Alarm event dynamic adaptive prediction method and device, equipment and medium

Abstract

The invention provides an alarm event dynamic adaptive prediction method, which comprises the following steps: collecting historical alarm information, and preprocessing all the collected historical alarm information to obtain standard alarm data; performing feature extraction and selection on the standard alarm data to obtain a feature subset in the standard alarm data, and performing selection and verification to obtain a plurality of data training models; obtaining property information of the prediction task, and selecting a machine learning algorithm matched with the plurality of data training models according to the property information; training and verifying the plurality of data training models matched with the machine learning algorithm according to historical alarm information to obtain an adaptive prediction model; analyzing the real-time monitoring data, and predicting a to-be-generated alarm event to obtain an alarm type and an alarm source of the alarm event; and planning a response strategy of the alarm event according to the alarm type and the alarm source. According to the technical scheme of the embodiment, the accuracy and timeliness of alarm prediction can be improved.

Description

Technical Field

[0001] The present invention relates to the field of emergency warning technology, and in particular to a method, device, equipment and medium for dynamic adaptive prediction of alarm events. Background Art

[0002] In emergency systems, timely prediction and response to emergencies are the key to ensuring safety and reducing losses. With the advancement of science and technology, especially in the fields of data processing and analysis and machine learning, it has become possible to use historical data to predict future events. Alarm prediction is to predict possible abnormalities or alarms in the future based on the system's historical alarm data with the help of algorithms and models. However, the alarm event prediction method in the prior art lacks the ability to deeply analyze historical alarm data, and cannot effectively handle complex data patterns and dynamic changes, resulting in insufficient accuracy and timeliness of predicted alarms. Summary of the invention

[0003] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a method, device, equipment and medium for dynamic self-adaptation of alarm events, which can improve the accuracy and timeliness of predicted alarms.

[0004] In a first aspect, an embodiment of the present invention provides a method for dynamic adaptive prediction of an alarm event, comprising:

[0005] Collect historical alarm information, and perform preprocessing operations on all the collected historical alarm information to obtain standard alarm data;

[0006] Extracting and selecting features from the standard alarm data to obtain a feature subset in the standard alarm data and selecting the feature subset, verifying the selected feature subset according to a preset machine learning model, and obtaining a plurality of data training models;

[0007] Acquire property information of the prediction task, and select a machine learning algorithm that matches the multiple data training models according to the property information;

[0008] Obtaining a first data set and a first test set of the historical alarm information, training a plurality of the data training models matched with the machine learning algorithm according to the first data set, and verifying the trained data training models according to the first test set to obtain an adaptive prediction model;

[0009] The adaptive prediction model analyzes the real-time monitoring data, predicts the alarm event to be occurred, and obtains the alarm type and alarm source of the alarm event;

[0010] A response strategy for the alarm event is planned according to the alarm type and the alarm source.

[0011] In some embodiments of the present invention, the preprocessing operation of all the collected historical alarm information to obtain standard alarm data includes:

[0012] Standardizing the historical alarm information to obtain unified alarm data;

[0013] Performing data verification on the unified alarm data to confirm whether there are any missing records in the unified alarm data;

[0014] When there are missing records in the unified alarm data, missing value processing is performed on the unified alarm data to fill in the unified alarm data, and missing value processing is performed on the filled unified alarm data to obtain complete report data;

[0015] When there is no missing record in the unified alarm data, directly performing missing value processing on the unified alarm data to obtain the complete alarm data;

[0016] The complete alarm data is converted, and feature selection is performed on the complete alarm data after the data conversion to obtain the standard alarm data.

[0017] In some embodiments of the present invention, the step of standardizing the historical alarm information to obtain unified alarm data includes:

[0018] Obtaining the original value, maximum value and minimum value of the historical alarm information;

[0019] Obtaining a normalized first processed value of the historical alarm information according to the original value, the maximum value, and the minimum value;

[0020] Obtaining a sample mean and a sample standard deviation of the historical alarm information, and obtaining a standardized second processed value of the historical alarm information according to the sample mean and the sample standard deviation;

[0021] Unified alarm data is obtained according to the first processed value and the second processed value.

[0022] In some embodiments of the present invention, the performing missing value processing on the unified alarm data to obtain the complete alarm data includes:

[0023] Acquire a first data point and a second data point in the unified alarm data;

[0024] When the missing data point is between the first data point and the second data point, a linear interpolation value of the missing data point is calculated according to the first data point, the second data point and the missing data point;

[0025] Obtaining independent variables and dependent variables in the unified alarm data, determining a linear relationship between the independent variables and the dependent variables, and obtaining a fitting straight line between the independent variables and the dependent variables;

[0026] Obtaining the independent variable observation value of the independent variable, the dependent variable observation value of the dependent variable and the total sample volume of the unified alarm data;

[0027] Calculate the first coefficient and the second coefficient of the fitting straight line according to the independent variable observation value, the dependent variable observation value and the total sample size;

[0028] The missing value of the unified alarm data is predicted according to the first coefficient and the second coefficient.

[0029] In some embodiments of the present invention, verifying the trained data training model according to the first test set includes:

[0030] Dividing the standard alarm data into an independent first training set and a second test set;

[0031] Cross-validating the first training set and the second test set to obtain hyperparameters of the standard alarm data, pre-processing and data cleaning the hyperparameters to optimize the performance of the hyperparameters and obtain an optimal parameter combination;

[0032] Inputting the optimal parameter combination into the data training model to obtain a plurality of first feature information and a plurality of second feature information of the data training model, obtaining a first weight value of the first feature information and a second weight value of the second feature information, and removing the first weight value when the first weight value is lower than the second weight value, and removing the second weight value when the second weight value is lower than the first weight value;

[0033] Performing a regularization operation on the data training model, and selecting an evaluation indicator aligned with the data training model to obtain a first output value of the data training model;

[0034] Perform an error analysis on the first output value to obtain an error analysis result, and improve the data training model according to the error analysis result.

[0035] In some embodiments of the present invention, after obtaining the adaptive prediction model, the method further includes:

[0036] Confirming whether the adaptive prediction model performs an adaptive optimization operation;

[0037] When the adaptive prediction model needs to perform the adaptive optimization operation, a learning strategy is introduced into the adaptive prediction model so that the adaptive prediction model can update the newly collected real-time monitoring data in real time;

[0038] Initializing the real-time monitoring data input into the adaptive prediction model to obtain initial training parameters; loading the initialization training parameters into a preset XGBoost according to a preset data structure, wherein a first function is preset in the XGBoost;

[0039] Training the adaptive prediction model according to the first function;

[0040] Determine whether the adaptive prediction model has an incremental learning phase, and when the adaptive prediction model has an incremental learning phase, obtain a second data set of the real-time monitoring data, and convert the second data set into a DMatrix data structure;

[0041] Obtain a training method preset in the XGBoost, and perform incremental training on the adaptive prediction model according to the training method and the DMatrix data structure.

[0042] In some embodiments of the present invention, the adaptive prediction model analyzes the real-time monitoring data, including:

[0043] Obtaining prediction results and actual alarm data of the adaptive prediction model;

[0044] Comparing and predicting the prediction result and the actual alarm data, so as to analyze the false positive examples and false negative examples of the adaptive prediction model and obtain error prediction information;

[0045] Generate an analysis report according to the error prediction information, and obtain analysis results of the analysis report;

[0046] Adjusting parameters of the adaptive prediction model according to the analysis result, and updating the adaptive prediction model after the parameter adjustment by using incremental learning;

[0047] The performance of the updated adaptive prediction model is re-evaluated.

[0048] In a second aspect, an embodiment of the present invention provides a device for dynamic adaptive prediction of alarm events, comprising at least one control processor and a memory for communicating with the at least one control processor; the memory stores instructions executable by the at least one control processor, and the instructions are executed by the at least one control processor so that the at least one control processor can execute the method for dynamic adaptive prediction of alarm events as described in the first aspect above.

[0049] In a third aspect, an embodiment of the present invention provides an electronic device, comprising the device for dynamic adaptive prediction of alarm events as described in the second aspect above.

[0050] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method for dynamic adaptive prediction of alarm events as described in the first aspect above.

[0051] The method for dynamic adaptive prediction of alarm events according to the embodiment of the present invention has at least the following beneficial effects:

[0052] Collect historical alarm information, perform preprocessing operations on all collected historical alarm information, and obtain standard alarm data; extract and select features from standard alarm data, obtain feature subsets in standard alarm data, and select the feature subsets, verify the selected feature subsets according to a preset machine learning model, and obtain multiple data training models; obtain the property information of the prediction task, and select a machine learning algorithm that matches multiple data training models according to the property information; obtain a first data set and a first test set of historical alarm information, train multiple data training models after matching the machine learning algorithm according to the first data set, and verify the trained data training model according to the first test set to obtain an adaptive prediction model; the adaptive prediction model analyzes real-time monitoring data, predicts alarm events to be generated, and obtains the alarm type and alarm source of the alarm event; and plans the response strategy of the alarm event according to the alarm type and alarm source. According to the technical solution of this embodiment, the accuracy and timeliness of the prediction alarm can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 is a flow chart of a method for dynamic adaptive prediction of alarm events provided by an embodiment of the present invention;

[0054] Figure 2 is a flowchart of preprocessing all collected historical alarm information provided by an embodiment of the present invention;

[0055] Figure 3 is a flow chart of standardizing historical alarm information provided by an embodiment of the present invention;

[0056] Figure 4 is a flow chart of processing missing values ​​of unified alarm data provided by an embodiment of the present invention;

[0057] Figure 5 is a flowchart of verifying a trained data training model according to a first test set provided by an embodiment of the present invention;

[0058] Figure 6 is a flow chart after obtaining an adaptive prediction model provided by an embodiment of the present invention;

[0059] Figure 7 is a flow chart of analyzing real-time monitoring data using an adaptive prediction model provided by an embodiment of the present invention;

[0060] Figure 8 It is a structural diagram of a dynamic adaptive prediction device for alarm events provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0061] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0062] In the description of the present invention, it should be understood that descriptions involving orientations, such as up, down, front, back, left, right, etc., and orientations or positional relationships indicated are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0063] In the description of the present invention, "several" means one or more, "more" means more than two, "greater than", "less than", "exceed" etc. are understood as not including the number itself, and "above", "below", "within" etc. are understood as including the number itself. If there is a description of "first" or "second", it is only used for the purpose of distinguishing the technical features, and cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0064] In the description of the present invention, unless otherwise clearly defined, terms such as setting, installing, connecting, etc. should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in the present invention based on the specific content of the technical solution.

[0065] An embodiment of the present invention provides a method for dynamic adaptive prediction of alarm events, including collecting historical alarm information, performing preprocessing operations on all collected historical alarm information to obtain standard alarm data; performing feature extraction and selection on the standard alarm data to obtain a feature subset in the standard alarm data and select the feature subset, verifying the selected feature subset according to a preset machine learning model to obtain multiple data training models; obtaining property information of the prediction task, and selecting a machine learning algorithm that matches the multiple data training models according to the property information; obtaining a first data set and a first test set of historical alarm information, training multiple data training models matched with the machine learning algorithm according to the first data set, and verifying the trained data training model according to the first test set to obtain an adaptive prediction model; the adaptive prediction model analyzes real-time monitoring data, predicts an alarm event to be occurred, and obtains the alarm type and alarm source of the alarm event; and plans a response strategy for the alarm event according to the alarm type and the alarm source.

[0066] According to the technical solution of this embodiment, advanced data mining and machine processing technology are used to process historical alarm data, which can more accurately identify potential associations and time occurrence patterns, provide more reliable and accurate prediction results, and thus reduce the occurrence of false alarms and missed alarms. Unlike the static rules commonly used in the prior art, this embodiment constructs an adaptive prediction model. As new alarm real-time monitoring data is continuously acquired, the adaptive prediction model can update and adjust its own parameters in real time, thereby ensuring the continued accuracy of the predicted alarms and the ability to respond to environmental changes. Furthermore, the adaptive prediction module can immediately trigger corresponding emergency measures by real-time monitoring and rapid prediction of potential alarms, greatly improving the response speed of the emergency system.

[0067] Those skilled in the art will appreciate that this embodiment can also display prediction results through a clear user interface and allow users to adjust warning settings according to actual conditions, thereby further increasing the flexibility and user-friendliness of the emergency response system.

[0068] It should be noted that this embodiment is not limited to a specific type of emergency system. The adaptive prediction model and algorithm framework are applicable to a variety of different emergency environments, including but not limited to natural disasters, industrial accidents, transportation systems, network security and other fields.

[0069] This embodiment does not impose any specific limitation.

[0070] The control method of the embodiment of the present invention is further described below based on the accompanying drawings.

[0071] Reference Figure 1 , Figure 1A flowchart of a method for dynamic adaptive prediction of alarm events provided by an embodiment of the present invention, the method for dynamic adaptive prediction of alarm events includes but is not limited to the following steps:

[0072] Step S11, collecting historical alarm information, pre-processing all collected historical alarm information to obtain standard alarm data;

[0073] It should be noted that in order to ensure the accuracy and effectiveness of the subsequent construction of the adaptive prediction model, the collected historical alarm information must first be thoroughly sorted and clarified, and the historical alarm information data must be unified into standard alarm data to ensure the compatibility and comparability of various data sources.

[0074] Step S12, extracting and selecting features from the standard alarm data, obtaining a feature subset in the standard alarm data and selecting the feature subset, verifying the selected feature subset according to a preset machine learning model, and obtaining multiple data training models;

[0075] It should be noted that the original data is converted into a form that can better represent the information in the standard alarm data through feature extraction. This embodiment adopts the principal component analysis method, and converts the possibly related variables into a set of linearly unrelated variables as the principal components through orthogonal transformation. The first principal component has the largest variance, and so on, for dimensionality reduction;

[0076] Feature selection is used to remove irrelevant or redundant features in the original data and retain the most useful features for building data training models, thereby reducing the complexity of the data training model and improving the interpretability of the model. It is used to improve the accuracy of the model in different scenarios.

[0077] The specific feature selection steps are as follows:

[0078] Perform exploratory analysis on the original data features, including statistical analysis and visualization; calculate the correlation between features and between features and response variables to identify highly correlated and low-correlated features; use one or more of the filtering, packaging, or embedding methods to find a high-quality feature subset, use a machine learning model to verify the performance of the selected feature subset, and simultaneously optimize the hyperparameters of multiple data training models to determine the final feature subset and use all available data to train the model.

[0079] Step S13, obtaining property information of the prediction task, and selecting a machine learning algorithm that matches the multiple data training models according to the property information;

[0080] It should be noted that according to the nature of the prediction task, a machine learning algorithm that matches multiple data training models is selected. For example, a long short-term memory network (LSTM) can be used for time series data, and a random forest or gradient boosting machine (GBM) can be used for classification tasks. According to the different advantages and constraints of different algorithms, the characteristics of the prediction, the amount of data and the real-time requirements are comprehensively considered.

[0081] Step S14, obtaining a first data set and a first test set of historical alarm information, training multiple data training models matched with the machine learning algorithm according to the first data set, and verifying the trained data training models according to the first test set to obtain an adaptive prediction model;

[0082] It should be noted that the first data set is a historical alarm data set, and the GBM algorithm is selected based on the historical alarm data set. The performance of the data training model is optimized through cross-validation and hyperparameter tuning techniques.

[0083] Specifically, adjusting the parameters of the GBM algorithm includes at least:

[0084] Number of trees (n_est imators): determines how many decision trees to add. Those skilled in the art will understand that more trees may improve performance, but will also increase computation time.

[0085] Tree Depth (max_depth): controls the depth of each decision tree. Deeper trees may capture more details, but are also prone to overfitting.

[0086] Learning rate (learning_rate): determines the contribution of each tree to the final prediction. Smaller learning rates require more trees to converge.

[0087] Subsample: The proportion of samples used to train each tree to reduce overfitting.

[0088] Minimum split loss (min_sp l it_loss): The minimum loss function drop required for a node to split.

[0089] Furthermore, the data training model is verified through the first test set, the performance of the data training model on the location data is evaluated, and a variety of evaluation indicators are introduced, where the evaluation indicators include but are not limited to accuracy, precision, recall and F1 score, etc. The most suitable evaluation criteria can be determined according to business needs.

[0090] Step S15, the adaptive prediction model analyzes the real-time monitoring data, predicts the alarm event to be occurred, and obtains the alarm type and alarm source of the alarm event;

[0091] It should be noted that the trained and verified adaptive prediction model is deployed in the production environment and seamlessly integrated with the existing emergency system to predict the high-alert events to be occurred and obtain the alarm type and high-alert source of the alarm event.

[0092] Step S16: Plan a response strategy for the alarm event according to the alarm type and the alarm source.

[0093] It should be noted that after predicting a potential alarm event, the emergency response steps are automatically triggered, such as sending notifications to emergency management personnel, updating status or proposing responses in the emergency system, planning response strategies and paths in the emergency system, and graphically displaying them on the monitoring board or electronic map of the control center, and visualizing potential risk areas, thereby completing dynamic adaptive prediction of alarm events.

[0094] It should be noted that the dynamic adaptive prediction method for alarm events implemented in this embodiment is used to enhance the efficiency and accuracy of the emergency response system. First, historical alarm information is collected, where the historical alarm information includes but is not limited to the time, location, severity and corresponding environmental parameters of the event. Subsequently, data analysis and machine learning techniques are used to extract alarm patterns, and a prediction model is established through a specific algorithm to predict the occurrence of potential alarm events. In addition, when the system confirms that it will be connected to a specific emergency response network, it calculates the most likely type and location of the alarm event by comparing it with other similar historical alarm events in real time. Finally, based on these predicted data, the response strategy and path are planned in the emergency system, graphically displayed on the monitoring board or electronic map of the control center, and the potential risk areas are visualized.

[0095] By combining data analysis of historical alarm events, the present invention can not only provide dynamically optimized early warning information in emergency situations, but also improve the response and resolution capabilities of the entire system when facing unknown risks or emergencies. Even when some alarm nodes fail or communication is limited, relying on its powerful data processing and pattern recognition capabilities, it can still maintain operating efficiency and stability, greatly enhancing the robustness of the emergency system.

[0096] In addition, in one embodiment, referring to Figure 2 ,exist Figure 1 Step S11 of the illustrated embodiment also includes but is not limited to the following steps:

[0097] Step S21, standardize the historical alarm information to obtain unified alarm data;

[0098] Step S22, performing data verification on the unified alarm data to confirm whether there are missing records in the unified alarm data;

[0099] Step S23, when there are missing records in the unified alarm data, missing value processing is performed on the unified alarm data to fill the unified alarm data, and missing value processing is performed on the filled unified alarm data to obtain complete report data;

[0100] Step S24, when there is no missing record in the unified alarm data, directly perform missing value processing on the unified alarm data to obtain complete alarm data;

[0101] Step S25, performing data conversion on the complete alarm data, performing feature selection on the converted complete alarm data, and obtaining standard alarm data.

[0102] It should be noted that the historical alarm information is first normalized and standardized to convert the historical alarm information into unified alarm data of a unified scale, where data table conversion refers to converting the data into a distribution with a mean of zero and a standard deviation of one, that is, converting it into a standard normal distribution (Z distribution); the unified alarm data is verified to confirm whether there are missing records in the unified alarm data. When there are missing records in the unified alarm data, methods such as difference or regression are used to fill or ignore the missing items. For interpolation processing, known data points in the unified alarm data are first collected, and then an interpolation formula is selected based on the known data points and the interpolation method, and the position of the missing points in the interpolation formula is replaced; for regression, a complete data set containing variables with missing values ​​is first collected, and then a suitable regression model (linear or multivariate linear) is selected. The model is trained through the complete records in the first data set, and other variables of the records where the missing values ​​are located are input into the regression model for summary to predict the missing values. By supplementing the missing values, complete alarm data is obtained.

[0103] In addition, in one embodiment, referring to Figure 3 ,exist Figure 1 Step S11 of the illustrated embodiment also includes but is not limited to the following steps:

[0104] Step S31, obtaining the original value, maximum value and minimum value of historical alarm information;

[0105] Step S32, obtaining a normalized first processed value of the historical alarm information according to the original value, the maximum value and the minimum value;

[0106] Step S33, obtaining a sample mean and a sample standard deviation of the historical alarm information, and obtaining a standardized second processed value of the historical alarm information according to the sample mean and the sample standard deviation;

[0107] Step S34, obtaining unified alarm data according to the first processed value and the second processed value.

[0108] It should be noted that the normalized first processed value of the historical alarm information is obtained according to the original value, the maximum value and the minimum value, which can be expressed by the following first formula:

[0109]

[0110] Among them, x noim is the first processed value, x is the original value, x max is the maximum value, x min is the minimum value.

[0111] The standardized second processed value of the historical alarm information is obtained according to the sample mean and the sample standard deviation, and is expressed by the following second formula:

[0112]

[0113] Among them, x std is the second processing value, is the sample mean and σ is the sample variance.

[0114] Finally, unified alarm data is obtained according to the first processed value and the second processed value.

[0115] In addition, in one embodiment, referring to Figure 4 ,exist Figure 1 Step S11 of the illustrated embodiment also includes but is not limited to the following steps:

[0116] Step S41, obtaining a first data point and a second data point in the unified alarm data;

[0117] Step S42, when the missing data point is between the first data point and the second data point, a linear interpolation of the missing data point is calculated according to the first data point, the second data point and the missing data point;

[0118] Step S43, obtaining the independent variable and the dependent variable in the unified alarm data, determining the linear relationship between the independent variable and the dependent variable, and obtaining a fitting straight line between the independent variable and the dependent variable;

[0119] Step S44, obtaining the independent variable observation value of the independent variable, the dependent variable observation value of the dependent variable and the total sample volume of the unified alarm data;

[0120] Step S45, calculating the first coefficient and the second coefficient of the fitting straight line according to the independent variable observation value, the dependent variable observation value and the total sample size;

[0121] Step S46: predicting the missing value of the unified alarm data according to the first coefficient and the second coefficient.

[0122] It should be noted that the missing items are filled or ignored by linear interpolation and regression. Specifically, when linear interpolation is used, the first data point (x1, y1) and (x2, y2) are determined, and a missing data point x is located between the first data point and the second data point. Then the linear interpolation y of the missing data point x can be calculated by the following third formula:

[0123]

[0124] When linear regression is used for processing, the independent variables and dependent variables in the unified alarm data are obtained, the linear relationship between the independent variables and the dependent variables is determined, and the best fitting straight line y=ax+b is found. The coefficients a and b are obtained by minimizing the residual square through the following fourth and fifth formulas:

[0125]

[0126] Where n is the sample size, x is the observed value of the independent variable, and y is the observed value of the dependent variable.

[0127] When there are multiple independent variables, multiple linear regression is used. The model is in the form of y=b0+b1x1+b2x2+...+bnxn, ​​and the coefficients b0, b1,..., bn can be obtained by the least squares method.

[0128] Specifically, for the interpolation process, first collect the surrounding known data points, then select the interpolation formula based on the known points and the interpolation method, replace the x value in the formula (the position of the missing point), and calculate the y value;

[0129] For regression processing, first collect a complete data set containing variables with missing values, then select an appropriate regression model (linear or multivariate linear), train the model using the complete records in the data set, and input other variables of the records where the missing values ​​are located into the regression model to predict the missing values.

[0130] In addition, in one embodiment, referring to Figure 5 ,exist Figure 1 Step S11 of the illustrated embodiment also includes but is not limited to the following steps:

[0131] Step S51, dividing the standard alarm data into an independent first training set and a second test set;

[0132] Step S52, cross-validating the first training set and the second test set to obtain hyperparameters of standard alarm data, pre-processing and data cleaning the hyperparameters to optimize the performance of the hyperparameters and obtain the optimal parameter combination;

[0133] Step S53, inputting the optimal parameter combination into the data training model to obtain a plurality of first feature information and a plurality of second feature information of the data training model, obtaining a first weight value of the first feature information and a second weight value of the second feature information, and removing the first weight value when the first weight value is lower than the second weight value, and removing the second weight value when the second weight value is lower than the first weight value;

[0134] Step S54, performing a regularization operation on the data training model, and selecting an evaluation indicator aligned with the data training model to obtain a first output value of the data training model;

[0135] Step S55, performing error analysis on the first output value to obtain an error analysis result, and improving the data training model according to the error analysis result.

[0136] It should be noted that, first, ensure that the standard alarm data is divided into an independent first training set and a second test set to prevent leakage and overfitting of the standard alarm data; cross-validate the first training set and the second test set to further accurately evaluate the performance of the data training model, ensure that each sample can be used as a test set, and that the data training model can be trained on multiple different training sets, and obtain the hyperparameters of the standard alarm data. The hyperparameters of the data training model are optimized through grid search, random search, or Bayesian optimization to obtain the optimal parameter combination; input the optimal parameter combination into the data training model, further analyze the features used in the data training model, remove unimportant features (that is, when the first weight value is lower than the second weight value, remove the first weight value, and when the second weight value is lower than the first weight value, remove the second weight value), or improve the model through methods such as feature crossover and polynomial expansion; consider using model integration techniques such as Stacking, Bagging, or Boosting ing, in order to integrate the learning effects of multiple data training models and improve the prediction performance; preferably, different algorithms can also be used to retrain the data training model, and the performance of multiple data training models can be compared; regularization techniques, such as L1 or L2 regularization, can be used to reduce the complexity of the data training model, thereby reducing the risk of overfitting; further selection of evaluation indicators for the data training model, such as in a highly unbalanced dataset, it may be necessary to use F1 score, area under the Rogers curve (ROC AUC) instead of just accuracy, so as to obtain a first output value, post-process the first output value by threshold adjustment, label calibration or generating synthetic samples to further improve the accuracy, and perform error analysis on samples misclassified by the data training model to see if there are patterns or commonalities, thereby guiding further model improvements.

[0137] In addition, in one embodiment, referring to Figure 6 ,exist Figure 1Step S11 of the illustrated embodiment also includes but is not limited to the following steps:

[0138] Step S61, confirming whether the adaptive prediction model performs an adaptive optimization operation;

[0139] Step S62, when the adaptive prediction model needs to perform an adaptive optimization operation, a learning strategy is introduced into the adaptive prediction model so that the adaptive prediction model can update the newly collected real-time monitoring data in real time;

[0140] Step S63, initializing the real-time monitoring data input into the adaptive prediction model to obtain initial training parameters;

[0141] Step S64, loading the initialization training parameters into a preset XGBoost according to a preset data structure, wherein a first function is preset in XGBoost;

[0142] Step S65, training the adaptive prediction model according to the first function;

[0143] Step S66, confirming whether the adaptive prediction model has an incremental learning stage, and when the adaptive prediction model has an incremental learning stage, obtaining a second data set of real-time monitoring data, and converting the second data set into a DMatrix data structure;

[0144] Step S67, obtaining the training method preset in XGBoost, and performing incremental training on the adaptive prediction model according to the training method and the DMatrix data structure.

[0145] It should be noted that it is necessary to confirm whether the adaptive prediction model needs to be adaptively optimized. When the adaptive prediction model needs to be adaptively optimized, a learning strategy is introduced into the adaptive prediction model so that the adaptive prediction model can update the real-time monitoring data of the new mobile phone in real time. First, the real-time monitoring data is initialized. When the model is trained for the first time, it is necessary to define training parameters, such as the number of trees (n_est imators or num_boost_round), learning rate (learning_rate or eta) and other parameters related to model performance, and then obtain the initial training parameters; use the DMatrix data structure (i.e., the preset data structure) to load the initial training data into XGBoost; use xgboost.train() (the first function) to train the adaptive prediction model, and pass parameters, training data, number of rounds (boosting rounds) and possible model evaluation lists to the first function. When there is new data and you want to continue learning based on the existing model, you need to convert the second data set into the DMatrix data structure. Use the xgb.train() method (i.e., the preset training method) to perform incremental training with the initial model (base learner) as a parameter. It should be noted that you can pass an existing model through the xgb_mode l parameter, and add new trees to the existing adaptive prediction model by passing the trained model object to the xgb.train() method, instead of starting from scratch. During incremental training, you can add more trees (num_boost_round) or re-fine-tune existing trees.

[0146] Each time you call xgb.train(), XGBoost will train the existing model for more rounds. You can do this over and over again with new data batches to achieve incremental learning. It is important to note that the actual effect of incremental learning depends on the nature of the dataset and the choice of model parameters. Sometimes, adding a large amount of data and the number of training rounds does not guarantee a significant improvement in model performance. The model should be evaluated after each incremental learning to verify whether the performance has improved.

[0147] In addition, in one embodiment, referring to Figure 7 ,exist Figure 1 Step S11 of the illustrated embodiment also includes but is not limited to the following steps:

[0148] Step S71, obtaining the prediction results and actual alarm data of the adaptive prediction model;

[0149] Step S72, comparing the prediction result with the actual alarm data to analyze the false positives and false negatives of the adaptive prediction model to obtain error prediction information;

[0150] Step S73, generating an analysis report according to the error prediction information, and obtaining analysis results of the analysis report;

[0151] Step S74, adjusting the parameters of the adaptive prediction model according to the analysis results, and updating the adaptive prediction model after the parameter adjustment by using incremental learning;

[0152] Step S75: re-evaluate the performance of the updated adaptive prediction model.

[0153] It should be noted that the feedback loop is designed so that the adaptive prediction model continuously learns from the actual alarm events and the prediction results. By analyzing the difference between the prediction results and the actual alarm data, the emergency system can automatically adjust the threshold or retrain the model part to reduce the prediction error in the future. This can be performed through the following detailed steps and processes:

[0154] Analyze the difference between prediction and actual results. After the adaptive prediction model is deployed, collect the prediction results and actual alarm data of the adaptive prediction model. Calculate important performance indicators such as accuracy, precision, recall, and F1 score. Compare the prediction results with real events and analyze the false positives (FP) and false negatives (FN) of the adaptive prediction model. By looking into FP and FN, understand what types of samples the adaptive prediction model makes mistakes on, find potential patterns or features that contribute to wrong predictions and generate analysis reports, and summarize the main findings and sources of errors.

[0155] Based on the analysis results, the data is assigned to different categories, such as by error type or model confidence level. Model parameters are adjusted for specific categories of events. For example, the weight of minority class samples can be increased, or more complex features can be added for frequently misclassified categories. The threshold of the prediction probability can be adjusted to optimize the balance between the model's prediction precision and recall.

[0156] Implement adjustment strategies and determine the adjustment strategies that need to be taken if the overall error of the model is higher than the pre-defined acceptable level. Choose whether to retrain the entire adaptive prediction model or update only specific components based on needs. Use methods such as grid search or random search to optimize hyperparameters. If the data stream continues to arrive, incremental learning can be used to update the model instead of retraining the entire model.

[0157] Revalidate the model's performance on an independent test set or use cross-validation methods to evaluate the model's performance.

[0158] Compare the results: Verify whether the model has improved in prediction accuracy by comparing the performance results before adjustment. Even if the performance has improved, a monitoring system should be set up to monitor the model performance to ensure long-term effectiveness. Ensure that the improvement of the model is not just a correction of specific errors, but that the performance of the entire data set has been improved.

[0159] As those skilled in the art will appreciate, the process of implementing this feedback loop is iterative. As time goes by and more data is accumulated, the model will be continuously fine-tuned and optimized to adapt to potential changes in data distribution and changes in alarm event patterns. At the same time, each step in the process should be recorded and documented to track the history and impact boundaries of model updates.

[0160] like Figure 8 As shown, Figure 8 The present invention also provides a dynamic adaptive prediction device for alarm events, including:

[0161] The processor 801 may be implemented by a general-purpose central processing unit (CPU), a high-performance graphics processing unit (GPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0162] The memory 802 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 802 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 802, and the processor 801 calls and executes the dynamic adaptive prediction method for alarm events in the embodiment of this application;

[0163] Input / output interface 803, used to implement information input and output;

[0164] The communication interface 804 is used to realize the communication interaction between the present apparatus and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WI FI, Bluetooth, etc.);

[0165] A bus 805 that transmits information between the various components of the device (e.g., the processor 801, the memory 802, the input / output interface 803, and the communication interface 804);

[0166] The processor 801 , the memory 802 , the input / output interface 803 and the communication interface 804 are connected to each other in communication within the device via a bus 805 .

[0167] An embodiment of the present application also provides an electronic device, including the dynamic adaptive prediction device for alarm events as described above.

[0168] An embodiment of the present application further provides a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed by a processor, the above-mentioned dynamic adaptive prediction method for alarm events is implemented.

[0169] As a non-transient computer-readable storage medium, the memory can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage devices. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and are implemented to be located in one place, or may also be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0170] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically include computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0171] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above-mentioned implementation mode. Technical personnel familiar with the field can also make various equivalent deformations or substitutions under the shared conditions without violating the spirit of the present invention. These equivalent deformations or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A method for dynamic adaptive prediction of alarm events, characterized in that: include: Collect historical alarm information, and perform preprocessing operations on all the collected historical alarm information to obtain standard alarm data; Extracting and selecting features from the standard alarm data to obtain a feature subset in the standard alarm data and selecting the feature subset, verifying the selected feature subset according to a preset machine learning model, and obtaining a plurality of data training models; Acquire property information of the prediction task, and select a machine learning algorithm that matches the multiple data training models according to the property information; Obtaining a first data set and a first test set of the historical alarm information, training a plurality of the data training models matched with the machine learning algorithm according to the first data set, and verifying the trained data training models according to the first test set to obtain an adaptive prediction model; The adaptive prediction model analyzes the real-time monitoring data, predicts the alarm event to be occurred, and obtains the alarm type and alarm source of the alarm event; A response strategy for the alarm event is planned according to the alarm type and the alarm source.

2. The method for dynamic adaptive prediction of alarm events according to claim 1, characterized in that: The preprocessing operation is performed on all the collected historical alarm information to obtain standard alarm data, including: Standardizing the historical alarm information to obtain unified alarm data; Performing data verification on the unified alarm data to confirm whether there are any missing records in the unified alarm data; When there are missing records in the unified alarm data, missing value processing is performed on the unified alarm data to fill in the unified alarm data, and missing value processing is performed on the filled unified alarm data to obtain complete report data; When there is no missing record in the unified alarm data, directly performing missing value processing on the unified alarm data to obtain the complete alarm data; The complete alarm data is converted, and feature selection is performed on the complete alarm data after the data conversion to obtain the standard alarm data.

3. The method for dynamic adaptive prediction of alarm events according to claim 2, characterized in that: The standardization of the historical alarm information to obtain unified alarm data includes: Obtaining the original value, maximum value and minimum value of the historical alarm information; Obtaining a normalized first processed value of the historical alarm information according to the original value, the maximum value, and the minimum value; Obtaining a sample mean and a sample standard deviation of the historical alarm information, and obtaining a standardized second processed value of the historical alarm information according to the sample mean and the sample standard deviation; Unified alarm data is obtained according to the first processed value and the second processed value.

4. The method for dynamic adaptive prediction of alarm events according to claim 2, characterized in that: The performing missing value processing on the unified alarm data to obtain the complete alarm data includes: Acquire a first data point and a second data point in the unified alarm data; When the missing data point is between the first data point and the second data point, a linear interpolation value of the missing data point is calculated according to the first data point, the second data point and the missing data point; Obtaining independent variables and dependent variables in the unified alarm data, determining a linear relationship between the independent variables and the dependent variables, and obtaining a fitting straight line between the independent variables and the dependent variables; Obtaining the independent variable observation value of the independent variable, the dependent variable observation value of the dependent variable and the total sample volume of the unified alarm data; Calculate the first coefficient and the second coefficient of the fitting straight line according to the independent variable observation value, the dependent variable observation value and the total sample size; The missing value of the unified alarm data is predicted according to the first coefficient and the second coefficient.

5. The method for dynamic adaptive prediction of alarm events according to claim 1, characterized in that: The verifying the trained data training model according to the first test set includes: Dividing the standard alarm data into an independent first training set and a second test set; Cross-validating the first training set and the second test set to obtain hyperparameters of the standard alarm data, pre-processing and data cleaning the hyperparameters to optimize the performance of the hyperparameters and obtain an optimal parameter combination; Inputting the optimal parameter combination into the data training model to obtain a plurality of first feature information and a plurality of second feature information of the data training model, obtaining a first weight value of the first feature information and a second weight value of the second feature information, and removing the first weight value when the first weight value is lower than the second weight value, and removing the second weight value when the second weight value is lower than the first weight value; Performing a regularization operation on the data training model, and selecting an evaluation indicator aligned with the data training model to obtain a first output value of the data training model; Perform an error analysis on the first output value to obtain an error analysis result, and improve the data training model according to the error analysis result.

6. The method for dynamic adaptive prediction of alarm events according to claim 1, characterized in that: After the adaptive prediction model is obtained, the method further includes: Confirming whether the adaptive prediction model performs an adaptive optimization operation; When the adaptive prediction model needs to perform the adaptive optimization operation, a learning strategy is introduced into the adaptive prediction model so that the adaptive prediction model can update the newly collected real-time monitoring data in real time; Initializing the real-time monitoring data input into the adaptive prediction model to obtain initial training parameters; Loading the initialization training parameters into a preset XGBoost according to a preset data structure, wherein a first function is preset in the XGBoost; Training the adaptive prediction model according to the first function; Confirm whether the adaptive prediction model exists in an incremental learning stage, and when the adaptive prediction model exists in an incremental learning stage, obtain a second data set of the real-time monitoring data, and convert the second data set into a DMatrix data structure; Obtain a training method preset in the XGBoost, and perform incremental training on the adaptive prediction model according to the training method and the DMatrix data structure.

7. The method for dynamic adaptive prediction of alarm events according to claim 1, characterized in that: The adaptive prediction model analyzes the real-time monitoring data, including: Obtaining prediction results and actual alarm data of the adaptive prediction model; Comparing and predicting the prediction result and the actual alarm data, so as to analyze the false positive examples and false negative examples of the adaptive prediction model and obtain error prediction information; Generate an analysis report according to the error prediction information, and obtain analysis results of the analysis report; Adjusting parameters of the adaptive prediction model according to the analysis result, and updating the adaptive prediction model after the parameter adjustment by using incremental learning; The performance of the updated adaptive prediction model is re-evaluated.

8. A dynamic adaptive prediction device for alarm events, characterized in that: It includes at least one control processor and a memory for communicating with the at least one control processor; the memory stores instructions that can be executed by the at least one control processor, and the instructions are executed by the at least one control processor so that the at least one control processor can execute the dynamic adaptive prediction method for alarm events as described in any one of claims 1 to 7.

9. An electronic device, characterized in that: It includes the dynamic adaptive prediction device for alarm events as described in claim 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the method for dynamic adaptive prediction of alarm events according to any one of claims 1 to 7.

Images