Public data security management and control system and method based on multi-source data fusion

Abstract

The invention discloses a public data security management and control system and method based on multi-source data fusion, and relates to the technical field of data security management and control, and the method comprises the steps: obtaining a plurality of historical early warning records, extracting and analyzing the early warning time of each early warning record, and then extracting a feature record from the early warning records; obtaining a plurality of feature records in a plurality of historical days, setting a weight of each day, and obtaining a misinformation coefficient corresponding to each early warning node in each sub-period according to the early warning time and the early warning node corresponding to each feature record; and obtaining a to-be-detected early warning record, obtaining a first false alarm coefficient and a second false alarm coefficient corresponding to the to-be-detected early warning record, obtaining a false alarm rate of the to-be-detected early warning record, and judging whether to prompt the to-be-detected early warning record to related personnel according to the false alarm rate. According to the invention, analysis is carried out in combination with the historical early warning record, the reasonability of the current to-be-detected early warning record is judged, and related personnel are prompted in time, so that the data transmission efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management and control, and in particular to a public data security management and control system and method based on multi-source data fusion. Background Art

[0002] In IoT communication technology, data will pass through several intermediate nodes and networks during transmission. In order for data to accurately reach the destination address from the source address through several intermediate nodes and networks, it is crucial to ensure the consistency and timeliness of data in the entire transmission process. However, when data is transmitted at a certain node, due to noise, interference or equipment failure in the transmission process, data errors may occur during the transmission process. At this time, the error information will be sent to the upstream and downstream in time through the early warning mechanism. However, the existing early warning information is not analyzed in combination with historical warning information. Due to the imperfect monitoring mechanism or excessive sensitivity to data changes, false warning information may be generated, wasting manpower and time to deal with these false information, thereby reducing data transmission efficiency. Summary of the invention

[0003] The purpose of the present invention is to provide a public data security management and control system and method based on multi-source data fusion to solve the problems raised in the prior art.

[0004] To achieve the above object, the present invention provides the following technical solutions: The public data security management and control method based on multi-source data fusion includes the following steps: Step S100: Acquire several historical warning records, where the warning record is a record of abnormal data when the collected sensor values ​​are transmitted from the source address through several nodes to the target address, passing through a certain node; extract and analyze the warning time of each warning record, and then extract feature records from it; In this scheme, characteristic records are those records whose sensor data transmission duration at each node stage is relatively balanced compared with other warning records. The more balanced in this scheme is calculated based on other warning records and the average duration of all node stages of the record itself. Using such records for the following analysis will increase the reliability of the calculation results. Step S200: Acquire multiple feature records within several days of history, and set the weight corresponding to each day of history; divide a day into several sub-periods, and obtain the false alarm coefficient corresponding to each warning node in each sub-period according to the warning time and warning node corresponding to each feature record; Step S300: obtaining the sensor value corresponding to the node position where the warning occurs and the sensor value corresponding to the source address in the warning record to be detected, and obtaining the first false alarm coefficient corresponding to the warning record to be detected according to the corresponding sensor value and warning time in the feature record; Step S400: According to the false alarm coefficient corresponding to the warning node in each sub-period, the second false alarm coefficient corresponding to the current warning record to be detected is obtained, and according to the first false alarm coefficient, the false alarm rate of the warning record to be detected is obtained, and according to the false alarm rate, it is determined whether to prompt the warning record to be detected to the relevant personnel.

[0005] Furthermore, step S100 includes: Step S110: Obtain several historical warning records, where the warning record is a record of abnormal sensor values ​​transmitted to a certain node according to preset warning rules; extract the time when the sensor value corresponding to the warning record passes through each node from the source address to the target address, and take two adjacent nodes as a node stage. According to the time when each node is passed, obtain the stage duration corresponding to each node stage in the warning record; According to the stage duration of a certain node stage n in each warning record, the average value is calculated as the average duration D of a certain node stage n. n , and then the benchmark duration range of stage n is F n =(P 1 *D n ,P 2 *D n ), where P 1 is the first duration coefficient, P 2 is the second duration coefficient, 0 <P 1 <1 <P 2 , and obtain the benchmark duration range of each node stage; Step S120: Obtain the stage duration corresponding to each node stage in a certain warning record R, and obtain the average value of the difference between the stage duration of each node stage in the record R and the corresponding average duration; if the stage duration of each node stage in the record R is within the corresponding benchmark duration range, and the variance obtained based on the average values ​​of all differences is less than the preset variance threshold, then record R is used as a feature record, and then all feature records in the warning record are obtained.

[0006] Further, step S200 includes: Step S210: Divide a day into Q evenly spaced sub-periods, obtain a number of feature records within M historical days, and extract the warning time and warning node of each feature record, and record the number of nodes as B; according to the existing judgment method, determine whether each feature record is a false alarm record or a target record with a real warning, and obtain the number of false alarm records a of the b-th node in the q-th sub-period on the m-th day. 1 and the target number of records a 2 , and the false positive degree is C=a 1 / (a 1 +a 2 ); Step S220: Sort the days in the historical M days in order from the beginning to the end, and set the weight corresponding to each day according to the condition that the larger the serial number of the day, the larger the weight, and the sum of the weights of all days is 1; According to the false alarm degree and weight, the false alarm coefficient of the b-th node in the q-th sub-period is obtained as: , where M is the total number of days, W is m is the weight corresponding to the mth day, C is the false alarm degree corresponding to the qth sub-period of the bth node in the mth day, and then the false alarm coefficient corresponding to each node in each sub-period is obtained.

[0007] It should be noted that, for temperature values, there will generally be certain changes within a day, that is, in a fixed sub-period within a day, the temperature value will not usually change much, and because temperature will affect equipment performance and environmental conditions, and thus affect the false alarm situation, in this scheme, the false alarm coefficient corresponding to each sub-period should be different, and the following second false alarm coefficient is obtained according to different sub-periods within a day, which is reasonable for calculating the false alarm rate of the warning record to be detected and can improve the accuracy of the calculation results.

[0008] Furthermore, step S300 includes: Step S310: extracting a number of false alarm records obtained according to the existing judgment method, the sensor value is the temperature value, and the false alarm record is a record of transmitting the temperature value; respectively obtain the sensor value T corresponding to the source address of two adjacent false alarm records 1 and T 2 , and the warning time t of two adjacent false alarm records 1 and t 2 , we get the characteristic slope K=|(T 1 -T 2 ) / (t 1 -t 2 )|, where || is the absolute value, and all characteristic slopes are obtained, and the maximum characteristic slope is taken as K 1 ; Step S320: Obtain the sensor value S corresponding to the node position where the warning occurs in the warning record to be detected 1 The sensor value S corresponding to the source address 2 , if the value S 1 With the value S 2 Different, confirm that the warning record to be detected is a record of real warning; If the value S 1 With the value S 2 Similarly, obtain the sensor value S collected at the source address in the previous adjacent transmission record corresponding to the warning record to be detected3 , and the warning time of the warning record to be detected is taken as s 1 , the warning time of the transmission record adjacent to the previous time of the warning record to be detected is taken as s 2 , and the characteristic slope corresponding to the warning record to be detected is: K 2 =|(S 1 -S 3 ) / (s 1 -s 2 )|, and then obtain the first false alarm coefficient of the warning record to be detected , where e is the natural index and h is the adjustment factor coefficient.

[0009] Since the sensor value should be a fixed value when it goes from the source address to the target address through multiple nodes, when the value S 1 With the value S 2 The difference indicates that the warning record to be detected is a real warning record, not a false alarm. The characteristic slope expresses the change range of temperature over a period of time. Of course, the maximum characteristic slope K 1 It also represents the maximum temperature change. The larger the characteristic slope of the warning record to be detected, the greater the possibility of a false alarm.

[0010] Further, step S400 includes: obtaining a sub-period corresponding to the warning time of the warning record to be detected, and using the false alarm coefficient of the warning node corresponding to the warning record to be detected in the corresponding sub-period as the second false alarm coefficient X of the warning record to be detected. 2 , and then get the false alarm rate Z=X of the warning record to be detected 2 *(1-X 1 ), if the false alarm rate Z is greater than the preset false alarm rate threshold, the warning record to be detected will be promptly prompted to the relevant personnel.

[0011] In this scheme, the first false alarm coefficient X 1 is obtained based on the characteristic slope, with a value of [0,1). 1 The smaller it is, the closer the current warning record is to the situation obtained based on the normal record, and the greater the false alarm rate. The first false alarm coefficient X 2 is obtained based on the warning time, with a value of [0,1], X 2 The larger the value is, the greater the false alarm rate is, so the false alarm rate Z is [0,1]. The larger the false alarm rate Z is, the more likely it is that the warning record to be detected is a false alarm, and the warning record to be detected should be promptly notified to relevant personnel.

[0012] The public data security management and control system based on multi-source data fusion includes a feature record extraction module, a sub-period analysis module, a first false alarm coefficient calculation module and an early warning record prompt module; Feature record extraction module: used to obtain several historical warning records. Warning records are records of abnormal data when the collected sensor values ​​are transmitted from the source address to the target address through several nodes. The warning time of each warning record is extracted and analyzed, and then the feature records are extracted from it. Sub-period analysis module: used to obtain multiple feature records within several days of history and set the weight corresponding to each day of history; divide a day into several sub-periods, and obtain the false alarm coefficient corresponding to each warning node in each sub-period according to the warning time and warning node corresponding to each feature record; The first false alarm coefficient calculation module is used to obtain the sensor value corresponding to the node position where the warning occurs and the sensor value corresponding to the source address in the warning record to be detected, and obtain the first false alarm coefficient corresponding to the warning record to be detected according to the corresponding sensor value and warning time in the feature record; Warning record prompt module: used to obtain the second false alarm coefficient corresponding to the current warning record to be detected according to the false alarm coefficient corresponding to the warning node in each sub-period, and to obtain the false alarm rate of the warning record to be detected according to the first false alarm coefficient, and to determine whether to prompt the warning record to be detected to relevant personnel based on the false alarm rate.

[0013] Further, the feature record extraction module includes a reference duration range determination unit and a unit; The reference duration range determination unit is used to obtain a number of historical warning records, extract the time when the sensor value corresponding to the warning record passes through each node from the source address to the target address, obtain the stage duration corresponding to each node stage in the warning record, and then obtain the reference duration range of each node stage; Feature record extraction: used to obtain the stage duration corresponding to each node stage in the early warning record, and obtain the average value of the difference between the stage duration of each node stage in the record and the corresponding average duration, and obtain all feature records in the early warning record based on the benchmark duration range.

[0014] Further, the first false alarm coefficient calculation module includes a characteristic slope determination unit and a first false alarm coefficient calculation unit; Characteristic slope determination unit: used to extract a number of false alarm records obtained according to the existing judgment method, respectively obtain the sensor values ​​corresponding to the source addresses of two adjacent false alarm records, and the warning time of the two adjacent false alarm records, and obtain the characteristic slope; The first false alarm coefficient calculation unit is used to obtain the sensor value corresponding to the node position where the warning occurs in the warning record to be detected, and obtain the characteristic slope corresponding to the warning record to be detected, and then obtain the first false alarm coefficient of the warning record to be detected.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention provides a public data security management and control system and method based on multi-source data fusion, including: obtaining several historical warning records, extracting and analyzing the warning time of each warning record, and then extracting feature records therefrom; obtaining multiple feature records within several historical days, setting the weight of each day, and obtaining the false alarm coefficient corresponding to each warning node in each sub-period according to the warning time and warning node corresponding to each feature record; obtaining the warning record to be detected, obtaining the first false alarm coefficient and the second false alarm coefficient corresponding to the warning record to be detected, obtaining the false alarm rate of the warning record to be detected, and judging whether to prompt the warning record to be detected to the relevant personnel according to the false alarm rate. The present invention analyzes the warning records in combination with the historical warning records, judges the rationality of the current warning records to be detected, and prompts the relevant personnel in time, which helps to improve the efficiency of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of the public data security management and control method based on multi-source data fusion of the present invention; Figure 2 This is a structural diagram of the public data security management and control system based on multi-source data fusion of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] Example: Figure 1 As shown, the present invention provides a technical solution for a public data security management method based on multi-source data fusion, comprising the following steps: Step S100: Obtain several historical warning records. The warning record is a record of data anomalies when the collected sensor values ​​are transmitted from the source address to the target address through several nodes and pass through a certain node; extract and analyze the warning time of each warning record, and then extract feature records therefrom.

[0019] Step S110: Obtain several historical warning records, where the warning record is a record of abnormal sensor values ​​transmitted to a certain node according to preset warning rules; extract the time when the sensor value corresponding to the warning record passes through each node from the source address to the target address, and take two adjacent nodes as a node stage. According to the time when each node is passed, obtain the stage duration corresponding to each node stage in the warning record; According to the stage duration of a certain node stage n in each warning record, the average value is calculated as the average duration D of a certain node stage n. n , and then the benchmark duration range of stage n is F n =(P 1 *D n ,P 2 *D n ), where P 1 is the first duration coefficient, P 2 is the second duration coefficient, 0 <P 1 <1 <P 2 , and obtain the benchmark duration range of each node stage; Step S120: Obtain the stage duration corresponding to each node stage in a certain warning record R, and obtain the average value of the difference between the stage duration of each node stage in the record R and the corresponding average duration; if the stage duration of each node stage in the record R is within the corresponding benchmark duration range, and the variance obtained based on the average values ​​of all differences is less than the preset variance threshold, then record R is used as a feature record, and then all feature records in the warning record are obtained.

[0020] In this scheme, characteristic records are those records in which the transmission time of sensor data in each node stage is relatively balanced compared with the other warning records. The more balanced in this scheme is calculated based on other warning records and the average duration of all node stages of the record itself. Using such records for the following analysis will increase the reliability of the calculation results.

[0021] Step S200: Obtain multiple feature records within several historical days, and set the weight corresponding to each historical day; divide a day into several sub-periods, and obtain the false alarm coefficient corresponding to each warning node in each sub-period according to the warning time and warning node corresponding to each feature record.

[0022] Step S210: Divide a day into Q evenly spaced sub-periods, obtain a number of feature records within M historical days, and extract the warning time and warning node of each feature record, and record the number of nodes as B; according to the existing judgment method, determine whether each feature record is a false alarm record or a target record with a real warning, and obtain the number of false alarm records a of the b-th node in the q-th sub-period on the m-th day. 1 and the target number of records a2 , and the false positive degree is C=a 1 / (a 1 +a 2 ); Step S220: Sort the days in the historical M days in order from the beginning to the end, and set the weight corresponding to each day according to the condition that the larger the serial number of the day, the larger the weight, and the sum of the weights of all days is 1; In this embodiment, the weight of each day is set as follows: all serial numbers are added together to obtain a total serial number AL=1+2+…+M, and then the serial number corresponding to the m-th day is m, and the weight corresponding to the m-th day is m / AL. Similarly, the weight of each day can be obtained, and the weight of the day with a large serial number is greater than the weight of the day with a small serial number, and the sum of the weights of each day is 1; since the weight of each day is set, the weight of the day with a large serial number is greater than the weight of the day with a small serial number, and the sum of the weights of all days is 1, it can be achieved in the prior art, and there are many ways to set it. In this embodiment, only one of them is introduced, and the specific setting method can be set according to actual conditions.

[0023] According to the false alarm degree and weight, the false alarm coefficient of the b-th node in the q-th sub-period is obtained as: , where M is the total number of days, W is m is the weight corresponding to the mth day, C is the false alarm degree corresponding to the qth sub-period of the bth node in the mth day, and then the false alarm coefficient corresponding to each node in each sub-period is obtained.

[0024] It should be noted that, for temperature values, there will generally be certain changes within a day, that is, in a fixed sub-period within a day, the temperature value will not usually change much, and because temperature will affect equipment performance and environmental conditions, and thus affect the false alarm situation, in this scheme, the false alarm coefficient corresponding to each sub-period should be different, and the following second false alarm coefficient is obtained according to different sub-periods within a day, which is reasonable for calculating the false alarm rate of the warning record to be detected and can improve the accuracy of the calculation results.

[0025] Step S300: Obtain the sensor value corresponding to the node position where the warning occurs and the sensor value corresponding to the source address in the warning record to be detected, and obtain the first false alarm coefficient corresponding to the warning record to be detected based on the corresponding sensor value and warning time in the feature record.

[0026] Step S310: extracting a number of false alarm records obtained according to the existing judgment method, the sensor value is the temperature value, and the false alarm record is a record of transmitting the temperature value; respectively obtain the sensor value T corresponding to the source address of two adjacent false alarm records 1 and T 2, and the warning time t of two adjacent false alarm records 1 and t 2 , we get the characteristic slope K=|(T 1 -T 2 ) / (t 1 -t 2 )|, where || is the absolute value, and all characteristic slopes are obtained, and the maximum characteristic slope is taken as K 1 ; Step S320: Obtain the sensor value S corresponding to the node position where the warning occurs in the warning record to be detected 1 The sensor value S corresponding to the source address 2 , if the value S 1 With the value S 2 Different, confirm that the warning record to be detected is a record of real warning; If the value S 1 With the value S 2 Similarly, obtain the sensor value S collected at the source address in the previous adjacent transmission record corresponding to the warning record to be detected 3 , and the warning time of the warning record to be detected is taken as s 1 , the warning time of the transmission record adjacent to the previous time of the warning record to be detected is taken as s 2 , and the characteristic slope corresponding to the warning record to be detected is: K 2 =|(S 1 -S 3 ) / (s 1 -s 2 )|, and then obtain the first false alarm coefficient of the warning record to be detected , where e is the natural index and h is the adjustment factor coefficient.

[0027] Since the sensor value should be a fixed value when it goes from the source address to the target address through multiple nodes, when the value S 1 With the value S 2 The difference indicates that the warning record to be detected is a real warning record, not a false alarm. The characteristic slope expresses the change range of temperature over a period of time. Of course, the maximum characteristic slope K 1 It also represents the maximum temperature change. The larger the characteristic slope of the warning record to be detected, the greater the possibility of false alarm. Since y=1-e -x When x is x≥0, y is [0,1), which is a function in which y increases as x increases. When x is small, the increase in y is larger than when x is large. In this scheme, the first false alarm coefficient is calculated based on the characteristic slope K of the warning record to be detected. 2 and the maximum characteristic slope K1 To make a judgment, when K 2 / K 1 When it is small, it also indicates that there may be errors, and K 2 / K 1 The larger the value, the greater the possibility of error. 2 / K 1 When it is small, the first false alarm coefficient should also be large, so the function y=1-e should be used here. -x The design is carried out, and the adjustment factor coefficient h is used as the adjustment factor coefficient of the first false alarm coefficient, and its specific value should be determined according to the actual situation.

[0028] Step S400: According to the false alarm coefficient corresponding to the warning node in each sub-period, the second false alarm coefficient corresponding to the current warning record to be detected is obtained, and according to the first false alarm coefficient, the false alarm rate of the warning record to be detected is obtained, and according to the false alarm rate, it is determined whether to prompt the warning record to be detected to the relevant personnel.

[0029] Step S400 includes: obtaining a sub-period corresponding to the warning time of the warning record to be detected, and using the false alarm coefficient of the warning node corresponding to the warning record to be detected in the corresponding sub-period as the second false alarm coefficient X of the warning record to be detected. 2 , and then get the false alarm rate Z=X of the warning record to be detected 2 *(1-X 1 ), if the false alarm rate Z is greater than the preset false alarm rate threshold, the warning record to be detected will be promptly prompted to the relevant personnel.

[0030] In this scheme, the first false alarm coefficient X 1 is obtained based on the characteristic slope, with a value of [0,1). 1 The smaller it is, the closer the current warning record is to the situation obtained based on the normal record, and the greater the false alarm rate. The first false alarm coefficient X 2 is obtained based on the warning time, with a value of [0,1], X 2 The larger the value, the greater the false alarm rate, so the false alarm rate Z is [0,1], and the larger the false alarm rate Z is, the more likely the warning record to be detected is to be a false alarm, and the warning record to be detected should be promptly prompted to relevant personnel. In this embodiment, the false alarm rate threshold is 0.6, and the specific value should be determined according to the actual situation.

[0031] The present invention also provides a public data security management and control system based on multi-source data fusion, including a feature record extraction module, a sub-period analysis module, a first false alarm coefficient calculation module and an early warning record prompt module; Feature record extraction module: used to obtain several historical warning records. Warning records are records of abnormal data when the collected sensor values ​​are transmitted from the source address to the target address through several nodes. The warning time of each warning record is extracted and analyzed, and then the feature records are extracted from it. Sub-period analysis module: used to obtain multiple feature records within several days of history and set the weight corresponding to each day of history; divide a day into several sub-periods, and obtain the false alarm coefficient corresponding to each warning node in each sub-period according to the warning time and warning node corresponding to each feature record; The first false alarm coefficient calculation module is used to obtain the sensor value corresponding to the node position where the warning occurs and the sensor value corresponding to the source address in the warning record to be detected, and obtain the first false alarm coefficient corresponding to the warning record to be detected according to the corresponding sensor value and warning time in the feature record; Warning record prompt module: used to obtain the second false alarm coefficient corresponding to the current warning record to be detected according to the false alarm coefficient corresponding to the warning node in each sub-period, and to obtain the false alarm rate of the warning record to be detected according to the first false alarm coefficient, and to determine whether to prompt the warning record to be detected to relevant personnel based on the false alarm rate.

[0032] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A public data security management and control method based on multi-source data fusion, characterized in that: The following steps are involved: Step S100: Acquire several historical warning records, wherein the warning records are records of abnormal data when the collected sensor values ​​are transmitted from the source address through several nodes to the target address, and when passing through a certain node; extract and analyze the warning time of each warning record, and then extract feature records therefrom; Step S200: Acquire multiple feature records within several days of history, and set the weight corresponding to each day of history; divide a day into several sub-periods, and obtain the false alarm coefficient corresponding to each warning node in each sub-period according to the warning time and warning node corresponding to each feature record; Step S300: obtaining the sensor value corresponding to the node position where the warning occurs and the sensor value corresponding to the source address in the warning record to be detected, and obtaining the first false alarm coefficient corresponding to the warning record to be detected according to the corresponding sensor value and warning time in the feature record; Step S400: According to the false alarm coefficient corresponding to the warning node in each sub-period, the second false alarm coefficient corresponding to the current warning record to be detected is obtained, and according to the first false alarm coefficient, the false alarm rate of the warning record to be detected is obtained, and according to the false alarm rate, it is determined whether to prompt the warning record to be detected to the relevant personnel.

2. The public data security management and control method based on multi-source data fusion according to claim 1 is characterized in that: Step S100 includes: Step S110: Obtain several historical warning records, wherein the warning records are records of abnormal sensor values ​​transmitted to a certain node according to preset warning rules; extract the time when the sensor value corresponding to the warning record passes through each node from the source address to the target address, and regard two adjacent nodes as a node stage. According to the time when each node is passed, the stage duration corresponding to each node stage in the warning record is obtained; According to the stage duration of a certain node stage n in each warning record, calculate the average value as the average duration D of the certain node stage n n , and then obtain the reference duration range of stage n as F n =(P1*D n , P2*D n ), where P1 is the first duration coefficient, P2 is the second duration coefficient, 0 < P1 < 1 < P2, and obtain the reference duration range of each node stage; Step S120: Obtain the stage duration corresponding to each node stage in a certain warning record R, and obtain the average value of the difference between the stage duration of each node stage in the record R and the corresponding average duration; if the stage duration of each node stage in the record R is within the corresponding benchmark duration range, and the variance obtained based on the average value of all differences is less than a preset variance threshold, then the record R is used as a feature record, and then all feature records in the warning record are obtained.

3. The public data security management and control method based on multi-source data fusion according to claim 1 is characterized in that: Step S200 includes: Step S210: Divide a day into Q sub-periods with uniform time, obtain several feature records within the historical M days, and extract the warning time and warning node of each feature record, and record the number of nodes as B; according to the existing judgment method, judge whether each feature record is a false alarm record or a target record for real warning, obtain the number of false alarm records a1 and the number of target records a2 of the b-th node in the q-th sub-period on the m-th day, and obtain the false alarm degree C=a1 / (a1+a2); Step S220: Sort the days in the historical M days in order from the beginning to the end, and set the weight corresponding to each day according to the condition that the larger the serial number of the day, the larger the weight, and the sum of the weights of all days is 1; According to the false alarm degree and weight, the false alarm coefficient of the b-th node in the q-th sub-period is obtained as: , where M is the total number of days, W is m is the weight corresponding to the mth day, C is the false alarm degree corresponding to the qth sub-period of the bth node in the mth day, and then the false alarm coefficient corresponding to each node in each sub-period is obtained.

4. The public data security management and control method based on multi-source data fusion according to claim 3 is characterized in that: Step S300 includes: Step S310: extracting a number of false alarm records obtained according to the existing judgment method, where the sensor value is a temperature value, and the false alarm record is a record of transmitting the temperature value; respectively obtaining the sensor values ​​T1 and T2 corresponding to the source address of two adjacent false alarm records, and the warning times t1 and t2 of the two adjacent false alarm records, and obtaining a characteristic slope K=|(T1-T2) / (t1-t2)|, where || is the absolute value, and obtaining all characteristic slopes, and taking the maximum characteristic slope as K1; Step S320: Obtain the sensor value S1 corresponding to the node position where the warning occurs and the sensor value S2 corresponding to the source address in the warning record to be detected. If the value S1 is different from the value S2, confirm that the warning record to be detected is a record of a real warning. If the value S1 is the same as the value S2, obtain the sensor value S3 collected at the source address in the previous adjacent transmission record corresponding to the warning record to be detected, and use the warning time of the warning record to be detected as s1, and the warning time of the previous adjacent transmission record of the warning record to be detected as s2, and obtain the characteristic slope corresponding to the warning record to be detected: K2=|(S1-S3) / (s1-s2)|, and then obtain the first false alarm coefficient of the warning record to be detected , where e is the natural index and h is the adjustment factor coefficient.

5. The public data security management and control method based on multi-source data fusion according to claim 1 is characterized in that: Step S400 includes: obtaining the sub-period corresponding to the warning time of the warning record to be detected, and using the false alarm coefficient of the warning node corresponding to the warning record to be detected in the corresponding sub-period as the second false alarm coefficient X2 of the warning record to be detected, and then obtaining the false alarm rate Z=X2*(1-X1) of the warning record to be detected. If the false alarm rate Z is greater than the preset false alarm rate threshold, the warning record to be detected will be promptly notified to relevant personnel.

6. A public data security management and control system, used to execute the public data security management and control method based on multi-source data fusion as described in any one of claims 1 to 5, characterized in that: The system includes a feature record extraction module, a sub-period analysis module, a first false alarm coefficient calculation module and an early warning record prompt module; Feature record extraction module: used to obtain several historical warning records, which are records of abnormal data when the collected sensor values ​​are transmitted from the source address to the target address through several nodes; extract and analyze the warning time of each warning record, and then extract feature records from it; Sub-period analysis module: used to obtain multiple feature records within several days of history and set the weight corresponding to each day of history; divide a day into several sub-periods, and obtain the false alarm coefficient corresponding to each warning node in each sub-period according to the warning time and warning node corresponding to each feature record; The first false alarm coefficient calculation module is used to obtain the sensor value corresponding to the node position where the warning occurs and the sensor value corresponding to the source address in the warning record to be detected, and obtain the first false alarm coefficient corresponding to the warning record to be detected according to the corresponding sensor value and warning time in the feature record; Warning record prompt module: used to obtain the second false alarm coefficient corresponding to the current warning record to be detected according to the false alarm coefficient corresponding to the warning node in each sub-period, and to obtain the false alarm rate of the warning record to be detected according to the first false alarm coefficient, and to determine whether to prompt the warning record to be detected to relevant personnel based on the false alarm rate.

7. The public data security management and control system according to claim 6, characterized in that: The feature record extraction module includes a reference duration range determination unit and a unit; The reference duration range determination unit is used to obtain a number of historical warning records, extract the time when the sensor value corresponding to the warning record passes through each node from the source address to the target address, obtain the stage duration corresponding to each node stage in the warning record, and then obtain the reference duration range of each node stage; Feature record extraction: used to obtain the stage duration corresponding to each node stage in the early warning record, and obtain the average value of the difference between the stage duration of each node stage in the record and the corresponding average duration, and obtain all feature records in the early warning record based on the benchmark duration range.

8. The public data security management and control system according to claim 6, characterized in that: The first false alarm coefficient calculation module includes a characteristic slope determination unit and a first false alarm coefficient calculation unit; Characteristic slope determination unit: used to extract a number of false alarm records obtained according to the existing judgment method, respectively obtain the sensor values ​​corresponding to the source addresses of two adjacent false alarm records, and the warning time of the two adjacent false alarm records, and obtain the characteristic slope; The first false alarm coefficient calculation unit is used to obtain the sensor value corresponding to the node position where the warning occurs in the warning record to be detected, and obtain the characteristic slope corresponding to the warning record to be detected, and then obtain the first false alarm coefficient of the warning record to be detected.

Images