Highway toll anomaly monitoring and identification system

Abstract

This invention discloses a highway toll anomaly monitoring and identification system, belonging to the field of data analysis technology. By constructing a highway toll anomaly monitoring and identification system, it solves the problems of data synchronization delay, packet loss, and abnormal operation identification errors in traditional technologies. The system includes modules for data acquisition, feature extraction, real-time assessment, real-time classification, identification processing, and early warning. It can comprehensively collect, analyze, and evaluate monitoring data for special operations. By extracting transmission delay and data loss features, it uses machine learning models to evaluate the real-time performance of data synchronization, classifies data into high, medium, and low real-time levels, and takes targeted processing measures. High real-time data is prioritized for analysis of potential violations, low real-time data is used for equipment and network troubleshooting, and medium real-time data triggers early warnings by assessing the degree of anomaly, reminding maintenance personnel to handle the situation in a timely manner, thereby improving the accuracy, security, and stability of the toll collection system.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and particularly to a highway toll abnormal monitoring and identification system. Background Art

[0002] The highway toll abnormal monitoring and identification system is a core component in highway toll management, aiming to ensure the accuracy, fairness of toll operations and prevent violations. By real-time monitoring of special operations during the toll collection process, the system can identify and record abnormal operations such as manual lifting of the barrier, cancellation of the coil operation, reprinting invoices, modifying toll data, etc. The records of these operations will be automatically uploaded to the station-level system for further query and auditing by the system. The station-level program can review special operations and fill in corresponding conclusions to ensure that the operations of toll collectors are within the legal scope, thus effectively avoiding violations such as unauthorized release of vehicles. This system not only enhances the transparency of the toll collection link but also strengthens the timely intervention in abnormal situations, ensuring the fairness and standardization of highway tolls.

[0003] The existing technologies have the following deficiencies:

[0004] Highway toll systems usually rely on multiple stations and subsystems for data transmission and synchronization. Delays or failures in any link may lead to incorrect judgments on abnormal operations. If the monitoring data of special operations is not uploaded or synchronized to the central system in a timely manner, it may cause the system to fail to identify violations in a timely manner. In addition, problems such as packet loss, delay, and incorrect verification may occur during the data synchronization process, resulting in the monitoring system being unable to update in a timely manner, generating incorrect reports or missing key abnormal data. Summary of the Invention

[0005] The purpose of the present invention is to provide a highway toll abnormal monitoring and identification system to solve the deficiencies in the background art.

[0006] To achieve the above purpose, the present invention provides the following technical solutions: A highway toll abnormal monitoring and identification system, including a data acquisition module, a feature extraction module, a real-time evaluation module, a real-time division module, an identification and processing module, and an early warning module;

[0007] Data acquisition module: Generate corresponding timestamps for each special operation record in the station system and corresponding timestamps for each received special operation data in the central system, and collect various special operation monitoring data of different stations within several time periods.

[0008] Feature extraction module: Preprocess the collected special operation monitoring data, and extract features from the preprocessed special operation monitoring data, respectively extracting the transmission delay feature and data loss feature of the special operation monitoring data.

[0009] Real-time evaluation module: Based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of special operation monitoring data to the central system, and the real-time synchronization of special operation monitoring data to the central system is determined based on the output results of the machine learning model.

[0010] Real-time segmentation module: Based on the evaluation results, special operation monitoring data is divided into high real-time data, medium real-time data, and low real-time data, and processed accordingly;

[0011] Identification and processing module: Prioritizes real-time analysis of high-real-time data to quickly identify and handle potential violations; prioritizes investigation of sites, devices, and operations involving low-real-time data and alerts the operations and maintenance team for maintenance.

[0012] Early warning module: For medium real-time data, the system assesses the degree of real-time anomalies in the monitoring data of special operations within a fixed time period and synchronizes it to the central system. If the degree of anomaly is high, an anomaly alarm is issued to the relevant operation and maintenance personnel through the early warning system.

[0013] Preferably, in the feature extraction module, the data transmission delay fluctuation index is generated after analyzing the transmission delay characteristics of special operation monitoring data sent from the site system to the central system. The method for obtaining the data transmission delay fluctuation index is as follows:

[0014] Delayed time series Convert it into a vector sequence, and reconstruct the phase space using delayed embedding: Where: Y(t) is a vector representing the state of the system, m is the embedding dimension, which is usually selected by the time delay method, and τ is the delay time, which is selected as the time interval of the data sequence;

[0015] The distance between adjacent vectors is analyzed using the phase space trajectory Y(t) reconstructed through time series embedding, and the Euclidean distance between adjacent vectors Y(t) and Y(t+1) is calculated. The expression is: ;in, It is the i-th component in the phase space. Starting from the initial time t=0, a pair of trajectories is selected, and their distance is calculated. The distance between these two trajectories is tracked by time progression, and the increase in distance over time is calculated, i.e., the data transmission delay fluctuation index is calculated. The calculation formula is: Where d(t) is the distance at time t, d(0) is the distance at the initial time, t is time, and AD is the data transmission delay fluctuation index.

[0016] Preferably, in the feature extraction module, after analyzing the data loss characteristics that failed to reach the central system during special data transmission, a packet loss rate anomaly index is generated. The method for obtaining the packet loss rate anomaly index is as follows:

[0017] The acquired packet loss rate time series data is preprocessed by selecting wavelet basis functions. The basic formula for wavelet transform is: ;in, It is the result of wavelet transform, representing the transform coefficients of signal f(s) at scale a and position b. It is a wavelet basis function that decomposes the time-series data of packet loss rate into multiple different frequency bands. Based on the wavelet transform results, the coefficients of each frequency component are obtained. Let H(s) be the high-frequency component extracted from the wavelet transform, where s is the timestamp and H(s) represents the high-frequency fluctuation of the packet loss rate at time s. The standard deviation of the high-frequency component is calculated using the following expression: ;in: It is the standard deviation of the high-frequency components. Here, n is the mean of the high-frequency components, and n is the time length of the data, used to calculate volatility. : By combining standard deviation and volatility characteristics, an anomaly index for packet loss rate is calculated. ;in, This is an abnormal index for packet loss rate.

[0018] Preferably, in the real-time evaluation module, based on the extracted transmission delay characteristics and data loss characteristics of the special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of the special operation monitoring data to the central system, and the real-time synchronization of the special operation monitoring data to the central system is determined based on the output of the machine learning model. Specifically:

[0019] The data transmission delay fluctuation index and packet loss rate anomaly index are converted into a comprehensive feature vector. This comprehensive feature vector is used as the input to a machine learning model. The machine learning model aims to predict the real-time value label of the special operation monitoring data synchronization to the central system for each set of comprehensive feature vectors. The training objective is to minimize the sum of prediction errors for all special operation monitoring data synchronization to the central system. The machine learning model is trained until the sum of prediction errors converges, at which point the model training stops. The real-time value of the special operation monitoring data synchronization to the central system is determined based on the model output. The machine learning model is a multinomial regression model.

[0020] Preferably, in the real-time classification module, based on the evaluation results, the special operation monitoring data is divided into high real-time data, medium real-time data, and low real-time data, specifically as follows:

[0021] The real-time value of the acquired special operation monitoring data synchronized to the central system is compared with the gradient standard threshold. The gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold. The real-time value of the special operation monitoring data synchronized to the central system is compared with the first standard threshold and the second standard threshold respectively.

[0022] If the real-time value of the special operation monitoring data synchronized to the central system is greater than the second standard threshold, it indicates that the real-time performance of the special operation monitoring data synchronized to the central system is high. At this time, a high real-time signal is generated, and the special operation monitoring data is classified as high real-time data.

[0023] If the real-time performance of the special operation monitoring data synchronized to the central system is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it indicates that the real-time performance of the special operation monitoring data synchronized to the central system is average. At this time, a medium real-time signal is generated, and the special operation monitoring data is classified as medium real-time data.

[0024] If the real-time value of the special operation monitoring data synchronized to the central system is less than the first standard threshold, it indicates that the real-time performance of the special operation monitoring data synchronized to the central system is low. At this time, a low real-time signal is generated, and the special operation monitoring data is classified as low real-time data.

[0025] Preferably, in the early warning module, for medium real-time data, the degree of real-time anomaly in synchronizing special operation monitoring data to the central system within a fixed time period is evaluated, specifically as follows:

[0026] For real-time data, i.e., special operation monitoring data generated within a fixed time period that is synchronized to the central system with a real-time value greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the real-time value of special operation monitoring data generated within subsequent fixed time periods that is also greater than or equal to the first standard threshold and less than or equal to the second standard threshold is collected, a corresponding dataset is established, and the mean and standard deviation of the dataset are calculated. After analysis, the degree of real-time anomaly in the synchronization of special operation monitoring data to the central system within the fixed time period is evaluated.

[0027] Preferably, if the average real-time value in the dataset is greater than or equal to the reference threshold for the average real-time value, and the standard deviation of the real-time value is less than the reference threshold for the standard deviation of the real-time value, it indicates that although the overall real-time performance of the data synchronization is good, the fluctuation is large and the degree of abnormality is high. At this time, a first-level warning signal is generated, the emergency handling process is initiated, and maintenance personnel are prioritized to conduct investigations.

[0028] If the mean real-time performance value is greater than or equal to the reference threshold for the mean real-time performance value, and the standard deviation of the real-time performance value is greater than or equal to the reference threshold for the standard deviation of the real-time performance value, it indicates that the overall real-time performance of data synchronization is good, with small fluctuations and low abnormality. In this case, no warning signal is generated, and routine checks are performed on the relevant systems.

[0029] If the average real-time performance value is less than the reference threshold for the average real-time performance value, and the standard deviation of the real-time performance value is greater than or equal to the reference threshold for the standard deviation of the real-time performance value, it indicates that the overall real-time performance of data synchronization is poor, with large fluctuations and a high degree of abnormality. At this time, a level 2 warning signal is generated to identify and repair network bottlenecks or equipment failures.

[0030] If the average real-time performance value is less than the reference threshold for the average real-time performance value, and the standard deviation of the real-time performance value is less than the reference threshold for the standard deviation of the real-time performance value, it indicates that the overall real-time performance of data synchronization is poor, but the fluctuation is stable and the degree of abnormality is low. In this case, no warning signal is generated, and system optimization or scheduling adjustment is performed.

[0031] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0032] 1. This invention provides a method for accurately predicting and analyzing the real-time performance of data synchronization to a central system by comprehensively collecting and real-time evaluating the transmission latency and loss characteristics of monitoring data for special operations, combined with advanced machine learning algorithms. By classifying data into high, medium, and low real-time performance levels and implementing targeted processing, the system can efficiently identify potential violations, promptly detect and repair network or equipment failures, thereby improving system stability and accuracy. For medium real-time data, by assessing the degree of anomalies and generating early warning signals, sufficient warnings can be provided before potential problems occur, optimizing operation and maintenance processes and resource scheduling.

[0033] 2. This invention employs key indicators such as data transmission delay fluctuation index and packet loss rate anomaly index, combined with a multinomial regression model for real-time prediction, thereby effectively avoiding system misjudgments caused by data loss, delays, and other issues. The real-time assessment and early warning module can accurately classify warnings based on the quality of data synchronization, ensuring that abnormal operations are identified and handled promptly, improving the operational efficiency and security of the highway toll collection system. Through this system, maintenance personnel can prioritize handling potential problems in both high and low real-time data, significantly improving the accuracy and processing efficiency of monitoring data, ultimately optimizing the operation and management of the entire toll collection system. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0035] Figure 1 This is a system module diagram of the present invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] For examples, please refer to Figure 1 As shown, the highway toll anomaly monitoring and identification system described in this embodiment includes a data acquisition module, a feature extraction module, a real-time evaluation module, a real-time segmentation module, an identification processing module, and an early warning module.

[0038] Data acquisition module: Generates a corresponding timestamp for each special operation record in the site system and a corresponding timestamp for each received special operation data in the central system, and collects monitoring data of various special operations from different sites within several time periods;

[0039] Feature extraction module: preprocesses the collected special operation monitoring data and extracts features from the preprocessed special operation monitoring data, extracting transmission delay features and data loss features of the special operation monitoring data respectively;

[0040] Real-time evaluation module: Based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of special operation monitoring data to the central system, and the real-time synchronization of special operation monitoring data to the central system is determined based on the output results of the machine learning model.

[0041] Real-time segmentation module: Based on the evaluation results, special operation monitoring data is divided into high real-time data, medium real-time data, and low real-time data, and processed accordingly;

[0042] Identification and processing module: Prioritizes real-time analysis of high-real-time data to quickly identify and handle potential violations; prioritizes investigation of sites, devices, and operations involving low-real-time data and alerts the operations and maintenance team for maintenance.

[0043] Early warning module: For medium real-time data, the system assesses the degree of real-time anomalies in the monitoring data of special operations within a fixed time period and synchronizes it to the central system. If the degree of anomaly is high, an anomaly alarm is issued to the relevant operation and maintenance personnel through the early warning system.

[0044] In the data acquisition module of the highway toll collection system, special operations typically refer to abnormalities or operations that require manual intervention during the toll collection process, such as manually raising the barrier to release vehicles, canceling the coil operation, reprinting invoices, and modifying toll data (such as adjusting the amount or modifying the vehicle type). These operations need to be recorded and monitored by the system to ensure the accuracy of toll collection and prevent fraudulent activities.

[0045] Whenever a specific operation occurs, the site system needs to generate a timestamp for that operation at the moment the event occurs. A timestamp typically consists of two parts:

[0046] Local timestamp: A time stamp generated by the internal clock of the site equipment (such as toll booths and toll collector consoles) to mark the precise time when the operation occurred.

[0047] Global Standard Time: To ensure data synchronization across multiple sites, timestamps need to use a unified standard time source (typically Coordinated Universal Time (UTC) or time synchronized based on NTP (Network Time Protocol)). This ensures that data from different sites can be sorted and compared according to a unified standard.

[0048] Generating timestamps typically involves recording the time of an event immediately when the toll collection system detects a specific action. The timestamp is usually the system's current date and time (with precision down to the second or millisecond). It's crucial to ensure the local system clock is synchronized with a global standard clock to avoid time errors caused by clock drift. After recording the timestamp, the station system uploads this record along with other necessary operational information (such as toll amount, vehicle information, and toll collector ID) to the central system.

[0049] When a site system uploads special operation monitoring data, the central system receives and processes this data. Each uploaded data entry includes a local timestamp generated by the site system and a global standard time. The central system generates a reception timestamp for each received special operation data entry, identifying the time the data was received by the central system. This timestamp is typically generated based on the central system's clock but needs to be synchronized with the site system's clock. The reception timestamp is primarily used to: ensure the central system can correctly sort and synchronize special operation data from different sites according to the event occurrence time and data reception time; and calculate the data transmission delay by comparing the site timestamps and the central system timestamps.

[0050] The central system verifies whether the received timestamp matches the system's own timestamp. Significant discrepancies may indicate problems during data transmission (e.g., high network latency, equipment failure). To ensure clock synchronization between the site systems and the central system, the central system may periodically obtain time information from a unified time source (such as an NTP server) to guarantee global consistency of timestamps across all data.

[0051] In highway toll collection systems, multiple toll stations are typically located in different geographical areas. The special operation monitoring data of these stations needs to be collected and processed in real time by the central system. The special operation data for each station includes: a record of the specific operation that occurred at each station, a timestamp for each operation, and other related data such as toll amount, vehicle information, and toll collector ID. The data collection process involves each station uploading the special operation data in real time or in batches at set time intervals (e.g., per second, per minute). The station system then uploads the collected special operation data to the central system. Encrypted transmission (such as HTTPS or VPN) is typically used to ensure data security.

[0052] Because multiple sites operate simultaneously, their data needs to be uploaded and synchronized to the central system. To avoid data corruption caused by time asynchrony, the following measures are typically taken: Before the central system receives data, the site systems usually synchronize their clocks using standardized protocols (such as NTP or PPS). This ensures that timestamps are consistent across different sites. At the receiving end, the central system sorts special operation data from different sites to ensure processing according to the chronological order of events.

[0053] In addition to timestamps, the collected special operation data also includes a large amount of business data. The central system will further analyze and process this data, including: removing redundant or invalid data to ensure data quality; and assessing the transmission latency from the site system to the central system based on the timestamps. Based on characteristics such as timestamp differences and transmission latency, the monitoring system can identify potential abnormal operations or data transmission problems and issue early warnings.

[0054] In this application, within the highway toll collection system, the station system generates timestamps to accurately record the occurrence time of each special operation, while the central system generates reception timestamps to mark the data reception time. These timestamps not only help ensure data accuracy and consistency but also provide crucial support for subsequent data synchronization, latency analysis, and anomaly detection. By collecting and synchronizing data from different stations in real time, timely monitoring and effective management of special operations during the toll collection process can be ensured.

[0055] In the feature extraction module, preprocessing for special operation monitoring data in highway toll systems includes: removing outliers, erroneous data, or invalid data, such as incomplete records or incorrectly formatted data. It checks for missing fields (such as timestamps and toll amounts) and handles them through interpolation, padding, or deletion. For important fields, such as timestamps and operation types, missing values ​​can be estimated or supplemented. It ensures that timestamps are in a uniform format (e.g., ISO 8601 format) and performs time zone conversion, enabling consistent time-series analysis of data from different sites. It converts data to appropriate types (e.g., converting string-type timestamps to date types, or converting monetary data to floating-point numbers). It normalizes certain features (e.g., scaling features such as delay time and data size to a uniform range). This helps reduce scale differences among features in the model. It standardizes the data (e.g., subtracting the mean and dividing by the standard deviation) to ensure consistent variance during feature extraction, preventing bias in the model due to excessively large or small data scales.

[0056] Transmission delay is a characteristic that represents the time difference between the transmission of special operation monitoring data from the site system to the central system. It reflects the speed at which data is processed from generation to completion, helping to identify problems such as network latency or equipment failure. Transmission delay is typically measured by the difference between the timestamp generated by the site system and the timestamp when the central system receives the data. For each record, the formula is: Transmission Delay = Central System Timestamp - Site Timestamp; this gives the delay time for each special operation record, usually in milliseconds (ms). To analyze system performance in more depth, distribution characteristics of the delay can be extracted, such as: Maximum Delay: The slowest delay in historical data. Minimum Delay: The fastest data transmission time. Average Delay: The average delay over a period of time. Delay Fluctuation: The standard deviation of delay values, reflecting the stability of system transmission. Delay Percentiles: For example, 95% delay means that the transmission delay of 95% of the data is less than a certain value, providing a more granular understanding of delay performance.

[0057] Data loss characteristics indicate the percentage or amount of data that fails to reach the central system during data transmission. Data loss can be caused by network failures, equipment malfunctions, or system crashes, and reflects the reliability and stability of the system.

[0058] A fundamental metric for data loss is the packet loss rate. Each site system records the number of data packets sent and the number of data packets actually received; the number of lost packets can be calculated by the difference between the two. For specific operations that result in data loss, the number of lost records can be calculated directly. These records need to be retransmitted or repaired promptly. Correlating packet loss with time periods helps analyze whether the packet loss rate is higher during certain specific time periods (such as peak hours or when equipment load is high). This trend analysis helps identify potential system bottlenecks or network problems. Monitor whether data retransmission events occur in the system. After data loss, the site system will retransmit the lost data. Record the frequency and number of failures for each retransmission to assess network or system instability. By analyzing the types of lost data, distinguish which specific operation records are more likely to be lost (e.g., certain types of operations may be more prone to loss due to excessively large data packets or complex operations).

[0059] After analyzing the transmission delay characteristics of special operation monitoring data sent from the site system to the central system, a data transmission delay fluctuation index is generated. The method for obtaining the data transmission delay fluctuation index is as follows:

[0060] Delayed time series Convert it into a vector sequence, and reconstruct the phase space using delayed embedding: Where: Y(t) is a vector representing the state of the system, m is the embedding dimension, which is usually selected by the time delay method (such as the pseudo nearest neighbor method), and τ is the delay time, which is usually selected as the time interval of the data sequence or by calculating the autocorrelation function.

[0061] The distance between adjacent vectors is analyzed using the phase space trajectory Y(t) reconstructed through time series embedding, and the Euclidean distance between adjacent vectors Y(t) and Y(t+1) is calculated. The expression is: ;in, Let be the i-th component in the phase space. Starting from the initial time t=0, select a pair of very close trajectories, calculate their distance, and track the distance between these trajectories over time. Calculate the increase in distance over time, i.e., calculate the data transmission delay fluctuation index. The calculation formula is: Where d(t) is the distance at time t, d(0) is the distance at the initial time, t is time, and is usually calculated until convergence. AD is the data transmission delay fluctuation index.

[0062] A higher data transmission delay fluctuation index generally indicates greater delay volatility, poorer system stability, and higher uncertainty in transmission delay. This may indicate network congestion, equipment failure, or other abnormal conditions, leading to unstable data transmission and affecting the real-time performance of special operation monitoring data. In such cases, the system may be unable to synchronize special operation monitoring data to the central system in a timely manner, potentially causing delays or loss of critical abnormal operation data, resulting in the failure to promptly identify and handle unauthorized operations.

[0063] Conversely, a smaller data transmission latency fluctuation index indicates less latency fluctuation, a more stable system transmission process, and higher real-time performance. This means that special operation monitoring data can be quickly and stably synchronized to the central system, allowing the system to detect abnormal operations promptly and respond accordingly, ensuring the accuracy and fairness of the billing process. A low fluctuation index reflects the system's efficiency and reliability, making real-time data processing more timely and accurate, and reducing the risk of data loss and delay.

[0064] After analyzing the data loss characteristics that fail to reach the central system during special data transmission processes, a packet loss rate anomaly index is generated. The method for obtaining the packet loss rate anomaly index is as follows:

[0065] The acquired packet loss rate time-series data is preprocessed to remove noise and outliers (e.g., through median filtering, smoothing, etc.). The packet loss rate data is then standardized to ensure a uniform scale for easier subsequent analysis. An appropriate wavelet basis function, such as the Daubechies wavelet or Morlet wavelet, is selected. The basic formula for wavelet transform is: ;in, It is the result of wavelet transform, representing the transform coefficients of signal f(s) at scale a and position b. Wavelet transform is a basis function that decomposes time-series data on packet loss rate into multiple frequency bands (low-frequency and high-frequency components), reflecting the changes in data at different time scales. Based on the wavelet transform results, the coefficients of each frequency component are obtained, typically including low-frequency and high-frequency components. Low-frequency components correspond to the stationary portion of the data, representing long-term trends. High-frequency components correspond to the fluctuating portion of the data, representing short-term fluctuations or sudden events. The focus is primarily on the high-frequency components because abnormal packet loss usually manifests as short-term fluctuations or sudden events.

[0066] Let H(s) be the high-frequency component extracted from the wavelet transform, where s is the timestamp and H(s) represents the high-frequency fluctuation of the packet loss rate at time t. The standard deviation of the high-frequency component is calculated using the following expression: ;in: It is the standard deviation of the high-frequency components. This is the mean of the high-frequency components, and n is the time length of the data. (Calculate volatility) (Reflecting short-term fluctuations): By combining standard deviation and volatility characteristics, an anomaly index for packet loss rate is calculated. ;in, This is an abnormal index for packet loss rate.

[0067] A higher packet loss rate anomaly index indicates greater fluctuation and anomaly in the packet loss rate over a certain period, suggesting more packet loss during data transmission. An increased packet loss rate anomaly index typically means that the real-time performance of data synchronization is significantly affected, especially during peak periods or network congestion. The increased frequency of packet loss prevents timely and complete synchronization of special operation monitoring data to the central system. In such cases, the system may be unable to promptly identify or process violations, thereby impacting the overall efficiency and accuracy of the toll collection system.

[0068] A lower packet loss rate anomaly index indicates fewer packet losses, better stability during data transmission, and lower fluctuations in the packet loss rate. In this case, special operation monitoring data can be quickly and stably synchronized to the central system, demonstrating high real-time performance. The system can efficiently and accurately identify and handle abnormal operations, ensuring that data monitoring during the toll collection process is not affected by delays or loss, thereby guaranteeing the operational security and fairness of the toll collection system.

[0069] Real-time evaluation module: Based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of special operation monitoring data to the central system, and the real-time synchronization of special operation monitoring data to the central system is determined based on the output results of the machine learning model.

[0070] The data transmission delay fluctuation index and packet loss rate anomaly index are converted into a comprehensive feature vector. This comprehensive feature vector is used as the input to a machine learning model. The machine learning model aims to predict the real-time value label of the special operation monitoring data synchronization to the central system for each set of comprehensive feature vectors. The training objective is to minimize the sum of prediction errors for all special operation monitoring data synchronization to the central system. The machine learning model is trained until the sum of prediction errors converges, at which point the model training stops. The real-time value of the special operation monitoring data synchronization to the central system is determined based on the model output. The machine learning model is a multinomial regression model.

[0071] The method for obtaining the real-time value of special operation monitoring data synchronization to the central system is as follows: Obtain the corresponding function expression from the comprehensive feature vector training data of the trained machine learning model. In the formula, This is the output function of the model, where AD is the data transmission delay fluctuation index. This is an abnormal index for packet loss rate. Real-time values ​​for synchronizing monitoring data from special operations to the central system.

[0072] Real-time segmentation module: Based on the evaluation results, special operation monitoring data is divided into high real-time data, medium real-time data, and low real-time data, and processed accordingly;

[0073] The real-time value of the acquired special operation monitoring data synchronized to the central system is compared with the gradient standard threshold. The gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold. The real-time value of the special operation monitoring data synchronized to the central system is compared with the first standard threshold and the second standard threshold respectively.

[0074] If the real-time value of the special operation monitoring data synchronized to the central system is greater than the second standard threshold, it indicates that the real-time performance of the special operation monitoring data synchronized to the central system is high. At this time, a high real-time signal is generated, and the special operation monitoring data is classified as high real-time data.

[0075] If the real-time performance of the special operation monitoring data synchronized to the central system is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it indicates that the real-time performance of the special operation monitoring data synchronized to the central system is average. At this time, a medium real-time signal is generated, and the special operation monitoring data is classified as medium real-time data.

[0076] If the real-time value of the special operation monitoring data synchronized to the central system is less than the first standard threshold, it indicates that the real-time performance of the special operation monitoring data synchronized to the central system is low. At this time, a low real-time signal is generated, and the special operation monitoring data is classified as low real-time data.

[0077] Identification and processing module: Prioritizes real-time analysis of high-real-time data to quickly identify and handle potential violations; prioritizes investigation of sites, devices, and operations involving low-real-time data and alerts the operations and maintenance team for maintenance.

[0078] High-real-time data is immediately fed into the data analysis system for real-time monitoring and analysis of its validity. For example, the system will immediately detect unusual operations: manual bar raising, coil cancellation, invoice reprinting, and modification of billing data. Through rapid analysis, the system can quickly identify abnormal operations inconsistent with the normal billing process. For instance, if frequent manual bar raising or abnormal modification of billing data is detected, the system can immediately mark these operations as suspicious. If the analysis reveals potential violations, the system will trigger an automatic alarm, notifying relevant staff or the operations and maintenance team for manual verification. Alarms can be sent instantly via SMS, email, and system push notifications to ensure rapid staff response.

[0079] Once high-real-time data triggers an alert for a violation, the relevant operation will be suspended or terminated. Operators or supervisors can take immediate intervention measures based on the data analysis results, such as prohibiting specific operations (e.g., manual bar manipulation), enforcing manual review procedures, or shutting down abnormal equipment or sites. This can effectively prevent the violation from escalating or significantly impacting billing results.

[0080] Abnormal operations involving highly real-time data can also serve as evidence for subsequent audits and investigations. If a violation is confirmed, further investigation can help identify responsibility, implement necessary penalties, and strengthen the system's preventative measures against similar violations.

[0081] The system prioritizes investigating sites and devices generating low real-time data, including: analyzing network bandwidth bottlenecks and congestion, especially during high-traffic periods; checking the data transmission path between the site and the central system for delays, packet loss, or jitter; inspecting devices generating low real-time data for hardware failures (e.g., sensors, toll machines, gate devices) or software anomalies (e.g., system lag, system crashes); and checking the site's system configuration for data synchronization issues caused by improper configuration (e.g., out-of-sync system time, incorrect device parameter configuration).

[0082] The system automatically generates maintenance reminders and notifies the maintenance team via SMS, email, or instant messaging. The maintenance team needs to conduct a detailed investigation of the sites containing low real-time data and take appropriate maintenance measures. Common maintenance measures include: if network problems cause data transmission delays, adjusting bandwidth configurations, optimizing transmission paths, or temporarily increasing network resources to alleviate network burden. If equipment failure causes data to fail to upload in a timely manner, the faulty equipment should be repaired or replaced immediately to ensure normal equipment operation. If software or system failures cause data synchronization delays, software updates or system restarts should be performed promptly to restore normal system operation. For low real-time data, there may be issues with partial data loss or non-synchronization. To ensure data integrity, data replenishment and retransmission mechanisms can be activated. The system can re-request lost data packets or use cached data for replenishment to restore the system's normal data flow as much as possible. Handling low real-time data is not limited to troubleshooting; it requires continuous monitoring of the site's equipment and network status, assessing system stability, and preventing similar problems from recurring. Monitoring can be strengthened through the following measures:

[0083] Early warning module: For medium real-time data, the system assesses the degree of real-time anomalies in the monitoring data of special operations within a fixed time period and synchronizes it to the central system. If the degree of anomaly is high, an anomaly alarm is issued to the relevant operation and maintenance personnel through the early warning system.

[0084] For real-time data, i.e., special operation monitoring data generated within a fixed time period that is synchronized to the central system with a real-time value greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the real-time value of special operation monitoring data generated within subsequent fixed time periods that is also greater than or equal to the first standard threshold and less than or equal to the second standard threshold is collected, a corresponding dataset is established, and the mean and standard deviation of the dataset are calculated. After analysis, the degree of real-time anomaly in the synchronization of special operation monitoring data to the central system within the fixed time period is evaluated.

[0085] If the mean real-time performance value within the dataset is greater than or equal to the reference threshold for the mean real-time performance value, and the standard deviation of the real-time performance value is less than the reference threshold for the standard deviation of the real-time performance value, it indicates that the mean real-time performance value is high, but the standard deviation is also large. This means that although the overall real-time performance of data synchronization is good, the fluctuations are large and the degree of abnormality is high, which may pose potential risks and requires immediate handling. At this time, a level one warning signal is generated, the emergency handling process is initiated, the possible system problems are quickly located, and maintenance personnel are prioritized for investigation.

[0086] If the mean real-time performance value is greater than or equal to the reference threshold for the mean real-time performance value, and the standard deviation of the real-time performance value is greater than or equal to the reference threshold for the standard deviation of the real-time performance value, it indicates that the mean real-time performance value is high and the standard deviation is small. This means that the overall real-time performance of data synchronization is good, the fluctuation is small, and the degree of abnormality is low. However, certain checks are still required to ensure system stability. At this time, no warning signal is generated, and routine checks are performed on the relevant systems to ensure that there are no potential risks. If there are equipment aging or system load problems, timely optimization and adjustment are carried out.

[0087] If the mean real-time performance value is less than the reference threshold for the mean real-time performance value, and the standard deviation of the real-time performance value is greater than or equal to the reference threshold for the standard deviation of the real-time performance value, it indicates that the mean real-time performance value is low and the standard deviation is large. This indicates that the overall real-time performance of data synchronization is poor and fluctuates greatly, with a high degree of abnormality. This suggests that there may be problems such as network latency, equipment failure, or configuration errors. At this time, a level 2 warning signal is generated to conduct a detailed investigation of the factors affecting system stability, identify and repair network bottlenecks or equipment failures.

[0088] If the mean real-time performance value is less than the reference threshold for the mean real-time performance value, and the standard deviation of the real-time performance value is less than the reference threshold for the standard deviation of the real-time performance value, it indicates that the mean real-time performance value is low and the standard deviation is small. This means that the overall real-time performance of data synchronization is poor, but the fluctuation is stable and the degree of abnormality is low. There may be insignificant system load or configuration problems. In this case, no warning signal is generated, and system optimization or scheduling adjustment is performed. The stability of data synchronization is monitored regularly to ensure that system performance is improved.

[0089] It should be noted that Level 1 warning signals are of greater importance than Level 2 warning signals, and relevant personnel can take corresponding measures according to the different warning signal levels.

[0090] In this embodiment, a comprehensive monitoring and early warning system is formed through multiple functional modules, including data acquisition, feature extraction, real-time assessment, real-time classification, identification processing, and early warning modules. The system generates timestamps in both the station system and the central system, and collects special operation monitoring data from different stations and time periods. After preprocessing the data and extracting transmission delay and packet loss features, a machine learning model is used to assess the real-time performance of data synchronization. The assessment results are used to classify the data into high, medium, and low real-time performance data, and corresponding processing measures are taken. High real-time performance data is prioritized for analysis of potential violations, while low real-time performance data is prioritized for investigation of equipment and network problems. For medium real-time performance data, the system assesses the degree of synchronization real-time anomaly and issues an alarm through the early warning module when the anomaly is severe, reminding maintenance personnel to handle potential risks in a timely manner, thereby ensuring the stability and security of the highway toll collection system.

[0091] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0092] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0093] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A highway toll anomaly monitoring and identification system, characterized in that: It includes a data acquisition module, a feature extraction module, a real-time evaluation module, a real-time segmentation module, an identification and processing module, and an early warning module; Data acquisition module: Generates a corresponding timestamp for each special operation record in the site system and a corresponding timestamp for each received special operation data in the central system, and collects monitoring data of various special operations from different sites within several time periods; Feature extraction module: preprocesses the collected special operation monitoring data and extracts features from the preprocessed special operation monitoring data, extracting transmission delay features and data loss features of the special operation monitoring data respectively; Specifically, this includes: analyzing the transmission delay characteristics of special operation monitoring data sent from the site system to the central system to generate a data transmission delay fluctuation index. The method for obtaining the data transmission delay fluctuation index is as follows: [The text abruptly ends here, likely due to an incomplete sentence or a missing section.] Convert it into a vector sequence, and reconstruct the phase space using delayed embedding: Where: Y(t) is a vector representing the system state, m is the embedding dimension, selected using the time delay method, and τ is the delay time, chosen as the time interval of the data sequence; the phase space trajectory Y(t) reconstructed through time series embedding is analyzed to determine the distance between adjacent vectors, and the Euclidean distance between adjacent vectors Y(t) and Y(t+1) is calculated. The expression is: ;in, It is the i-th component in the phase space. Starting from the initial time t=0, a pair of trajectories is selected, and their distance is calculated. The distance between these two trajectories is tracked by time progression, and the increase in distance over time is calculated, i.e., the data transmission delay fluctuation index is calculated. The calculation formula is: Where d(t) is the distance at time t, d(0) is the distance at the initial time, t is time, and AD is the data transmission delay fluctuation index; Real-time evaluation module: Based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of special operation monitoring data to the central system, and the real-time synchronization of special operation monitoring data to the central system is determined based on the output results of the machine learning model. Real-time segmentation module: Based on the evaluation results, special operation monitoring data is divided into high real-time data, medium real-time data, and low real-time data, and processed accordingly; Identification and processing module: Prioritizes real-time analysis of high-real-time data to quickly identify and handle potential violations; prioritizes investigation of sites, devices, and operations involving low-real-time data and alerts the operations and maintenance team for maintenance. Early warning module: For medium real-time data, the system assesses the degree of real-time anomalies in the monitoring data of special operations within a fixed time period and synchronizes it to the central system. If the degree of anomaly is high, an anomaly alarm is issued to the relevant operation and maintenance personnel through the early warning system.

2. The highway toll anomaly monitoring and identification system according to claim 1, characterized in that: In the feature extraction module, data loss characteristics that fail to reach the central system during special data transmission processes are analyzed to generate a packet loss rate anomaly index. The method for obtaining the packet loss rate anomaly index is as follows: The acquired packet loss rate time series data is preprocessed by selecting wavelet basis functions. The basic formula for wavelet transform is: ;in, It is the result of wavelet transform, representing the transform coefficients of signal f(s) at scale a and position b. It is a wavelet basis function that decomposes the time-series data of packet loss rate into multiple different frequency bands. Based on the wavelet transform results, the coefficients of each frequency component are obtained. Let H(s) be the high-frequency component extracted from the wavelet transform, where s is the timestamp and H(s) represents the high-frequency fluctuation of the packet loss rate at time s. The standard deviation of the high-frequency component is calculated using the following expression: ;in: It is the standard deviation of the high-frequency components. Here, n is the mean of the high-frequency components, and n is the time length of the data, used to calculate volatility. : By combining standard deviation and volatility characteristics, an anomaly index for packet loss rate is calculated. ;in, This is an abnormal index for packet loss rate.

3. The highway toll anomaly monitoring and identification system according to claim 2, characterized in that: In the real-time evaluation module, based on the transmission delay characteristics and data loss characteristics of the extracted special operation monitoring data, a machine learning model is trained to predict the real-time synchronization of special operation monitoring data to the central system. The real-time synchronization of special operation monitoring data to the central system is then determined based on the output of the machine learning model. Specifically: The data transmission delay fluctuation index and packet loss rate anomaly index are converted into a comprehensive feature vector. This comprehensive feature vector is used as the input to a machine learning model. The machine learning model aims to predict the real-time value label of the special operation monitoring data synchronization to the central system for each set of comprehensive feature vectors. The training objective is to minimize the sum of prediction errors for all special operation monitoring data synchronization to the central system. The machine learning model is trained until the sum of prediction errors converges, at which point the model training stops. The real-time value of the special operation monitoring data synchronization to the central system is determined based on the model output. The machine learning model is a multinomial regression model.

4. The highway toll anomaly monitoring and identification system according to claim 3, characterized in that: In the real-time classification module, based on the evaluation results, the monitoring data for special operations is divided into high real-time data, medium real-time data, and low real-time data, specifically as follows: The real-time value of the acquired special operation monitoring data synchronized to the central system is compared with the gradient standard threshold. The gradient standard threshold includes a first standard threshold and a second standard threshold, and the first standard threshold is less than the second standard threshold. The real-time value of the special operation monitoring data synchronized to the central system is compared with the first standard threshold and the second standard threshold respectively. If the real-time value of the special operation monitoring data synchronized to the central system is greater than the second standard threshold, it indicates that the real-time performance of the special operation monitoring data synchronized to the central system is high. At this time, a high real-time signal is generated, and the special operation monitoring data is classified as high real-time data. If the real-time performance of the special operation monitoring data synchronized to the central system is greater than or equal to the first standard threshold and less than or equal to the second standard threshold, it indicates that the real-time performance of the special operation monitoring data synchronized to the central system is average. At this time, a medium real-time signal is generated, and the special operation monitoring data is classified as medium real-time data. If the real-time value of the special operation monitoring data synchronized to the central system is less than the first standard threshold, it indicates that the real-time performance of the special operation monitoring data synchronized to the central system is low. At this time, a low real-time signal is generated, and the special operation monitoring data is classified as low real-time data.

5. The highway toll anomaly monitoring and identification system according to claim 1, characterized in that: In the early warning module, for medium-real-time data, the degree of real-time anomaly in synchronizing special operation monitoring data to the central system within a fixed time period is assessed, specifically as follows: For real-time data, i.e., special operation monitoring data generated within a fixed time period that is synchronized to the central system with a real-time value greater than or equal to the first standard threshold and less than or equal to the second standard threshold, the real-time value of special operation monitoring data generated within subsequent fixed time periods that is also greater than or equal to the first standard threshold and less than or equal to the second standard threshold is collected, a corresponding dataset is established, and the mean and standard deviation of the dataset are calculated. After analysis, the degree of real-time anomaly in the synchronization of special operation monitoring data to the central system within the fixed time period is evaluated.

6. The highway toll anomaly monitoring and identification system according to claim 5, characterized in that: If the mean real-time performance value within the dataset is greater than or equal to the reference threshold for the mean real-time performance value, and the standard deviation of the real-time performance value is less than the reference threshold for the standard deviation of the real-time performance value, it indicates that although the overall real-time performance of the data synchronization is good, the fluctuation is large and the degree of abnormality is high. At this time, a level one warning signal is generated, the emergency handling process is initiated, and maintenance personnel are prioritized to conduct investigations. If the mean real-time performance value is greater than or equal to the reference threshold for the mean real-time performance value, and the standard deviation of the real-time performance value is greater than or equal to the reference threshold for the standard deviation of the real-time performance value, it indicates that the overall real-time performance of data synchronization is good, with small fluctuations and low abnormality. In this case, no warning signal is generated, and routine checks are performed on the relevant systems. If the average real-time performance value is less than the reference threshold for the average real-time performance value, and the standard deviation of the real-time performance value is greater than or equal to the reference threshold for the standard deviation of the real-time performance value, it indicates that the overall real-time performance of data synchronization is poor, with large fluctuations and a high degree of abnormality. At this time, a level 2 warning signal is generated to identify and repair network bottlenecks or equipment failures. If the average real-time performance value is less than the reference threshold for the average real-time performance value, and the standard deviation of the real-time performance value is less than the reference threshold for the standard deviation of the real-time performance value, it indicates that the overall real-time performance of data synchronization is poor, but the fluctuation is stable and the degree of abnormality is low. In this case, no warning signal is generated, and system optimization or scheduling adjustment is performed.

Images