etc. In this example, the third cost function can calculate the difference between the estimated type and the example type, as well as the difference between the estimated support and the example support, to evaluate the accuracy of the initialized classification sub-model. If the estimated type is consistent with the example type, and the estimated support is close to the example support, then the value of the third cost function will be lower, indicating that the classification performance of the model is better; conversely, if there is a large difference between the two, then the value of the third cost function will be higher, indicating that the model needs further optimization.

[0146] In step S30c, the computer system checks whether the third cost function meets the third training stop indicator. The third training stop indicator is a preset threshold or condition used to determine whether the model has been trained well enough to stop training to avoid overfitting or other problems. If the third cost function does not meet the third training stop indicator (that is, its value is still high), the computer system will optimize the model variables of the initial encoding sub-model and the initial classification sub-model. This optimization process usually involves optimization techniques such as backpropagation algorithms and gradient descent, which minimize the third cost function by continuously adjusting parameters such as model weights and biases. In the electric vehicle charging scenario, this means that the computer system adjusts the parameters of the model based on the difference between the estimated type and the example type, and the difference between the estimated support and the example support, in order to improve the model's classification accuracy for abnormal types and the reliability of support prediction.

[0147] During the optimization process, the initialization encoding sub-model will also be optimized at the same time. This is because the initialization encoding sub-model is responsible for converting the original data into a reduced-dimensional feature representation, and the quality of the reduced-dimensional feature representation directly affects the classification performance of the subsequent model. Therefore, while optimizing the initialization classification sub-model, the initialization encoding sub-model also needs to be adjusted to ensure that it can generate more accurate and useful reduced-dimensional feature representations.

[0148] In sub-step S30d, if the third cost function meets the third training stop index (i.e., its value has dropped below the preset threshold), the computer system will determine the initialized classification sub-model as a temporary classification sub-model. This means that the initialized classification sub-model has passed the preliminary training and verification and can be used as a relatively stable component to construct a temporary monitoring agent. At this point, the computer system can continue to perform a similar separation training process on the initialized monitoring sub-model and the initialized core abnormal data item monitoring sub-model until they also meet their respective training stop indexes. Ultimately, these trained sub-models will be combined into a complete temporary monitoring agent for subsequent collaborative training and the final traffic monitoring task.

[0149] Throughout the separate training process, the computer system continuously monitors and evaluates the performance of the models to ensure that they can accurately identify and analyze abnormal behaviors in the monitored traffic data. This usually involves using methods such as validation sets or cross-validation to evaluate the generalization ability of the model and adjusting or retraining the model when necessary. In addition, since the initialization encoding sub-model is shared by multiple sub-models during the separate training process, its performance is critical to the quality of the entire temporary monitoring agent. Therefore, during the training process, the computer system also needs to pay special attention to the optimization and adjustment of the initialization encoding sub-model.

[0150] In practical applications, the initialization classification sub-model may need to handle multiple anomaly types, and the support of each anomaly type may vary depending on the data characteristics and application scenarios. Therefore, when designing and training the initialization classification sub-model, these factors need to be fully considered to ensure that the model can accurately classify the data items and give reasonable support. In addition, with the continuous influx of new data and the continuous optimization of the model, the estimated type and estimated support can also be continuously updated and adjusted to more accurately reflect the actual situation.

[0151] In summary, the various sub-steps S30a~S30d in another implementation of step S30 together constitute a sophisticated separation training process, which aims to ensure that the initialized classification sub-model can accurately classify the data items and give the corresponding support. Through this process, the computer system can gradually build a relatively stable temporary monitoring agent component, laying a solid foundation for subsequent collaborative training and the final flow monitoring task. This process not only relies on advanced machine learning algorithms and techniques, but also requires an in-depth understanding and analysis of application scenarios and data characteristics. By continuously optimizing and improving the separation training process, the performance and application effect of the temporary monitoring agent can be further improved, providing more powerful support for the safe operation of the energy supply station.

[0152] In one implementation, step S30a, when the example dimensionality reduction feature representation is associated with the third example monitoring traffic data, the example dimensionality reduction feature representation is input into the initialization classification sub-model to generate an estimated type corresponding to the estimated data item and an estimated support corresponding to the estimated type, including:

[0153] Step S30a1: Inputting the example dimensionality reduction feature representation into the initialization classification sub-model to generate a traffic feature array, wherein the traffic feature array includes a preset number of types, and each element in the traffic feature array is used to represent the type of the corresponding data item and the corresponding support;

[0154] Step S30a2: Generate an estimated type and an estimated support based on the traffic feature array.

[0155] In step S30a1, the computer system inputs the example dimensionality reduction feature representation into the initialization classification sub-model. The initialization classification sub-model is a pre-trained machine learning model that is specifically used to classify data items and predict the support corresponding to each category. This model may be built based on a variety of algorithms, such as support vector machines (SVM), random forests, decision trees, or deep neural networks (DNN), depending on the application scenario and data characteristics. In this step, the initialization classification sub-model analyzes the input example dimensionality reduction feature representation to predict the type of each data item and generate a traffic feature array.

[0156] The traffic feature array is an array containing a preset number of types, where each element corresponds to a possible data item type and contains a value representing the support of the type. The preset number of types is determined in advance based on the application scenario and data characteristics, and it represents all the categories that the data item may belong to. In the electric vehicle charging scenario, the preset number of types may include multiple categories such as "normal charging", "charging fraud", and "equipment failure". Each element in the traffic feature array contains a type label and a support value. The type label is used to identify the category to which the data item belongs, while the support value is used to measure the model's confidence or reliability in the prediction.

[0157] Taking the electric vehicle charging scenario as an example, suppose there is a set of sample dimensionality reduction feature representations that contain charging records of multiple vehicles. After inputting these feature representations into the initial classification sub-model, the model can generate a flow feature array that contains three preset types: "normal charging", "charging fraud" and "equipment failure". For each charging record, the flow feature array provides an array containing three elements, corresponding to the support of these three types. For example, for a charging record, the flow feature array may be as follows: [{type: "normal charging", support: 0.2}, {type: "charging fraud", support: 0.7}, {type: "equipment failure", support: 0.1}], indicating that the model predicts that the charging record has a 70% probability of belonging to the "charging fraud" category, a 20% probability of belonging to the "normal charging" category, and a 10% probability of belonging to the "equipment failure" category.

[0158] Next, in step S30a2, the computer system generates an estimated type and an estimated support based on the traffic feature array generated in sub-step S30a1. This step involves analyzing and comparing the elements in the traffic feature array to determine the most likely type of each data item and give the corresponding support. Specifically, the computer system traverses each element in the traffic feature array, finds the type label with the highest support, and uses it as the estimated type of the data item. At the same time, the computer system outputs the support value corresponding to the type label as the estimated support.

[0159] Continuing with the electric vehicle charging scenario as an example, assume that the above-mentioned traffic feature array is obtained in sub-step S30a1. In sub-step S30a2, the computer system compares the support values ​​in each element and finds the type label with the highest support. In this example, the "charging fraud" type has the highest support (0.7), so the computer system outputs this type label as the estimated type of the charging record. At the same time, the computer system outputs 0.7 as the estimated support, indicating that the model has a 70% confidence level in the prediction.

[0160] The estimated type and estimated support are not final results, but a preliminary estimate based on current data and model predictions. In actual applications, this estimate can be used to further analyze data, trigger alarms, or serve as input for subsequent processing. At the same time, as new data continues to flow in and the model continues to be optimized, the estimate type and estimated support can also be continuously updated and adjusted to more accurately reflect the actual situation.

[0161] In addition, during the training process of the initial classification sub-model, the computer system can use a variety of optimization strategies to improve the classification accuracy of the model and the reliability of the support prediction. For example, cross-validation can be used to evaluate the generalization ability of the model, the performance of the model can be optimized by adjusting the hyperparameters of the model, or an ensemble learning method can be used to combine the prediction results of multiple models to improve the accuracy of the overall prediction. The selection and implementation of these optimization strategies depends on the specific application scenario and data characteristics.

[0162] In one implementation, step S41 uses a comprehensive cost function to collaboratively train a temporary monitoring agent to obtain a flow monitoring agent, including:

[0163] Step S411: inputting the example monitoring flow data into the temporary coding sub-model, performing data coding on the example monitoring flow data, and generating a temporary dimensionality reduction feature representation, wherein the temporary dimensionality reduction feature representation represents a dimensionality reduction feature representation of the features of the example monitoring flow data extracted by using the temporary coding sub-model;

[0164] Step S412: input the temporary dimension reduction feature representation into the temporary monitoring agent to determine the comprehensive cost function;

[0165] Step S413: When the comprehensive cost function does not meet the comprehensive training stop index, optimizing the model variables of the temporary monitoring agent;

[0166] Step S414: When the comprehensive cost function meets the comprehensive training stop index, the temporary monitoring agent is used as the flow monitoring agent.

[0167] In step S411, the computer system inputs the example monitoring flow data into the temporary encoding sub-model to perform data encoding processing on it. The temporary encoding sub-model is an important component of the temporary monitoring agent, which is responsible for converting the high-dimensional example monitoring flow data into a low-dimensional temporary dimensionality reduction feature representation. This process is similar to the processing process of the data encoding sub-model mentioned above, but here, the temporary encoding sub-model is trained based on the current state of the temporary monitoring agent, so it can be dynamically adjusted according to the feedback during the collaborative training process. The temporary dimensionality reduction feature representation is a low-dimensional vector or matrix output by the temporary encoding sub-model, which contains the key information in the example monitoring flow data while removing redundancy and noise. This representation is the basis for the subsequent collaborative training steps because it will be input into the various sub-models of the temporary monitoring agent for analysis and prediction. In the electric vehicle charging scenario, the temporary dimensionality reduction feature representation may contain key features such as vehicle identification number, charging time, charging rate, payment amount, etc. These features are carefully selected and encoded by the temporary encoding sub-model and can reflect the key information of charging behavior.

[0168] Next, in step S412, the computer system inputs the temporary dimension reduction feature representation into the temporary monitoring agent to determine the comprehensive cost function. The comprehensive cost function is an indicator to measure the overall performance of the temporary monitoring agent, which integrates the cost functions of the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model (i.e., the first cost function, the second cost function and the third cost function). During the collaborative training process, the comprehensive cost function is used to evaluate the comprehensive performance of the temporary monitoring agent in predicting the range of abnormal data, identifying core abnormal data items and classifying abnormal types.

[0169] The calculation formula of the comprehensive cost function may involve multiple complex mathematical operations, such as weighted summation, cross entropy loss calculation, etc. Specifically, it can assign different weights according to the performance of the temporary monitoring agent on each subtask, and weighted sum the cost function values ​​of these subtasks to obtain the final comprehensive cost function value. For example, in the electric vehicle charging scenario, if the temporary monitoring agent performs well in predicting the range of abnormal charging duration, but performs poorly in identifying the core abnormal charging rate, then the comprehensive cost function can assign a lower weight to the cost function of predicting the range of abnormal charging duration, and assign a higher weight to the cost function of identifying the core abnormal charging rate to balance the overall performance.

[0170] In step S413, the computer system checks whether the comprehensive cost function meets the comprehensive training stop index. The comprehensive training stop index is a preset threshold or condition used to determine whether the temporary monitoring agent has been trained to a good enough degree that the collaborative training can be stopped to avoid overfitting or other problems. If the comprehensive cost function does not meet the comprehensive training stop index (i.e., its value is still high), then the computer system will optimize the model variables of the temporary monitoring agent.

[0171] This optimization process usually involves optimization techniques such as back-propagation algorithms and gradient descent. Specifically, the computer system adjusts the weights and biases of each sub-model in the temporary monitoring agent according to the gradient information of the comprehensive cost function to minimize the value of the comprehensive cost function. During the collaborative training process, the sub-models of the temporary monitoring agent will communicate and collaborate with each other. For example, the initialization monitoring sub-model can provide clues about the range of abnormal data for the initialization core abnormal data item monitoring sub-model, while the initialization classification sub-model can use the outputs of the initialization monitoring sub-model and the initialization core abnormal data item monitoring sub-model to more accurately classify the abnormal type. This collaborative mechanism helps to improve the overall performance of the temporary monitoring agent and make it more adaptable to complex and changeable practical application scenarios.

[0172] Finally, in step S414, if the comprehensive cost function meets the comprehensive training stop index (that is, its value has dropped below the preset threshold), the computer system will use the temporary monitoring agent as the final flow monitoring agent. This means that the temporary monitoring agent has passed the test of collaborative training and has the ability to accurately identify and analyze abnormal traffic in actual application scenarios. At this time, the computer system can deploy the flow monitoring agent to actual scenarios such as energy supply stations for real-time monitoring and analysis of data flows in and out of the supply station, and timely detection and response to potential security threats. Before deploying the flow monitoring agent to the actual scenario, the computer system may also need to perform a series of verification and testing on it. For example, an independent verification data set can be used to evaluate the generalization ability of the flow monitoring agent; various abnormal scenarios can be simulated to test its robustness and accuracy; and communication and coordination can be carried out with the managers of the energy supply station to ensure that the flow monitoring agent can be seamlessly connected with the actual business process.

[0173] In summary, the four sub-steps S411~S414 in step S41 together constitute the core mechanism of collaborative training. Through this process, the computer system can gradually optimize the performance of the temporary monitoring agent, and finally obtain an accurate, efficient and adaptable flow monitoring agent. This process not only relies on advanced machine learning algorithms and technologies, but also requires a deep understanding and analysis of application scenarios and data characteristics. By continuously optimizing and improving the collaborative training process, the performance and application effect of the flow monitoring agent can be further improved, providing more powerful support for the safe operation of actual scenarios such as energy supply stations.

[0174] An embodiment of the present invention provides a computer system, such as Figure 2 As shown, the computer system 100 includes: a processor 101 and a memory 103. The processor 101 and the memory 103 are connected, such as through a bus 102. Optionally, the computer system 100 may also include a transceiver 104. It should be noted that in actual applications, the transceiver 104 is not limited to one, and the structure of the computer system 100 does not constitute a limitation on the embodiments of the present invention.

[0175] An embodiment of the present invention provides a computer system. The computer system in the embodiment of the present invention includes: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory and configured to be executed by the one or more processors. When the one or more programs are executed by the processor, the method described above in the embodiment of the present invention is implemented.

Claims

1. A method for protecting energy supply stations based on edge computing, characterized in that: include: Acquire monitoring flow data of a target edge computing node, wherein the target edge computing node is an edge computing node deployed at an energy supply station, and the monitoring flow data is a data flow entering and leaving the energy supply station during a target monitoring period; The monitored traffic data is input into a traffic monitoring agent to obtain abnormal traffic monitoring results, wherein the abnormal traffic monitoring results include the abnormal data range, core abnormal data items, abnormal types corresponding to the abnormal data items, and abnormal support corresponding to the abnormal types obtained from the monitored traffic data; the traffic monitoring agent is a neural network obtained by training an initialized monitoring agent; the initialized monitoring agent includes an initialized monitoring sub-model, an initialized core abnormal data item monitoring sub-model, and an initialized classification sub-model; when the initialized monitoring sub-model, the initialized core abnormal data item monitoring sub-model, and the initialized classification sub-model are separately trained and converged, the initialized monitoring agent is collaboratively trained to obtain the traffic monitoring agent; Generate monitoring traffic annotation data based on the abnormal traffic monitoring result and the monitoring traffic data, wherein the monitoring traffic annotation data has the following tags: the abnormal data range, the core abnormal data item, the abnormal type and the support corresponding to the abnormal type; Before inputting the monitored traffic data into the traffic monitoring agent to obtain abnormal traffic monitoring results, the method further includes: Acquire example monitoring traffic data, wherein the example monitoring traffic data includes first example monitoring traffic data marked with example abnormal data range, second example monitoring traffic data marked with example core abnormal data items, and third example monitoring traffic data marked with example types corresponding to example data items and example support corresponding to the example types; Inputting the example monitored traffic data into an initialization encoding sub-model to obtain an example reduced-dimensionality feature representation, wherein the example reduced-dimensionality feature representation represents a reduced-dimensionality feature representation of traffic features extracted from the example monitored traffic data; The example dimensionality reduction feature representation is respectively input into the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model for separate training to obtain a temporary monitoring agent, wherein the temporary monitoring agent includes a temporary monitoring sub-model, a temporary core abnormal data item monitoring sub-model and a temporary classification sub-model, and the temporary monitoring sub-model, the temporary core abnormal data item monitoring sub-model and the temporary classification sub-model are each obtained by separate training according to their corresponding model training objectives, and the initialization monitoring agent includes the initialization encoding sub-model; Performing collaborative training on the temporary monitoring agent to obtain the flow monitoring agent; The initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model are separately trained in sequence in combination with the initialization encoding sub-model to obtain a temporary monitoring agent, including: The initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model are trained in sequence respectively using a comprehensive cost function in combination with the initialization encoding sub-model to obtain the temporary monitoring agent, wherein the comprehensive cost function is obtained by integrating the first cost function, the second cost function and the third cost function, when the temporary monitoring sub-model is obtained by training, the second cost function and the third cost function are shielded, when the temporary core abnormal data item monitoring sub-model is obtained by training, the first cost function and the third cost function are shielded, and when the temporary classification sub-model is obtained by training, the first cost function and the second cost function are shielded; The collaborative training of the temporary monitoring agent to obtain the flow monitoring agent includes: using the comprehensive cost function to collaboratively train the temporary monitoring agent to obtain the flow monitoring agent, wherein, in the collaborative training link, the first cost function, the second cost function and the third cost function are not shielded.

2. The method according to claim 1, characterized in that The step of inputting the monitored traffic data into a traffic monitoring agent to obtain abnormal traffic monitoring results includes: Inputting the monitoring traffic data into a data encoding sub-model, performing data encoding processing on the monitoring traffic data to obtain a coding feature representation, wherein the traffic monitoring agent includes the data encoding sub-model; Inputting the coded feature representation into the target monitoring sub-model, detecting abnormal information in the coded feature representation, and obtaining the abnormal data range, wherein the traffic monitoring agent includes the target monitoring sub-model; Input the encoded feature representation into a core abnormal data item monitoring sub-model, detect the core abnormal data item in the encoded feature representation, and obtain the core abnormal data item, wherein the traffic monitoring agent includes the core abnormal data item monitoring sub-model; Input the encoded feature representation into a target classification sub-model to obtain an abnormal type set, wherein the abnormal type set includes types corresponding to the abnormal data items and corresponding supports, and the traffic monitoring agent includes the target classification sub-model; The monitoring traffic annotation data is generated based on the abnormal data range, the core abnormal data items, the types corresponding to the abnormal data items and their corresponding supports, and the monitoring traffic data.

3. The method according to claim 2, characterized in that The step of inputting the monitored traffic data into a data encoding sub-model and performing data encoding processing on the monitored traffic data to obtain a coding feature representation includes: Inputting the monitored traffic data into a first encoding sub-model, performing dimensionality reduction processing on the monitored traffic data, and obtaining a first dimensionality reduction feature representation, wherein the feature length of the first dimensionality reduction feature representation is smaller than the monitored traffic data; The first dimensionality reduction feature representation is input into a second encoding sub-model, and the first dimensionality reduction feature representation is expanded and enhanced to obtain the encoding feature representation, wherein the feature length of the encoding feature representation is smaller than the monitoring flow data and larger than the first dimensionality reduction feature representation.

4. The method according to claim 1, characterized in that The step of inputting the example dimension reduction feature representation into the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model for separate training to obtain a temporary monitoring agent includes: If the example dimensionality reduction feature representation is associated with the first example monitored traffic data, inputting the example dimensionality reduction feature representation into the initialization monitoring sub-model to generate an estimated abnormal data range; determining the first cost function based on the estimated abnormal data range and the example abnormal data range; When the first cost function does not meet the first training stop indicator, optimizing the model variables of the initialization encoding sub-model and the initialization monitoring sub-model; When the first cost function meets the first training stop indicator, the initialized monitoring sub-model is used as the temporary monitoring sub-model.

5. The method according to claim 4, characterized in that If the example dimensionality reduction feature representation is associated with the first example monitoring traffic data, inputting the example dimensionality reduction feature representation into the initialization monitoring sub-model to generate an estimated abnormal data range includes: Input the example dimensionality reduction feature representation into the initialization monitoring sub-model, determine the estimated positioning data item, the estimated positioning data item fine-tuning amount, and the estimated length, wherein the estimated positioning data item and the estimated positioning data item fine-tuning amount are used to indicate the position of the estimated abnormal data range, and the estimated length is used to indicate the characteristic length of the estimated abnormal data range; The estimated abnormal data range is generated based on the estimated positioning data item, the estimated positioning data item fine-tuning amount, and the estimated length.

6. The method according to claim 1, characterized in that The step of inputting the example dimension reduction feature representation into the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model for separate training to obtain a temporary monitoring agent includes: When the example dimensionality reduction feature representation is associated with the second example monitored traffic data, inputting the example dimensionality reduction feature representation into the initialized core abnormal data item monitoring sub-model to generate an estimated core abnormal data item; determining the second cost function based on the estimated core anomaly data item and the example core anomaly data item; When the second cost function does not meet the second training stop index, optimizing the model variables of the initialization encoding sub-model and the initialization core abnormal data item monitoring sub-model; When the second cost function meets the second training stop indicator, determining the initialized core abnormal data item monitoring sub-model as the temporary core abnormal data item monitoring sub-model; Wherein, when the example dimensionality reduction feature representation is associated with the second example monitored traffic data, the example dimensionality reduction feature representation is input into the initialized core abnormal data item monitoring sub-model to generate an estimated core abnormal data item, including: Inputting the example dimensionality reduction feature representation into the initialized core abnormal data item monitoring sub-model to determine the number of estimated core abnormal data items and the position and support of each of the estimated core abnormal data items; Generate the estimated core abnormal data items based on the number of the estimated core abnormal data items and the position and support of each of the estimated core abnormal data items; Alternatively, the example dimension reduction feature representation is input into the initialization monitoring sub-model, the initialization core abnormal data item monitoring sub-model and the initialization classification sub-model for separate training to obtain a temporary monitoring agent, including: When the example dimensionality reduction feature representation is associated with the third example monitored traffic data, the example dimensionality reduction feature representation is input into the initialization classification sub-model to generate an estimated type corresponding to the estimated data item and an estimated support corresponding to the estimated type; Determine the third cost function based on the estimated type, the estimated support and the example type, the example support; When the third cost function does not meet the third training stop index, optimizing the model variables of the initialization encoding sub-model and the initialization classification sub-model; When the third cost function meets the third training stop indicator, using the initialized classification sub-model as the temporary classification sub-model; Wherein, when the example dimensionality reduction feature representation is associated with the third example monitoring flow data, the example dimensionality reduction feature representation is input into the initialization classification sub-model to generate an estimated type corresponding to the estimated data item and an estimated support corresponding to the estimated type, including: Input the example dimensionality reduction feature representation into the initialization classification sub-model to generate a traffic feature array, wherein the traffic feature array includes a preset number of types, and each element in the traffic feature array is used to represent the type of the corresponding data item and the corresponding support; The estimated type and the estimated support are generated based on the traffic feature array.

7. The method according to claim 1, characterized in that The step of using the comprehensive cost function to collaboratively train the temporary monitoring agent to obtain the flow monitoring agent includes: Inputting the example monitored traffic data into a temporary encoding sub-model, performing data encoding on the example monitored traffic data, and generating a temporary reduced-dimensionality feature representation, wherein the temporary reduced-dimensionality feature representation represents a reduced-dimensionality feature representation of features of the example monitored traffic data extracted by using the temporary encoding sub-model; Inputting the temporary dimension reduction feature representation into the temporary monitoring agent to determine the comprehensive cost function; When the comprehensive cost function does not meet the comprehensive training stop index, optimizing the model variables of the temporary monitoring agent; When the comprehensive cost function meets the comprehensive training stop index, the temporary monitoring agent is used as the traffic monitoring agent.

8. A computer system, characterized in that: include: one or more processors; Memory; one or more computer programs; The one or more computer programs are stored in the memory and configured to be executed by the one or more processors, and when the one or more computer programs are executed by the processors, the method according to any one of claims 1 to 7 is implemented.

Images