Method and related device for constructing urban safety knowledge graph based on AI big model

Abstract

The present invention relates to the technical field of security knowledge graphs, and discloses a method for constructing a city security knowledge graph based on an AI large model and a related device. The method comprises: performing vectorized feature extraction on multi-source city security event data to obtain a multidimensional feature matrix, and performing feature analysis through a BERT encoder, and performing key-value pair generation and feature processing on each group of query vectors in the obtained grouped query vector set; performing spatiotemporal correlation calculation on the event-related feature matrix to obtain an initial security knowledge graph, and performing graph neural network learning and event classification on the initial security knowledge graph to obtain event type division results; performing situation assessment index calculation on the event type division results to obtain security situation warning data; and performing knowledge graph update on the security situation warning data to obtain a city security knowledge graph. The present invention realizes accurate classification and situation assessment of security events and dynamic update of the city security knowledge graph.

Description

Technical Field

[0001] The present invention relates to the field of security knowledge graph technology, and in particular to a method and related device for constructing a city security knowledge graph based on an AI big model. Background Art

[0002] With the acceleration of urbanization and the development of information technology, urban security incidents are characterized by multi-source heterogeneity, dynamic evolution, and complex correlation. Traditional urban security management methods are unable to cope with the rapid growth of massive security incident data, and it is urgent to establish an intelligent security situation awareness system. Especially in complex urban environments, security incidents often have strong spatiotemporal correlations and propagation characteristics. The effective capture and analysis of these characteristics is crucial for accurately judging the security situation.

[0003] At present, although deep learning technology has made some progress in the field of security situation awareness, existing methods have many limitations when processing multi-source heterogeneous data. This is mainly reflected in the fact that the feature extraction of security event data is not comprehensive enough, it is difficult to effectively utilize the spatiotemporal correlation characteristics between events, and there is a lack of systematic methodological support in knowledge representation and reasoning. At the same time, the existing security event classification rule system is not perfect enough and cannot accurately describe the evolution characteristics and impact mechanisms of different types of security events. Summary of the invention

[0004] The present invention provides a method and related devices for constructing a city safety knowledge graph based on an AI big model, which realizes accurate classification and situation assessment of security incidents and dynamic updating of the city safety knowledge graph.

[0005] In a first aspect, the present invention provides a method for constructing a city safety knowledge graph based on a security situation awareness AI big model, and the method for constructing a city safety knowledge graph based on a security situation awareness AI big model comprises:

[0006] Vectorized feature extraction is performed on multi-source urban safety event data to obtain a multi-dimensional feature matrix, and the multi-dimensional feature matrix is ​​input into a BERT encoder for feature analysis, and key-value pair generation and feature processing are performed on each group of query vectors in the obtained grouped query vector set to obtain an event-related feature matrix;

[0007] Performing spatiotemporal correlation calculation on the event-related feature matrix to obtain an initial security knowledge graph, and performing graph neural network learning and event classification on the initial security knowledge graph to obtain an event type classification result;

[0008] Calculate the situation assessment index based on the event type classification results to obtain security situation warning data;

[0009] The knowledge graph of the security situation warning data is updated, and the initial security knowledge graph is continuously optimized through incremental learning methods and knowledge reasoning algorithms to obtain a city security knowledge graph.

[0010] In a second aspect, the present invention provides a device for constructing a city safety knowledge graph based on a security situation awareness AI big model, and the device for constructing a city safety knowledge graph based on a security situation awareness AI big model comprises:

[0011] The encoding module is used to perform vectorized feature extraction on multi-source urban safety event data to obtain a multi-dimensional feature matrix, and input the multi-dimensional feature matrix into a BERT encoder for feature analysis, and perform key-value pair generation and feature processing on each group of query vectors in the obtained grouped query vector set to obtain an event-related feature matrix;

[0012] An event classification module is used to perform spatiotemporal correlation calculation on the event association feature matrix to obtain an initial security knowledge graph, and perform graph neural network learning and event classification on the initial security knowledge graph to obtain an event type classification result;

[0013] A calculation module is used to calculate the situation assessment index based on the event type classification results to obtain security situation warning data;

[0014] The knowledge graph updating module is used to update the knowledge graph of the security situation warning data, continuously optimize the initial security knowledge graph through incremental learning methods and knowledge reasoning algorithms, and obtain a city security knowledge graph.

[0015] The third aspect of the present invention provides a computer device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the computer device executes the above-mentioned method for constructing a city safety knowledge graph based on the security situation awareness AI big model.

[0016] The fourth aspect of the present invention provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is run on a computer, it enables the computer to execute the above-mentioned method for constructing a city safety knowledge graph based on the security situation awareness AI big model.

[0017] In the technical solution provided by the present invention, the processing capability of multi-source heterogeneous security data is improved through the group query attention mechanism and feature mapping optimization, so that the model can more accurately extract and fuse the features of security events of different modes, and realize the comprehensive perception of the urban security situation. Based on the spatiotemporal correlation analysis and knowledge graph construction method, a systematic event correlation analysis framework is established, which can accurately characterize the propagation links and evolution laws between security events. By introducing graph neural network learning and three-dimensional rule system, accurate classification and situation assessment of security events are achieved, which greatly improves the recognition and early warning capabilities of complex security scenarios. By combining incremental learning and knowledge reasoning, the dynamic update and optimization of the knowledge graph are realized, ensuring the continuous adaptability and accuracy of the security situation awareness system. A complete security situation assessment indicator system is established, and the dynamic update of the urban security knowledge graph is realized through multi-dimensional feature fusion and dynamic monitoring mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1 A schematic diagram of the steps of a method for constructing a city safety knowledge graph based on a security situation awareness AI big model in an embodiment of the present invention;

[0020] Figure 2 It is a structural schematic diagram of a device for constructing a city safety knowledge graph based on a security situation awareness AI big model in an embodiment of the present invention;

[0021] Figure 3 It is a schematic block diagram of the structure of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0022] Embodiments of the present invention provide a method for constructing a city safety knowledge graph based on an AI large model and related devices. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of a method for constructing a city safety knowledge graph based on a security situation awareness AI big model in an embodiment of the present invention includes:

[0024] Step S1, performing vectorized feature extraction on multi-source urban safety event data to obtain a multi-dimensional feature matrix, and inputting the multi-dimensional feature matrix into a BERT encoder for feature analysis, performing key-value pair generation and feature processing on each group of query vectors in the obtained grouped query vector set, and obtaining an event-related feature matrix;

[0025] It is understandable that the execution subject of the present invention can be a device for constructing a city safety knowledge graph based on a security situation awareness AI big model, or a terminal or a server, which is not limited here. The embodiment of the present invention is described by taking a server as the execution subject as an example.

[0026] Specifically, data cleaning and standardization are performed on multi-source urban safety incident data to obtain a normalized data set. The goal of data cleaning is to remove outliers, fill in missing values, and perform consistency checks on data from different sources to ensure the accuracy and completeness of the data; standardization includes normalizing numerical data and encoding categorical data to facilitate subsequent feature extraction. After data preprocessing is completed, semantic information analysis is performed on the event description text in the normalized data set. Key entity, behavior, and attribute information are extracted from the text through natural language processing technology. For example, the named entity recognition algorithm is used to extract key entities such as subjects, locations, and tools involved in the event, and the behavior description and attribute features are mined through the relationship extraction model to generate a word vector feature sequence containing this information. This process implements semantic embedding through deep learning models (such as BERT or GPT), so that the high-dimensional semantic information of text data can be accurately captured and represented in a numerical form. At the same time, the spatial information in the normalized data set is geographically resolved. Unstructured street addresses, area names, and other information are converted into standard longitude and latitude coordinates through geocoding technology to form unified spatial features. Geocoding is implemented by calling the online map service API, and the coordinate information is integrated into the feature sequence through the vectorization method. Time series features are constructed based on the time field of the normalized dataset, and the date and time information is uniformly converted into Unix timestamp format to eliminate the differences between different time formats; periodic features are extracted based on timestamp data, such as the daily cycle, weekly cycle or annual cycle of events. These periodic features help analyze the regularity and trend of event occurrence. By performing statistical analysis on the time series, the time interval characteristics of event occurrence are calculated to enrich the time series feature vector. Based on the impact range information provided in the normalized dataset, the area and population density of the area affected by the event are calculated in combination with the geo-fence algorithm. For example, by drawing a geo-fence with a dynamic radius around the center point of the event and superimposing the regional population distribution data, the number and density of the population that the event may affect are estimated, and the impact range feature vector is generated. The word vector feature sequence, unified coordinate feature sequence, time series feature vector and impact range feature vector are sorted based on the event ID to ensure that each row corresponds to all the feature information of an event. Through standardization operations (such as Z-score or Min-Max normalization), different features are normalized to eliminate the influence between feature dimensions, ensure data comparability and computational efficiency, and obtain a multi-dimensional feature matrix. The multi-dimensional feature matrix is ​​grouped and queried for attention encoding to obtain an event-related feature matrix. Using the attention mechanism in deep learning, the correlation and importance between different features are captured by building an attention model based on query, key, and value. The feature matrix is ​​grouped according to feature type or source (for example, text features and spatiotemporal features are grouped), and the multi-head self-attention mechanism is applied to extract the mutual influence of intra-group and inter-group features.Integrate the attention encoding results of all groups to form a high-dimensional event-related feature matrix.

[0027] The multidimensional feature matrix is ​​input into the BERT encoder for feature analysis, which includes position encoding and word segmentation of the event feature sequence. Position encoding enables BERT to capture the position information in the sequence by assigning unique position information to each feature, while word segmentation decomposes text-like features into fine-grained semantic units to ensure that the encoding result can fully express the semantic structure of the feature. Through this step, the obtained encoded feature sequence contains a deep representation of event features in multiple dimensions such as semantics, time and space. The encoded feature sequence is grouped by query vectors. The encoded feature sequence is divided into multiple independent query vector groups, and the vectors in each group represent a specific type of event feature, such as spatial features, temporal features, text features, or impact range features. By dividing the query vector into m independent feature groups, the feature dimension is significantly reduced, which facilitates the refinement analysis and subsequent processing of features of different modalities, and obtains a set of grouped query vectors. Key-value pairs are generated in each query vector group, and a correlation calculation mechanism between features is established by defining the relationship between query, key and value. For each query vector group, the attention score between the query vector and the corresponding key-value pair is calculated. This calculation is completed through the dot product operation, and its result represents the correlation degree between the current query vector and other features in the group. By normalizing these scores, the in-group attention distribution is obtained, which reflects the importance weight of the features in the group. Feature mapping is performed on the in-group attention distribution. By projecting the features of different modalities into a unified semantic space, the differences between modalities are eliminated and their semantic consistency is enhanced to obtain the mapping feature vector. Cross-modal attention calculation is performed based on the mapping feature vector to analyze the correlation between different types of security features. By introducing the cross-modal attention mechanism, the model calculates the correlation weights of different modal features in the semantic space, namely the cross-modal attention weights. Multi-head attention fusion is performed on the cross-modal attention weights to capture richer feature correlations. Multi-head attention fusion improves the model's ability to represent complex feature interactions by calculating weight distributions in parallel on multiple attention heads and combining them to generate a fused attention matrix. Residual connection is performed based on the fused attention matrix to combine the original features and the attention features to make full use of the underlying information of the original data and the deep features mined by the attention mechanism to obtain the residual feature matrix. The residual feature matrix is ​​layer-normalized to eliminate the numerical differences between features. Layer normalization ensures the consistency of feature distribution by standardizing the mean and variance of each layer’s features, enhancing the model’s robustness and generalization ability to input features, and generating an event-related feature matrix.

[0028] Step S2: Calculate the spatiotemporal correlation of the event-related feature matrix to obtain an initial security knowledge graph, and perform graph neural network learning and event classification on the initial security knowledge graph to obtain event type classification results;

[0029] Specifically, the event correlation feature matrix is ​​separated into the time and space dimensions. By analyzing the time and space information in the event features, the event data is split into a time feature sub-matrix and a space feature sub-matrix. For the time feature sub-matrix, the time interval between events is calculated to construct a vector reflecting the time span of the event. By analyzing the order of occurrence and the interval length of events, an event temporal correlation matrix is ​​generated, which quantifies the temporal correlation between events. At the same time, the spatial distance calculation is performed on the spatial feature sub-matrix. Using geographic coordinate information, the spatial distance between events is calculated through the Euclidean distance, Manhattan distance or earth great circle distance formula to form an event distance measurement vector. After combining these vectors, an event spatial correlation matrix is ​​generated to reflect the spatial proximity and potential propagation paths between events. Based on the event temporal correlation matrix and the event spatial correlation matrix, a comprehensive weighted calculation is performed to obtain the event spatiotemporal correlation intensity matrix. Using weighted summation, kernel function mapping or Bayesian inference and other methods, the temporal and spatial correlations are fused according to certain weights to ensure that features of different dimensions can be effectively integrated. Threshold screening is performed on the spatiotemporal correlation intensity matrix, and a reasonable correlation threshold θ is set to screen out highly correlated event pairs and filter out low-correlation data. The screening results constitute an event correlation graph, in which nodes represent single events and edges represent strong correlations between events. Common features are extracted from event nodes in the event correlation graph, and the relationship between the attributes of each node and events is analyzed. By aggregating these features, knowledge entity nodes and relationship edges are constructed to generate a set of knowledge triples. These triples are represented in the form of "entity-relationship-entity", such as "event A-impact-event B" or "location X-inclusion-event Y", which intuitively describes events and their relationships. Based on the knowledge triple set, a knowledge structure graph is constructed according to the predefined ontology structure rules. The construction of the ontology structure organizes the hierarchical relationship between entities based on the knowledge architecture of a specific field. For example, events are layered by category (such as natural disasters, safety accidents, public health events, etc.), and the superior-subordinate relationship between entities is constructed by defining attribute relationships (such as time impact and spatial propagation). The generated knowledge structure graph is annotated with evolutionary paths, and the time series and associated propagation links of events are recorded to reflect the development and evolution logic of events and generate an initial security knowledge graph. The initial security knowledge graph is subjected to graph neural network learning. The attribute classification rule group is used to classify the attributes of nodes and edges in the graph to identify the key attributes of the event and its scope of influence. Combined with the impact assessment rule group, the potential impact of the event on the surrounding environment is analyzed, and its evolution trend is evaluated based on the propagation mode and correlation strength of the event. The dynamic correlation between events is mined through the evolution pattern rule group to build a comprehensive security event classification system. The graph neural network generates a high-dimensional feature representation that reflects the event classification results through node embedding, feature aggregation, and hierarchical learning, and divides the events into different types to obtain the event type classification results.

[0030] The initial security knowledge graph is input into the graph neural network model. By utilizing the characteristics of the graph neural network, deep learning and feature extraction are performed on the nodes in the graph. In this process, a node feature aggregation matrix is ​​constructed based on the neighbor information of the nodes, and the features of the nodes are aggregated layer by layer through graph convolution operations to capture the high-order correlation between the nodes. The aggregation process effectively utilizes the topological information and node attributes in the graph structure to generate a high-dimensional feature representation vector containing the overall structure of the graph. The event attribute features are extracted from the graph structure representation vector, and an attribute classification rule group with event name, event category and location as the core content is constructed. The role of the attribute classification rule group is to perform a preliminary classification of events, such as dividing events into basic types such as natural disasters, social security events or public facility failures. Through multi-layer clustering and rule matching of event attributes, a basic event type sequence is obtained. Based on the basic event type sequence, the impact degree is analyzed, and the degree of harm of the event is quantitatively calculated by constructing an impact assessment rule group including regional area and population density. The area of ​​the event affected area and the covered population density are calculated using the spatial impact range of the event (such as the geographical location and its affected radius) and population distribution data. These quantitative results are used to determine the hazard level of the event and form an important indicator for event impact assessment. Based on the hazard level of the event, its propagation path is analyzed. By constructing a propagation feature rule group including propagation speed, scope and diffusion direction, the diffusion law of the event in the time and space dimensions is extracted. Based on the analysis of the propagation path, time series analysis is performed. By constructing an evolutionary pattern rule group including duration, change trend and periodic law, the development trajectory of the event is deeply characterized. The construction of the evolutionary pattern rule group requires relying on time series data analysis technology, such as extracting the development trend of the event through time series decomposition, and combining historical data to analyze the periodic law of event occurrence, which helps to reveal the evolution characteristics of the event at different time stages. Combining the basic event type sequence, event hazard level, event propagation mode and event evolution characteristics, these features are comprehensively represented through multi-dimensional feature fusion technology to generate event feature vectors. The event feature vector is input into the graph attention classifier, and the different dimensions of the feature are weighted by using the attention mechanism. The attention mechanism automatically learns the importance weights of the features of each dimension to ensure that the classifier can focus on the classification according to the characteristics of a specific event and obtain accurate event type classification results.

[0031] Step S3, calculating the situation assessment index based on the event type classification results to obtain security situation warning data;

[0032] Specifically, according to the event type classification results, the classification results are statistically analyzed according to the event type dimension, and the occurrence frequency and weight distribution of each type of event in the window are calculated by setting a time window. The event frequency is calculated by counting the cumulative number of each type of event in the time window, while the weight distribution is weighted by combining factors such as the impact range, time span and propagation intensity of the event to generate importance indicators reflecting the characteristics of different event types. Through calculation, a type frequency vector is generated, which can quantitatively describe the occurrence law and distribution characteristics of each type of event in a given time period. Based on the type frequency vector, the event impact degree is evaluated and an impact degree vector is generated. The impact degree assessment needs to comprehensively consider factors such as the hazard level, propagation speed and scope of the event. For example, by combining the direct impact of the event (such as the loss area or the number of affected people) and the indirect impact (such as the possibility of chain reactions or secondary events in the surrounding areas), the comprehensive impact score of the event is calculated and converted into an impact degree vector. At the same time, in order to more comprehensively evaluate the potential risks of the event, the impact degree vector is subjected to correlation propagation analysis. By analyzing the geographical distribution and propagation links of events, calculating the diffusion trend of events in space and the potential risk transmission path, generating regional threat levels, and forming regional situation vectors, it effectively reflects the threat level and safety hazard level of events in different spatial ranges. Evaluate the event handling effect based on the regional situation vector. According to the regional situation vector, combined with the event handling strategy and response time, calculate the handling score vector. The generation of the handling score vector needs to comprehensively consider the response efficiency of various events, the rationality of resource allocation, and the final risk reduction degree. For example, by analyzing the risk reduction rate and the final impact degree of the event after emergency handling, the effectiveness of the handling is quantified to provide a basis for dynamically adjusting the security strategy. Perform weighted sum operations on the type frequency vector, the impact degree vector, the regional situation vector, and the handling score vector to generate a comprehensive situation assessment score. By setting the weights of different vectors, it ensures that the contributions of different dimensional features to the final assessment results are reasonable. Through the weighted sum operation, the features of each dimension are integrated to generate a quantitative score reflecting the current security situation, showing the overall status of the current city security. The situation assessment scores are graded according to the preset level thresholds, and the situation assessment scores are divided into different warning levels. Design the threshold range to ensure that the classification results can accurately reflect the actual risk situation. The classification method includes dividing the assessment scores into multiple levels such as "low risk", "medium risk", "high risk" and "extremely high risk", and each level corresponds to a different security management response strategy. After the classification is completed, a situation warning label is generated according to the warning level. Based on the situation warning label, a dynamic monitoring indicator system is constructed.The dynamic monitoring indicator system comprehensively considers multiple dimensions such as time, space and event characteristics. By updating data such as the frequency, propagation links and impact range of events in real time, it ensures that the system can respond quickly to changes in the situation and ultimately generate security situation warning data.

[0033] Step S4: Update the knowledge graph of the security situation warning data, continuously optimize the initial security knowledge graph through incremental learning methods and knowledge reasoning algorithms, and obtain the city security knowledge graph.

[0034] Specifically, event entities, attributes and relationship information are identified and extracted from security situation warning data. Through natural language processing (NLP) technology, named entity recognition (NER) algorithm and relationship extraction model, key elements related to the event are extracted from structured and unstructured data, including the name, time, location, category, scope of influence and the correlation between entities. The extracted information is screened through validity detection to ensure the accuracy and consistency of the new data. The validity detection content includes data format verification, logical consistency verification and duplication check. Through this step, a new knowledge sequence is generated. The initial security knowledge graph and the new knowledge sequence are merged to generate an extended knowledge structure. The new entities and relationships are de-duplicated and matched, and the node and edge structure of the existing graph are updated. For example, for a new event entity, if its attributes and relationships already exist partially in the initial graph, the new and old information are merged through the fusion algorithm, while avoiding the appearance of redundancy or contradiction. After the knowledge merger is completed, the extended knowledge structure is input into the incremental learning model, and the node representation and edge relationship of the graph are updated through online learning. The incremental learning model can quickly learn the features of the newly added data without retraining the entire graph, thereby dynamically optimizing the structure and content of the graph. Through this step, an incremental optimized graph is generated, which can reflect the impact of the newly added data on the urban security situation in real time and is highly dynamic and adaptable. Knowledge reasoning is performed based on the incremental optimized graph to discover implicit security risk links. The implementation of knowledge reasoning relies on rule linking and path mining algorithms. The former matches the nodes and relationships in the graph based on predefined logical rules to discover risk links that may exist but are not explicitly represented. The path mining algorithm uses the topological structure of the graph to mine potential causal relationships and influence chains from the connection paths between nodes. Through these reasoning processes, the reasoning knowledge results are obtained. Subgraphs are constructed for the reasoning knowledge results. Events and entities with high correlation in the reasoning knowledge results are aggregated to form a risk subgraph. The construction of the risk subgraph is based on similarity measurement and correlation analysis. For example, by calculating the semantic similarity or relationship weight between nodes, nodes and edges with strong correlation are screened out and organized into a complete subgraph. The urban safety knowledge graph is generated by combining the initial knowledge graph, the extended knowledge structure, the reasoning knowledge results and the risk subgraph. The graph contains comprehensive entity information and relationship data, and realizes dynamic update and implicit knowledge mining through incremental learning and knowledge reasoning.

[0035] In the embodiment of the present invention, the processing capability of multi-source heterogeneous security data is improved through the group query attention mechanism and feature mapping optimization, so that the model can more accurately extract and fuse the features of security events of different modes, and realize the comprehensive perception of the urban security situation. Based on the spatiotemporal correlation analysis and knowledge graph construction method, a systematic event correlation analysis framework is established, which can accurately describe the propagation links and evolution laws between security events. By introducing graph neural network learning and three-dimensional rule system, accurate classification and situation assessment of security events are realized, which greatly improves the recognition and early warning capabilities of complex security scenarios. By combining incremental learning and knowledge reasoning, the dynamic update and optimization of the knowledge graph are realized, ensuring the continuous adaptability and accuracy of the security situation awareness system. A complete security situation assessment indicator system is established, and the dynamic update of the urban security knowledge graph is realized through multi-dimensional feature fusion and dynamic monitoring mechanism.

[0036] In a specific embodiment, the process of executing step S1 may specifically include the following steps:

[0037] Perform data cleaning and standardization on multi-source urban safety event data to obtain a normalized data set, and extract key entity, behavior, and attribute information from the event description text in the normalized data set to obtain a word vector feature sequence;

[0038] Perform geographic location analysis on the spatial information in the normalized data set, convert street addresses and area names into longitude and latitude coordinates, and obtain a unified coordinate feature sequence;

[0039] Based on the time field of the normalized data set, the time series feature is constructed, the date and time information is converted into Unix timestamps and the time periodicity features are extracted to obtain the time series feature vector;

[0040] According to the impact range information in the normalized data set, the area and population density of the event affected area are calculated in combination with the geographic fence algorithm to obtain the impact range feature vector;

[0041] Based on the word vector feature sequence, unified coordinate feature sequence, time series feature vector and impact range feature vector, the event ID is sorted and standardized to obtain a multi-dimensional feature matrix.

[0042] The multi-dimensional feature matrix is ​​grouped and queried for attention encoding to obtain the event-related feature matrix.

[0043] Specifically, data cleaning and standardization are performed on the original urban safety incident data from various sources. Assuming that the original data contains event description text, spatial information, time field, and impact range information, the first step of data cleaning is to deal with missing values ​​and outliers. For numerical data, such as time fields and impact ranges, the missing values ​​are filled by using the mean filling method or the interpolation method based on historical data, while for text data, incomplete or erroneous descriptions are handled by semantic checking methods. Standardization is intended to eliminate dimensional differences between different data sources, such as for numerical data , converted to a standardized value through the normalization formula:

[0044] ;

[0045] in, and Represents a specific feature set The minimum and maximum values ​​of is the standardized feature value. After completing data standardization, feature extraction of event description text is performed. Through natural language processing technology, especially named entity recognition and relationship extraction models, key entities (such as location, time), behaviors (such as outbreak, diffusion) and attributes (such as scale, intensity) of events are extracted from the text. These extraction results are mapped to a high-dimensional semantic space to generate a word vector feature sequence. Assume that the length of the text sequence is , the dimension of each word vector is , then the generated word vector feature sequence is represented as a matrix:

[0046] ;

[0047] in, Indicates The vector representation of each word. For the spatial information in the data, parse its geographical location. Use geocoding technology to map the unstructured street address or area name to longitude and latitude coordinates. Assume that The coordinates of the records are expressed as , the coordinates of all records form a matrix:

[0048] ;

[0049] in, Indicates The longitude and latitude information of the record. The processing of the time field involves normalizing the time information into a numerical form. Convert the time data into a Unix timestamp , the formula is:

[0050] ;

[0051] in, Indicates the date and time of the event. Indicates the base time of January 1, 1970. In order to capture the periodic characteristics of time, sine and cosine functions are introduced for encoding. The calculation formula for periodic time characteristics is as follows:

[0052] ;

[0053] in, The total time length of a complete cycle. For the impact range information, the area and population density of the event-affected area are calculated based on the geo-fence algorithm. For example, for the impact center of an event and radius , the affected area is calculated by the following formula:

[0054] ;

[0055] If the population density of the area is known to be , then the total population impact is:

[0056] ;

[0057] The word vector feature sequence , unified coordinate feature matrix , time series feature vector and the influence range feature vector After sorting by event ID and performing standardization operations, a complete multi-dimensional feature matrix is ​​generated:

[0058] ;

[0059] The generated multi-dimensional feature matrix is ​​grouped and queried for attention encoding to mine the correlation between events. Assume that the query matrix, key matrix, and value matrix in the attention mechanism are , , , the attention weight is calculated by dot product and normalized as:

[0060] ;

[0061] in, For attention distribution, is the dimension of the key vector, is the scaling factor, Indicates the similarity between the query and the key. The final weighted output is:

[0062] ;

[0063] It is an event correlation feature matrix, which contains the deep relationship representation between events.

[0064] In a specific embodiment, the execution step performs grouping query attention coding on the multi-dimensional feature matrix to obtain the event-related feature matrix, which may specifically include the following steps:

[0065] Input the multidimensional feature matrix into the BERT encoder for feature analysis, perform position encoding and word segmentation on the event feature sequence to obtain a coded feature sequence, and group the coded feature sequence into query vectors, divide the query vectors into m independent feature groups, and obtain a grouped query vector set;

[0066] Generate key-value pairs for each query vector in the grouped query vector set, calculate the attention score of the query vector and the key-value pair, obtain the attention distribution within the group, perform feature mapping on the attention distribution within the group, project different modal features into a unified semantic space, and obtain a mapping feature vector;

[0067] Based on the mapped feature vector, cross-modal attention calculation is performed, correlation analysis is performed on different types of security features, cross-modal attention weights are obtained, and multi-head attention fusion is performed on the cross-modal attention weights to obtain a fused attention matrix;

[0068] Based on the fused attention matrix, residual connection is performed, the original features are combined with the attention features to obtain the residual feature matrix, and the residual feature matrix is ​​layer-normalized to obtain the event-related feature matrix.

[0069] Specifically, the multidimensional feature matrix Is A feature set consisting of event records, each of which contains The multi-dimensional feature matrix is ​​input into the BERT encoder for feature analysis, and the event feature sequence is segmented and position encoded. For the text part of the event description, it is decomposed into words or subword sequences through the pre-trained word segmenter; for the numerical features of other modalities, the feature discretization and block division are used to form inputs similar to word segmentation. Position encoding is to retain sequence information, using the formula:

[0070] ;

[0071] in, and The location The even and odd dimension position encoding values ​​of , is the feature dimension, is the current dimension index. Through position encoding, the position information is integrated into the feature representation to form a feature sequence input to the BERT encoder. The feature sequence is encoded through the multi-layer Transformer structure of BERT. The core of each layer is the self-attention mechanism, and its query, key and value are obtained by linear transformation of the input features respectively. The formula is:

[0072] ;

[0073] in, is a learnable weight matrix, are query, key, and value matrices respectively, is the dimension of each head in the attention mechanism. The weights are calculated by dot product attention:

[0074] ;

[0075] in, is the attention weight matrix, which indicates the strength of the relationship between different features. The weighted output is:

[0076] ;

[0077] is the encoded feature matrix, capturing the global correlation between features. The encoded feature sequence is grouped into query vectors, and the query vectors Divided into independent feature groups, each containing records. For each set of query vectors, generate corresponding key-value pairs, calculate the attention distribution within the group, and map them to a unified semantic space. Assume that The query vector for a group is , the keys and values ​​are and , the attention distribution within the group is:

[0078] ;

[0079] Its weighted output is:

[0080] ;

[0081] Mapping feature vector mapped to unified semantic space This is achieved through nonlinear transformations (such as activation functions):

[0082] ;

[0083] in, is the activation function, is the mapping matrix. The mapping eigenvectors based on all groups , perform cross-modal attention calculation to analyze the correlation between different types of security features. Let the cross-modal attention weight be , calculated as:

[0084] ;

[0085] in, Represents the cross-modal attention distribution between groups. Multi-head attention fusion is performed on the cross-modal attention weights. Assume that Attention heads, the output of each head is , the multi-head fusion is:

[0086] ;

[0087] Among them, Concat is a vector concatenation operation. is the fusion weight matrix. The fused attention matrix Perform residual connection with the original features, and the combination formula is:

[0088] ;

[0089] For the residual feature matrix Perform layer normalization, the normalization formula is:

[0090] ;

[0091] in, and are the mean and standard deviation of the features respectively. The normalized matrix It is the event-related feature matrix, which has the ability to capture deep-level correlations.

[0092] In a specific embodiment, the process of executing step S2 may specifically include the following steps:

[0093] Separate the event-related feature matrix in time and space dimensions, split the event features according to the time dimension and space dimension, and obtain the time feature sub-matrix and space feature sub-matrix;

[0094] The time interval of the time feature submatrix is ​​calculated to construct the event time span vector, and the event time series correlation matrix is ​​obtained. The spatial distance of the spatial feature submatrix is ​​calculated to construct the event distance measurement vector, and the event space correlation matrix is ​​obtained.

[0095] Based on the event temporal correlation matrix and the event spatial correlation matrix, a comprehensive weighted calculation is performed to obtain the event spatiotemporal correlation strength matrix, and the event spatiotemporal correlation strength matrix is ​​threshold screened, and the correlation threshold θ is set to screen the highly correlated event pairs to obtain the event correlation graph;

[0096] Extract common features from event nodes in the event association graph, construct knowledge entity nodes and relationship edges, and obtain a set of knowledge triples;

[0097] Construct the ontology structure based on the knowledge triple set, organize the hierarchical relationship between entities according to the predefined architecture, obtain the knowledge structure diagram, and annotate the evolution path of the knowledge structure diagram, record the event development and evolution sequence and related propagation links, and obtain the initial security knowledge graph;

[0098] Graph neural network learning is performed on the initial security knowledge graph, and a security incident classification system is constructed through attribute classification rule group, impact assessment rule group, and evolution pattern rule group to obtain the event type classification results.

[0099] Specifically, for the input event-related feature matrix ,in Indicates the number of events, Represents the feature dimension of each event. By analyzing the semantic attributes of the features, the matrix is ​​split according to the time dimension and the space dimension to obtain the time feature sub-matrix and the spatial eigenmatrix ,in and Represents the number of features in the time dimension and space dimension respectively, and satisfies . For the time feature sub-matrix Perform time interval calculations to quantify the temporal correlation between events. and The temporal characteristics of the events are and , the time interval is defined as:

[0100] ;

[0101] Calculate the time interval for all event pairs and construct the event time span vector , and the time interval is mapped to the time series correlation through the Gaussian kernel function:

[0102] ;

[0103] in, is a hyperparameter of the time scale, This is the event temporal correlation matrix. At the same time, the spatial feature submatrix Perform spatial distance calculations to quantify the geographical relevance of events. and The location coordinates of the event are and , the spatial distance is calculated by Euclidean formula:

[0104] ;

[0105] Similarly, the distance is mapped to spatial correlation through the Gaussian kernel function:

[0106] ;

[0107] in, is a hyperparameter of the spatial scale, This is the event space correlation matrix. Based on the temporal correlation matrix and spatial correlation matrix , perform comprehensive weighted calculation to obtain the event spatiotemporal correlation intensity matrix :

[0108] ;

[0109] in, is a weight parameter, which indicates the relative importance of time and space dimensions. In order to screen highly correlated event pairs, the spatiotemporal correlation strength matrix Perform threshold screening and set correlation threshold , only keep event pairs and construct an event association graph , where the node set Represents an event, an edge set Indicates a strongly associated event pair. In the event association graph, extract the common features of each node (such as time, location, event type), and combine the relationship features of the edges to construct knowledge entity nodes and relationship edges to form a knowledge triple set. ,in is the head entity, is the tail entity, is the relationship between the two. Based on the set of knowledge triples, the hierarchical relationship between entities is organized according to the predefined architecture to construct a knowledge structure graph. The knowledge structure graph forms a complete ontology structure by defining node types, hierarchical relationships, and contextual relevance. For example, events are classified into "natural disasters", "social security events", etc., and attributes (such as time, scope of impact) and relationships (such as impact, diffusion) are defined for each type of event. The evolution path of the knowledge structure graph is annotated to record the time series of events and related propagation links. The annotation is achieved by tracking the causal relationship and propagation path between nodes to obtain the initial security knowledge graph. On the generated initial security knowledge graph, deep learning is performed using graph neural networks to construct a security incident classification system. The graph neural network generates a high-dimensional representation vector of the event through feature aggregation of nodes and global information propagation. Assume that the nodes in the graph are represented as , the aggregation process is:

[0110] ;

[0111] in, For Node In the The feature vector of the layer, For Node The neighbor node set of , AGG is the aggregation function (such as average or weighted sum), are learnable weights, is the activation function. Combined with the attribute classification rule group, impact assessment rule group and evolution pattern rule group, we analyze the attributes of nodes, assess the impact scope and hazard level of events, and mine the time evolution pattern of events. Based on these features, we classify events into different types and obtain the event type classification results.

[0112] In a specific embodiment, the execution step performs graph neural network learning on the initial security knowledge graph, constructs a security event classification system through an attribute classification rule group, an impact assessment rule group, and an evolution pattern rule group, and the process of obtaining the event type classification result can specifically include the following steps:

[0113] The initial security knowledge graph is input into the graph neural network, a node feature aggregation matrix is ​​constructed based on the node's neighbor information, and multi-layer feature aggregation is performed on the knowledge entity nodes to obtain a graph structure representation vector.

[0114] Extract event attribute features from the graph structure representation vector, build an attribute classification rule group including event name, event category, and location, perform preliminary classification of security events based on event attributes, and obtain a basic event type sequence;

[0115] Based on the basic event type sequence, the impact degree is analyzed, and an impact assessment rule group including regional area and population density is constructed to quantitatively calculate the impact range of the event and obtain the event hazard level;

[0116] Analyze the event propagation path according to the event hazard level, construct a propagation feature rule group including propagation speed, scope, and diffusion direction, extract the event diffusion law, and obtain the event propagation model;

[0117] Conduct time series analysis on event propagation patterns, construct an evolution pattern rule group including duration, change trend, and periodic law, characterize the development trajectory of events, and obtain event evolution characteristics;

[0118] Based on the basic event type sequence, event hazard level, event propagation mode and event evolution characteristics, multi-dimensional feature fusion is performed to obtain the event feature vector;

[0119] The event feature vector is input into the graph attention classifier, and the security events are classified according to the feature weights of each dimension to obtain the event type classification result.

[0120] Specifically, the initial security knowledge graph is represented as a graph structure , where the node set Represents knowledge entities (such as events, places, time, etc.), edge sets Represents the relationship between nodes (such as influence, diffusion). The input of the graph includes the node feature matrix and the adjacency matrix ,in is the number of nodes, is the feature dimension of each node. Use graph neural network to aggregate multi-layer features of knowledge graph. Update node feature representation based on the information of neighbor nodes. Suppose node The characteristics are And its neighbor node set is , No. The feature update formula of the layer is:

[0121] ;

[0122] in, is a learnable weight matrix, AGG is an aggregation function (such as average, weighted sum, etc.), is the activation function (such as ReLU). This process gradually integrates the information of neighbor nodes into the central node through multi-layer aggregation to obtain the global graph structure representation vector . Representing vectors based on graph structures , extract event attributes (such as event name, category, and location) from the features of each node. By constructing an attribute classification rule group, the attribute features of the node are classified. For example, the semantic category is extracted based on the event name, the location is classified using the location feature, and the classification result is verified in combination with the contextual relationship in the graph. Assume that the classification rule group is based on the category vector of the node Represents that the preliminary classification of nodes can be achieved by the Softmax function:

[0123] ;

[0124] in, is the classification weight matrix, Is a node The characteristic vector of is the probability distribution of the node category. After this process, the basic event type sequence is generated. The impact degree of the basic event type sequence is analyzed and the impact assessment rule group is constructed, including the calculation of regional area and population density. Assume that the impact range of the event is the radius , the area of ​​the affected region is calculated as:

[0125] ;

[0126] If the population density of the area is , then the total population impact of the event is:

[0127] ;

[0128] Based on these quantitative indicators, assess the severity of the incident. For example, mapping hazard levels through a grading function:

[0129] ;

[0130] in, is the threshold for level division. Combined with the event hazard level, the event propagation path is analyzed to construct a propagation feature rule group. The key parameters of the propagation path include propagation speed , Scope and diffusion direction . Assume that the event starts from time Start spreading, at some point The propagation range is expressed as:

[0131] ;

[0132] Combining the propagation range and geographic location, the propagation direction of the event is represented by a vector:

[0133] ;

[0134] in, and are the initial position and propagation position of the event, respectively. Based on the propagation characteristics, the propagation mode of the event is analyzed in time series to extract the evolution characteristics including duration, change trend and periodic law. The duration is calculated by the start and end time difference of the event:

[0135] ;

[0136] The trend of change is obtained through regression analysis of time series, for example, using a linear regression model to fit the trend of the impact range over time. The periodic law is extracted through Fourier transform to extract the main periodic components. Combined with the basic event type sequence, event hazard level, event propagation mode and evolution characteristics, these multi-dimensional information are fused into event feature vectors. Assume that the weight of each feature is , the fusion formula is:

[0137] ;

[0138] Finally, the event feature vector is input into the graph attention classifier. The classifier assigns weights to different feature dimensions through a multi-head attention mechanism. The specific calculation is:

[0139] ;

[0140] in, are query, key, and value matrices respectively, is the scaling factor, is the attention distribution, It is The final classification result is obtained by fusing the outputs of all attention heads:

[0141] ;

[0142] in, is the classification weight matrix, is the final classification result of the node.

[0143] In a specific embodiment, the process of executing step S3 may specifically include the following steps:

[0144] According to the event type dimension, statistics are performed based on the event type classification results, and the occurrence frequency and weight distribution of each type of event in the time window are calculated to obtain the type frequency vector;

[0145] Evaluate the impact of the event based on the type frequency vector to obtain the impact vector, perform correlation propagation analysis on the impact vector, calculate the regional threat level based on the geographical distribution and propagation link of the event to obtain the regional situation vector, and evaluate the event handling effect based on the regional situation vector to obtain the handling score vector;

[0146] Perform a weighted sum operation on the type frequency vector, impact degree vector, regional situation vector and disposal score vector to obtain a situation assessment score;

[0147] The situation assessment scores are graded and divided into different warning levels according to the preset level thresholds to obtain situation warning labels. A dynamic monitoring indicator system is constructed based on the situation warning labels to obtain security situation warning data.

[0148] Specifically, according to the event type classification results, the events are classified and counted by type. Assume that the event type set is ,in is the total number of event types, for the time window , event type The frequency of occurrence within this time window Calculated by the formula:

[0149] ;

[0150] in, Yes Type The number of events, is the length of the time window. By counting the occurrence frequency of all event types, a type frequency vector is constructed. , which is used to describe the time distribution of different event types. After obtaining the type frequency vector, the impact of the event is evaluated based on the impact range and weight distribution of the event. The impact weight of each type of event is calculated by weighting multiple factors, such as the impact range , severity level and transmission intensity The comprehensive calculation formula of the impact weight is:

[0151] ;

[0152] in, is the normalized weight coefficient, which reflects the contribution of each factor to the total impact. and frequency ,type The total impact is expressed as:

[0153] ;

[0154] Summarize the impact of all event types and generate an impact vector Based on the influence vector Conduct correlation propagation analysis. Combine the geographical distribution and propagation links of the events to quantify the comprehensive threat level of the region. Assume that the region set is ,area The threat level of a is calculated by adding the impact of its covered events, using the formula:

[0155] ;

[0156] in, Indicates area Internal and Type A collection of related events. It is an event In the area By calculating the threat level of all regions, the regional situation vector is generated. Based on regional situation vector , to quantitatively evaluate the effect of event handling. The generation of the handling score vector needs to combine the event response time, handling resource investment and risk reduction degree. The treatment score is , calculated by the following formula:

[0157] ;

[0158] in, It is a region The risk reduction value within is the average response time of an event, is the disposal resource cost. Finally, the disposal score vector is constructed . In generating type frequency vector , influence degree vector , Regional Situation Vector and the disposition score vector Finally, these dimensions are combined through weighted summation to obtain the overall situation assessment score. The comprehensive calculation formula is:

[0159] ;

[0160] in, Represents the L1 norm of the vector, used to calculate the total amount, is the weighting coefficient, reflecting the importance of each vector in the assessment. The evaluation scores are divided into multiple warning levels according to the preset thresholds. For example, the warning level is set to "low risk" ( ), “Medium Risk” ( ), "High Risk" ( ) and "very high risk" ( ). Each level corresponds to a different response strategy. Through hierarchical calculation, a situation warning label is generated. A dynamic monitoring indicator system is constructed based on the situation warning label. The system combines real-time event data and historical trends to continuously update the risk status of each area and event type. For example, the threat level change trend of each area is calculated in real time through the sliding window method:

[0161] ;

[0162] At the same time, the overall situation is reviewed periodically to form a dynamic monitoring indicator system for the security situation and generate final security situation warning data.

[0163] In a specific embodiment, the process of executing step S4 may specifically include the following steps:

[0164] Identify and extract event entities, attributes and relationship information from security situation warning data, and perform validity tests to obtain new knowledge sequences;

[0165] Merge the initial security knowledge graph and the newly added knowledge sequence to obtain an extended knowledge structure, and input the extended knowledge structure into the incremental learning model. Update the node representation and edge relationship through online learning to obtain an incremental optimization graph.

[0166] Perform knowledge reasoning based on the incremental optimization graph, use rule linking and path mining algorithms to discover implicit security risk links, and obtain reasoning knowledge results;

[0167] Subgraphs are constructed for the inference knowledge results, and highly correlated events and entities are organized into risk subgraphs to obtain a city safety knowledge graph.

[0168] Specifically, natural language processing technology is used to identify and extract event entities, attributes, and relationship information from security situation warning data. Assume that the warning data contains event description text , through the named entity recognition (NER) model, from each text Extract the key entity set ,in Represents a specific entity. At the same time, the relationship extraction model is used to identify the relationship set between entities ,in Represents the relationship between two entities, such as "occurs in" or "results in". After the entities and relationships are extracted, the extraction results are tested for validity to ensure the quality of the newly added knowledge. Validity testing includes data integrity checking and logical consistency verification. For example, for an entity The attribute collection , verify whether the attribute conforms to the expected format through rule constraints (such as the time field should be a standardized date), and check the logical consistency between attribute values ​​(such as the event occurrence time cannot be later than the response time). Through these tests, a new knowledge sequence is generated , where each triple Represents the header entity ,relation and tail entity . Initial security knowledge graph With the new knowledge sequence Merge knowledge. The merging process involves deduplication matching of nodes and edges to avoid the introduction of redundant information. Assume that the node set of the newly added knowledge is And the edge set is , then the expanded graph is expressed as:

[0169] ;

[0170] in, The expanded knowledge structure is input into the incremental learning model, and the node representation and edge relationship of the graph are dynamically updated through online learning. Online learning uses an incremental optimization algorithm to adjust only the features of the newly added nodes and edges without retraining the entire model. , which represents the vector Update via neighbor aggregation:

[0171] ;

[0172] in, is a learnable weight matrix, is the activation function (such as ReLU), AGG is the aggregation function (such as average or weighted sum), Is a node The neighbor set of . After that, knowledge reasoning is performed based on the graph to discover implicit security risk links. The implementation of reasoning relies on rule linking and path mining algorithms. Rule linking is to match nodes and edges in the graph based on predefined rules. For example, if the rule For "If and ,but ", then by traversing the graph to find , and generate new inference relationships. Path mining uses the topological structure of the graph to analyze potential causal relationships. For example, if the path length is , for the starting node and the end node , the path probability is calculated by the following formula:

[0173] ;

[0174] in, Indicates the first Strip edge, It is the edge The reasoning knowledge results are transformed into risk subgraphs through subgraph construction. The core of subgraph construction is to aggregate highly correlated events and entities in the reasoning results. For example, for node pairs with strong correlation, the correlation weight is calculated to filter out those with correlation higher than the threshold. The node set:

[0175] ;

[0176] in, Represents the association weight of the node. Risk subgraph It is composed of the selected nodes and edges. Through the above steps, the generated urban safety knowledge graph dynamically updates entity and relationship information, and reveals implicit risk links through knowledge reasoning, forming a comprehensive perception of the security situation.

[0177] In this embodiment, when updating the knowledge graph of the security situation warning data, an iterative double cross-domain-center transfer matching algorithm is used to update the knowledge, including: cross-domain division of the security situation warning data and the urban safety knowledge graph, dividing the event nodes into circular subdomains with a radius R according to the geographic coordinates, setting the overlap rate of adjacent subdomains to α, and marking the overlapping area nodes based on the event type to obtain a multi-domain overlapping structure; calculating the central node for each subdomain in the multi-domain overlapping structure, calculating the node importance score according to the number of adjacent edges E of the node and the node feature vector f, selecting the node with the highest score as the domain center, and obtaining a central node set; constructing the central node set into a complete graph structure, calculating the cross-domain matching score between node pairs based on the shortest path distance and feature similarity between nodes, and obtaining an inter-domain matching matrix; threshold filtering the inter-domain matching matrix, and selecting the subdomain where the node pair with a matching score greater than the first target value is located as Candidate matching domains are selected, and an extended subgraph is constructed based on the first-order neighbor nodes of the central node to obtain a coarse matching domain pair; similarity calculation is performed on the non-central nodes in the coarse matching domain pair, and the attribute feature vector and local structure feature vector of the node are integrated to calculate the matching degree of the node pair to obtain a local node matching pair; a knowledge migration channel is constructed based on the local node matching pair, and the attribute labels and relationship edges of the nodes in the source domain are migrated to the target domain according to the matching correspondence, and the migration edges are weighted attenuated to obtain a migration rule set; conflict detection is performed on the migration rule set, and the logical consistency score is calculated based on the existing knowledge rules in the domain, and the rules with consistency scores lower than the second target value are deleted to obtain an optimized rule set; the optimized rule set is applied to the target domain, the attribute information and relationship edges of the nodes are updated, and the updated subdomains are re-divided and the central nodes are calculated to complete an iterative update, and the above process is repeated until convergence to obtain an updated urban safety knowledge graph.

[0178] The above describes the method for constructing a city safety knowledge graph based on a security situation awareness AI big model in an embodiment of the present invention. The following describes the device for constructing a city safety knowledge graph based on a security situation awareness AI big model in an embodiment of the present invention. Figure 2 In an embodiment of the present invention, an embodiment of a device for constructing a city safety knowledge graph based on a security situation awareness AI big model includes:

[0179] The encoding module is used to perform vectorized feature extraction on multi-source urban safety event data to obtain a multi-dimensional feature matrix, and to perform group query attention encoding on the multi-dimensional feature matrix to obtain an event correlation feature matrix;

[0180] The event classification module is used to calculate the spatiotemporal correlation of the event-related feature matrix to obtain the initial security knowledge graph, and to perform graph neural network learning and event classification on the initial security knowledge graph to obtain the event type classification result;

[0181] A calculation module is used to calculate the situation assessment index based on the event type classification results to obtain security situation warning data;

[0182] The knowledge graph update module is used to update the knowledge graph of security situation warning data, and continuously optimize the initial security knowledge graph through incremental learning methods and knowledge reasoning algorithms to obtain the city security knowledge graph.

[0183] Through the collaboration of the above components, the group query attention mechanism and feature mapping optimization have improved the processing ability of multi-source heterogeneous security data, enabling the model to more accurately extract and fuse the features of security events of different modalities, and achieve a comprehensive perception of the city's security situation. Based on the spatiotemporal correlation analysis and knowledge graph construction method, a systematic event correlation analysis framework has been established, which can accurately describe the propagation links and evolution laws between security events. By introducing graph neural network learning and a three-dimensional rule system, accurate classification and situation assessment of security events have been achieved, greatly improving the recognition and early warning capabilities of complex security scenarios. By combining incremental learning and knowledge reasoning, the knowledge graph is dynamically updated and optimized, ensuring the continuous adaptability and accuracy of the security situation awareness system. A complete security situation assessment indicator system has been established, and the dynamic update of the city's security knowledge graph has been achieved through multi-dimensional feature fusion and dynamic monitoring mechanisms.

[0184] Reference Figure 3 In an embodiment of the present invention, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a display screen, an input device, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the corresponding data in this embodiment. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the above method is implemented.

[0185] Those skilled in the art will understand that Figure 3The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied.

[0186] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above method is implemented. It can be understood that the computer-readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0187] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided by the present invention and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double-speed data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM.

[0188] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0189] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0190] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing a city safety knowledge graph based on a security situation awareness AI big model, characterized in that: The method comprises: Vectorized feature extraction is performed on multi-source urban safety event data to obtain a multi-dimensional feature matrix, and the multi-dimensional feature matrix is ​​input into a BERT encoder for feature analysis, and key-value pair generation and feature processing are performed on each group of query vectors in the obtained grouped query vector set to obtain an event-related feature matrix; The event-related feature matrix is ​​subjected to spatiotemporal correlation calculation to obtain an initial security knowledge graph, and the initial security knowledge graph is subjected to graph neural network learning and event classification to obtain an event type classification result; specifically, the method comprises: performing spatiotemporal dimension separation on the event-related feature matrix, splitting the event features according to the time dimension and the space dimension to obtain a time feature submatrix and a space feature submatrix; performing time interval calculation on the time feature submatrix to construct an event time span vector to obtain an event time series correlation matrix, and performing spatial distance calculation on the space feature submatrix to construct an event distance measurement vector to obtain an event space correlation matrix; performing comprehensive weighted calculation based on the event time series correlation matrix and the event space correlation matrix to obtain an event time series correlation matrix. The event association strength matrix is ​​obtained by threshold screening of the event spatiotemporal association strength matrix, and the association threshold θ is set to screen highly correlated event pairs to obtain an event association graph; common features are extracted from event nodes in the event association graph, knowledge entity nodes and relationship edges are constructed, and a knowledge triple set is obtained; an ontology structure is constructed based on the knowledge triple set, and the hierarchical relationship between entities is organized according to a predefined architecture to obtain a knowledge structure graph, and the evolution path of the knowledge structure graph is annotated to record the event development and evolution sequence and the associated propagation link to obtain an initial security knowledge graph; graph neural network learning is performed on the initial security knowledge graph, and a security event classification system is constructed through an attribute classification rule group, an impact assessment rule group, and an evolution pattern rule group to obtain an event type classification result; Calculate the situation assessment index based on the event type classification results to obtain security situation warning data; The knowledge graph of the security situation warning data is updated, and the initial security knowledge graph is continuously optimized through incremental learning methods and knowledge reasoning algorithms to obtain a city security knowledge graph.

2. The method for constructing a city safety knowledge graph based on a security situation awareness AI big model according to claim 1 is characterized in that: The vectorized feature extraction is performed on the multi-source urban safety event data to obtain a multi-dimensional feature matrix, and the multi-dimensional feature matrix is ​​input into the BERT encoder for feature analysis, and key-value pairs are generated and feature processed for each group of query vectors in the obtained grouped query vector set to obtain an event-related feature matrix, including: Perform data cleaning and standardization on multi-source urban safety event data to obtain a normalized data set, and extract key entity, behavior, and attribute information from the event description text in the normalized data set to obtain a word vector feature sequence; Performing geographic location analysis on the spatial information in the normalized data set, converting street addresses and area names into longitude and latitude coordinates to obtain a unified coordinate feature sequence; Based on the time field of the normalized data set, a time series feature is constructed, the date and time information is converted into a Unix timestamp and the time periodicity feature is extracted to obtain a time series feature vector; According to the impact range information in the normalized data set, the area and population density of the event affected area are calculated in combination with the geographic fence algorithm to obtain the impact range feature vector; Based on the word vector feature sequence, the unified coordinate feature sequence, the time series feature vector and the impact range feature vector, a standardized operation is performed by sorting by event ID to obtain a multi-dimensional feature matrix; The multi-dimensional feature matrix is ​​input into a BERT encoder for feature analysis, and key-value pairs are generated and feature processed for each group of query vectors in the obtained grouped query vector set to obtain an event-related feature matrix.

3. The method for constructing a city safety knowledge graph based on a security situation awareness AI big model according to claim 2 is characterized in that: The multidimensional feature matrix is ​​input into the BERT encoder for feature analysis, key-value pair generation and feature processing are performed on each group of query vectors in the obtained grouped query vector set to obtain an event-related feature matrix, including: Input the multidimensional feature matrix into the BERT encoder for feature analysis, perform position encoding and word segmentation processing on the event feature sequence to obtain a coded feature sequence, and perform query vector grouping on the coded feature sequence, divide the query vector into m independent feature groups, and obtain a grouped query vector set; Generating a key-value pair for each group of query vectors in the grouped query vector set, calculating the attention score of the query vector and the key-value pair, obtaining the attention distribution within the group, and performing feature mapping on the attention distribution within the group, projecting different modal features into a unified semantic space, and obtaining a mapping feature vector; Performing cross-modal attention calculation based on the mapped feature vector, performing correlation analysis on different types of security features to obtain cross-modal attention weights, and performing multi-head attention fusion on the cross-modal attention weights to obtain a fused attention matrix; Based on the fused attention matrix, residual connection is performed, the original features are combined with the attention features to obtain a residual feature matrix, and the residual feature matrix is ​​layer-normalized to obtain an event-related feature matrix.

4. The method for constructing a city safety knowledge graph based on a security situation awareness AI big model according to claim 1 is characterized in that: The graph neural network learning is performed on the initial security knowledge graph, and a security event classification system is constructed through an attribute classification rule group, an impact assessment rule group, and an evolution pattern rule group to obtain event type classification results, including: Input the initial security knowledge graph into the graph neural network, construct a node feature aggregation matrix based on the node neighbor information, perform multi-layer feature aggregation on the knowledge entity nodes, and obtain a graph structure representation vector; Extracting event attribute features from the graph structure representation vector, constructing an attribute classification rule group including event name, event category, and occurrence location, and preliminarily classifying security events according to event attributes to obtain a basic event type sequence; Based on the basic event type sequence, an impact degree analysis is performed, an impact assessment rule group including regional area and population density is constructed, and the event impact range is quantitatively calculated to obtain the event hazard level; Analyze the event propagation path according to the event hazard level, construct a propagation feature rule group including propagation speed, affected range, and diffusion direction, extract the event diffusion law, and obtain the event propagation model; Conducting a time series analysis on the event propagation pattern, constructing an evolution pattern rule group including duration, change trend, and periodic law, characterizing the event development trajectory, and obtaining the event evolution characteristics; Perform multi-dimensional feature fusion based on the basic event type sequence, the event hazard level, the event propagation mode and the event evolution characteristics to obtain an event feature vector; The event feature vector is input into the graph attention classifier, and the security events are classified according to the feature weights of each dimension to obtain the event type classification result.

5. The method for constructing a city safety knowledge graph based on a security situation awareness AI big model according to claim 4 is characterized in that: The calculating of situation assessment indexes on the event type classification results to obtain security situation warning data includes: Perform statistics based on the event type classification results according to the event type dimension, calculate the occurrence frequency and weight distribution of each type of event in the time window, and obtain a type frequency vector; Evaluate the impact of the event based on the type frequency vector to obtain an impact vector, perform correlation propagation analysis on the impact vector, calculate the regional threat level based on the geographical distribution and propagation link of the event to obtain a regional situation vector, and evaluate the event handling effect based on the regional situation vector to obtain a handling score vector; Performing a weighted sum operation on the type frequency vector, the impact degree vector, the regional situation vector, and the disposal score vector to obtain a situation assessment score; The situation assessment scores are graded, and the situation assessment scores are divided into different warning levels according to preset level thresholds to obtain situation warning labels, and a dynamic monitoring indicator system is constructed according to the situation warning labels to obtain security situation warning data.

6. The method for constructing a city safety knowledge graph based on a security situation awareness AI big model according to claim 5 is characterized in that: The updating of the knowledge graph of the security situation warning data, and the continuous optimization of the initial security knowledge graph through the incremental learning method and the knowledge reasoning algorithm to obtain the city security knowledge graph include: Identify and extract event entities, attributes and relationship information from the security situation warning data, and perform validity detection to obtain a newly added knowledge sequence; Merging the initial security knowledge graph and the newly added knowledge sequence to obtain an extended knowledge structure, inputting the extended knowledge structure into an incremental learning model, updating node representations and edge relationships through online learning, and obtaining an incremental optimization graph; Perform knowledge reasoning based on the incremental optimization graph, use rule linking and path mining algorithms to discover implicit security risk links, and obtain reasoning knowledge results; Subgraphs are constructed for the inference knowledge results, and highly correlated events and entities are organized into risk subgraphs to obtain a city safety knowledge graph.

7. A device for constructing a city safety knowledge graph based on a security situation awareness AI big model, characterized in that: Used to execute the method for constructing a city safety knowledge graph based on a security situation awareness AI big model according to any one of claims 1 to 6, the city safety knowledge graph construction device based on a security situation awareness AI big model comprises: The encoding module is used to perform vectorized feature extraction on multi-source urban safety event data to obtain a multi-dimensional feature matrix, and input the multi-dimensional feature matrix into a BERT encoder for feature analysis, and perform key-value pair generation and feature processing on each group of query vectors in the obtained grouped query vector set to obtain an event-related feature matrix; An event classification module is used to perform spatiotemporal correlation calculation on the event association feature matrix to obtain an initial security knowledge graph, and perform graph neural network learning and event classification on the initial security knowledge graph to obtain an event type classification result; A calculation module is used to calculate the situation assessment index based on the event type classification results to obtain security situation warning data; The knowledge graph updating module is used to update the knowledge graph of the security situation warning data, continuously optimize the initial security knowledge graph through incremental learning methods and knowledge reasoning algorithms, and obtain a city security knowledge graph.

8. A computer device, characterized in that: It includes a memory and a processor, the memory stores a computer program that can be run on the processor, and is characterized in that when the processor executes the computer program, it implements the method for constructing a city safety knowledge graph based on a security situation awareness AI big model as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the processor executes the method for constructing a city safety knowledge graph based on a security situation awareness AI large model as described in any one of claims 1 to 6.

Images