IT+OT end-to-end status detection and early warning methods

Abstract

This invention discloses a method for full-link status detection and early warning of IT+OT systems, belonging to the field of system monitoring and intelligent operation and maintenance that integrates information technology and operational technology. It includes acquiring specific parameters of IT and OT systems and converting them into a unified data stream; aligning and quantizing the data stream to generate a two-dimensional event stream; constructing a causal graph of IT and OT systems and extracting correlation features; dynamically pruning the graph to generate monitoring nodes and issuing instructions; verifying OT device feedback data to generate progressive early warnings; and adjusting IT resource strategies based on the early warnings and generating OT instruction correction parameters. This invention employs multi-source data fusion, dynamic causal graph analysis, cross-domain verification, and progressive early warning technologies, enabling real-time perception of the full-link status of IT / OT converged systems, identification of risk and fault evolution, and early warning and response. This significantly improves the comprehensiveness of converged system monitoring, the accuracy of early warnings, and the response speed, enhancing the stability and security of system operation.

Description

Technical Field

[0001] The present invention relates to the field of system monitoring and intelligent operation and maintenance in the integration of information technology and operation technology (IT / OT integration), and particularly to a method for detecting and warning the full-link status of IT+OT. Background Art

[0002] With the rapid development of industrial Internet and intelligent manufacturing, the deep integration of information technology (IT) systems and operation technology (OT) systems has become the core trend in modern industrial production and critical infrastructure operation. This integration enables the full-link data from enterprise management to production control to be connected, providing the possibility to improve efficiency and optimize decision-making, and its application scenarios cover multiple important industries such as power, transportation, manufacturing, and municipal administration.

[0003] However, the existing state monitoring and warning mechanisms for the IT and OT integration environment often show certain limitations when facing problems such as increasingly complex system architectures, massive heterogeneous data, and cross-domain fault propagation. Traditional monitoring means may focus on a single field or local link, lacking the overall perception and dynamic correlation analysis ability of the full-link status of IT and OT. Therefore, there is still room for improvement in the timeliness and accuracy of early fault identification and potential risk warning, and it is difficult to fully meet the requirements of high reliability and high security for complex systems. Summary of the Invention

[0004] To solve the above problems, the present invention provides a method for detecting and warning the full-link status of IT+OT, which adopts multi-source data fusion, dynamic causal graph analysis, cross-domain verification, and progressive warning technologies, can real-time perceive the full-link status of the IT / OT integration system, identify risk and fault evolution, and conduct early warning and response, significantly improving the comprehensiveness of fusion system monitoring, the accuracy of warning, and the response speed, and enhancing the stability and security of system operation.

[0005] The above objectives can be achieved through the following solutions:

[0006] The IT+OT full-link status detection and early warning method includes: acquiring server latency parameters of the IT system and device current ripple parameters of the OT system; converting the server latency parameters into a first protocol data stream using a lightweight probe; converting the device current ripple parameters into a second protocol data stream using a non-invasive modem; performing spatiotemporal stamp alignment and confidence quantification on the first and second protocol data streams based on a preset protocol mapping white box to generate a two-dimensional event stream with spatiotemporal stamps and anomaly confidence; constructing a causal relationship graph between the IT system and the OT system using preset historical event stream data, and extracting the current associated feature set based on the spatiotemporal stamps of the two-dimensional event streams; dynamically pruning the causal relationship graph based on the current associated feature set to generate an active monitoring node set, and issuing monitoring commands to the OT devices corresponding to the active monitoring node set; receiving feedback data from the OT devices, performing cross-node verification on the feedback data, and generating a progressive early warning signal when the number of abnormal event triggers in a preset area exceeds a preset threshold; adjusting the resource allocation strategy of the IT system and generating OT device operation command correction parameters based on the progressive early warning signal.

[0007] Optionally, the generation of the two-dimensional event stream with spatiotemporal stamp and anomaly confidence score includes: parsing the API call timestamp and packet loss rate parameters of the first protocol data stream to generate first anomaly confidence score data; parsing the current ripple frequency parameters and operation instruction restoration matching degree of the second protocol data stream to generate second anomaly confidence score data; and merging the first anomaly confidence score data and the second anomaly confidence score data based on a preset spatiotemporal stamp alignment algorithm to generate a two-dimensional event stream with spatiotemporal stamp and anomaly confidence score.

[0008] Optionally, the step of constructing a causal relationship graph between the IT system and the OT system using preset historical event stream data includes: extracting the IT server response time parameter and the OT signal light current fluctuation parameter from the preset historical event stream data to generate a parameter correlation weight matrix; and removing correlation edges with weights less than the preset weights in the parameter correlation weight matrix according to preset sparsity processing rules to generate a causal relationship graph between the IT system and the OT system.

[0009] Optionally, generating an active monitoring node set and issuing monitoring instructions to the OT devices corresponding to the active monitoring node set includes: when the server latency parameter is detected to exceed a preset threshold, matching and obtaining associated OT device current ripple nodes from the causal relationship graph; correcting the abnormal confidence tolerance range of the associated OT device current ripple nodes based on a preset traffic flow time period division rule; generating an active monitoring node set according to the corrected abnormal confidence tolerance range, and issuing the monitoring instructions to the OT devices corresponding to the active monitoring node set.

[0010] Optionally, the correction of the abnormal confidence tolerance range of the associated OT device current ripple node includes: determining the current time period according to a preset traffic flow time period division rule; if the current time period is determined to be a peak time period, then compressing and correcting the abnormal confidence tolerance range of the associated OT device current ripple node; if the current time period is determined to be an off-peak time period, then adjusting the abnormal confidence tolerance range of the associated OT device current ripple node to relax its tolerance.

[0011] Optionally, generating a progressive warning signal includes: receiving feedback data from the OT device, extracting an abnormal device current ripple signal from the feedback data, and matching the abnormal device current ripple signal with a preset set of normal operation instructions; when the abnormal device current ripple signal does not match the preset set of normal operation instructions, acquiring traffic flow density data of adjacent nodes within a preset area; determining the spatial correlation between the traffic flow density data and the abnormal device current ripple signal, and generating a progressive warning signal when the spatial correlation conforms to a preset diffusion chain pattern.

[0012] Optionally, generating progressive early warning signals further includes: acquiring all abnormal signals within a preset area and analyzing the geographical distribution characteristics of the all abnormal signals; if the geographical distribution characteristics conform to a preset cascading fault propagation path, generating a cross-system fault alarm report; marking fault source nodes according to the cascading fault propagation path, and injecting the fault source nodes into the weight update queue of the causal relationship graph.

[0013] Optionally, adjusting the resource allocation strategy of the IT system and generating OT device operation instruction correction parameters based on the progressive early warning signal includes: determining the resource allocation strategy update parameters of the IT system based on the progressive early warning signal, and applying the resource allocation strategy update parameters to adjust the API response latency threshold of the IT system; generating a traffic light timing adjustment instruction for the OT device based on the current ripple frequency parameter, and issuing the traffic light timing adjustment instruction to the corresponding OT device; and feeding back the collaborative execution result of the resource allocation strategy update parameters and the traffic light timing adjustment instruction to the causal relationship graph update weight matrix of the IT system and the OT system.

[0014] Optionally, the method further includes: acquiring real-time location data of the vehicle network terminal, and calculating the current vehicle queue length and the corresponding vehicle queue length threshold through a preset intersection congestion prediction model; when the current vehicle queue length exceeds the vehicle queue length threshold, injecting the congestion prediction result of the current vehicle queue length into the dynamic pruning process of the causal relationship graph to generate a dynamic node monitoring priority correction value; and adjusting the monitoring order of the set of activated monitoring nodes according to the dynamic node monitoring priority correction value.

[0015] Optionally, the method further includes: receiving regional pedestrian and vehicle traffic data from an external smart street light network, and generating a brightness gradient adjustment command based on the regional pedestrian and vehicle traffic data; when an abnormal street light voltage parameter is detected from the external smart street light network, generating power supply strategy correction parameters for adjacent street light devices according to the current associated feature set; and sending the brightness gradient adjustment command and the power supply strategy correction parameters to the relevant devices of the external smart street light network in a coordinated manner, and generating a cross-system optimization execution log.

[0016] Compared with the prior art, the present invention has the following advantages:

[0017] 1. Achieved deep integration and refined monitoring of the entire IT and OT chain. By integrating multi-source heterogeneous data from IT and OT, this invention constructs a unified event flow and cross-domain causal graph, enabling a comprehensive understanding of the overall system operation status. It overcomes the shortcomings of traditional monitoring methods in terms of comprehensive coverage and depth of correlation analysis, significantly improving the breadth and depth of monitoring.

[0018] 2. Improved accuracy and timeliness of early identification and warning of complex faults. This invention utilizes dynamic causal graph analysis, cross-node collaborative verification, and specific diffusion pattern recognition technologies to effectively capture early weak anomalies and cross-domain fault propagation paths, enabling early risk prediction and progressive alarms, effectively reducing false alarms and missed alarms, and improving the problem of early warning lag.

[0019] 3. Enhanced system dynamic adaptability and intelligent collaborative response capabilities. This invention can not only dynamically adjust monitoring strategies and early warning thresholds based on real-time status, but also coordinate the allocation of IT resources and the operation commands of OT equipment based on early warning results. Its collaboration with external intelligent systems and the feedback update mechanism of causal graphs further improve risk response efficiency and overall system resilience.

[0020] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the IT+OT end-to-end status detection and early warning method according to an embodiment of the present invention.

[0023] Figure 2 This is a heatmap showing the evolution of IT and OT anomaly confidence levels (FACD / SACD) over time in an embodiment of the present invention.

[0024] Figure 3 This is a simplified chord diagram of the correlation weights between key IT and OT parameters in this embodiment of the invention.

[0025] Figure 4 This is a step chart showing how the progressive early warning level changes with accumulated risk factors, according to an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] Reference Figure 1 One embodiment of the present invention proposes an IT+OT full-link status detection and early warning method. It adopts multi-source data fusion, dynamic causal graph analysis, cross-domain verification and progressive early warning technology, which can perceive the full-link status of IT / OT converged system in real time, identify risk and fault evolution, and perform early warning and response. It significantly improves the comprehensiveness of converged system monitoring, the accuracy of early warning and the response speed, and enhances the stability and security of system operation.

[0028] The method described in this embodiment specifically includes:

[0029] The server latency parameters of the IT system and the device current ripple parameters of the OT system are obtained. The server latency parameters are converted into a first protocol data stream through a lightweight probe, and the device current ripple parameters are converted into a second protocol data stream through a non-invasive modem.

[0030] Specifically, the focus is on collecting initial status indication information from two heterogeneous environments: information technology (IT) systems and operational technology (OT) systems. Server latency parameters in IT systems primarily reflect the efficiency of information processing and communication, while device current ripple parameters in OT systems indirectly reveal the operating conditions of physical equipment. Through appropriate technologies, such as lightweight probes for IT parameters and non-invasive sensing and demodulation methods for OT parameters, these raw, diverse parameters are transformed into standardized protocol data streams. This provides the necessary data foundation for subsequent cross-domain data integration and unified analysis.

[0031] Based on a preset protocol mapping white box, the first protocol data stream and the second protocol data stream are aligned with spatiotemporal stamps and quantified with confidence metrics to generate a two-dimensional event stream with spatiotemporal stamps and anomaly confidence.

[0032] Specifically, to gain a deeper understanding and analysis of the complex interrelationships and dependencies between IT and OT systems, this study aims to construct a causal model that can characterize these relationships. By utilizing pre-defined historical data encompassing long-term operational states and various events, appropriate analytical methods are employed to uncover potential causal relationships between different IT components and OT devices and their state parameters. This constructed causal relationship map of IT and OT systems macroscopically illustrates the interactions between various elements. Based on this map, and combined with spatiotemporal information from real-time two-dimensional event streams, the most relevant feature combinations to the current state can be dynamically identified and extracted—the current set of associated features—providing a basis for subsequent precise analysis and decision-making.

[0033] A causal relationship graph between the IT system and the OT system is constructed using preset historical event stream data, and the current set of associated features is extracted based on the spatiotemporal stamps of the dual-dimensional event stream.

[0034] Specifically, to gain a deeper understanding and analysis of the complex interrelationships and dependencies between IT and OT systems, a causal model capable of representing these relationships is constructed. By utilizing pre-defined historical data encompassing long-term operational states and various events, appropriate analytical methods are employed to uncover potential causal relationships between different IT components and OT devices and their state parameters. This constructed causal relationship map of IT and OT systems macroscopically illustrates the interactions between various elements. Based on this map, and combined with spatiotemporal information from real-time two-dimensional event streams, the most relevant feature combinations to the current state can be dynamically identified and extracted—the current set of associated features—providing a basis for subsequent precise analysis and decision-making.

[0035] The causal relationship graph is dynamically pruned based on the current set of associated features to generate a set of active monitoring nodes, and monitoring instructions are sent to the OT devices corresponding to the set of active monitoring nodes.

[0036] Specifically, this step aims to dynamically optimize the monitoring scope and adjust the monitoring strategy based on the current status and correlation characteristics. Using the extracted set of current correlation features, the constructed causal relationship graph of IT and OT systems is dynamically pruned. This pruning process primarily focuses on the parts of the complex graph most relevant to current risks or anomalies, removing temporarily inactive or low-correlation paths, thereby improving analysis efficiency and accuracy. Through pruning, a set of active monitoring nodes is obtained, representing units that currently require key attention. Subsequently, corresponding monitoring commands are proactively issued to the OT devices in this set to obtain more targeted real-time status information.

[0037] Receive feedback data from the OT device, perform cross-node verification on the feedback data, and generate a progressive early warning signal when the number of abnormal events triggered in the preset area exceeds a preset threshold.

[0038] Specifically, after issuing monitoring instructions, this step is responsible for receiving execution feedback or status data from the target OT device. To ensure the reliability of monitoring information and reduce false alarms, cross-node verification needs to be performed on the received feedback data. This verification typically involves comparing and verifying information from multiple relevant nodes to determine the authenticity of a single anomaly report. After the data is verified, the frequency or number of confirmed anomalies within a specific preset area over a certain period of time is statistically analyzed. When this number reaches or exceeds a preset threshold, it indicates that the risk level of the area has increased, at which point a progressive early warning signal is generated, the level of which may be adjusted as the risk further develops.

[0039] The IT system's resource allocation strategy is adjusted based on the progressive early warning signals, and OT equipment operation instruction correction parameters are generated.

[0040] Specifically, this step is the closed-loop response link in the entire detection and early warning method. Upon receiving a progressive early warning signal, corresponding adjustment and correction measures are initiated based on the warning level, type, and indicated potential risks. This includes optimizing the resource allocation strategy of the IT system, such as adjusting service priorities and allocating more computing or network resources, to ensure the stable operation of critical businesses or address potential IT-side risks. Simultaneously, corrective parameters for operational instructions are generated for the OT system. These parameters may be used to adjust the operating settings of OT equipment, trigger protection mechanisms, or guide manual intervention, aiming to mitigate or eliminate the warned risks at the operational level and ensure the security of the physical system.

[0041] This embodiment employs multi-source data fusion, dynamic causal graph analysis, cross-domain verification, and progressive early warning technologies to perceive the entire IT / OT converged link status in real time, identify risk and fault evolution, and provide early warning and response. This significantly improves the comprehensiveness of converged monitoring, the accuracy of early warning, and the speed of response, thereby enhancing operational stability and security.

[0042] Optionally, the generation of the two-dimensional event stream consisting of spatiotemporal stamps and anomaly confidence includes:

[0043] Parse the API call timestamp and packet loss rate parameters of the first protocol data stream to generate the first anomaly confidence data;

[0044] Specifically, this step aims to extract key performance indicators from the first protocol data stream obtained from the IT system to assess the degree of anomaly in its operational status. For example, Application Programming Interface (API) call timestamps accurately record the back-and-forth time points of service requests and responses, and their sequences can be used to analyze the statistical distribution, jitter, and trends of response latency. Packet loss rate directly reflects the quality and reliability of the network communication link. By analyzing the API call timestamp sequence within a predetermined time window and combining it with the packet loss rate value of the current time period, the abnormal performance of the IT link can be quantified. First Anomaly Confidence Data (FACD) is generated based on these analysis results through a comprehensive model such as a weighted scoring model, used to numerically represent the confidence level of operational anomalies on the IT side. The calculation of FACD can refer to the following exemplary formula:

[0045] FACD = w1 * X it1 +w2*X it2 ,

[0046] In the formula, FACD represents the first anomaly confidence score, and its value range can be normalized to the interval [0,1]. The larger the value, the higher the confidence score of the anomaly; X it1 This represents a quantitative value indicating the degree of latency anomaly, calculated based on various statistical indicators of API call latency; X it2 This represents the quantitative value of network quality anomalies calculated based on the packet loss rate; w1 and w2 are the weighting coefficients of latency and packet loss rate in the comprehensive evaluation, respectively, and w1 + w2 = 1. These weighting coefficients can be preset based on historical data or expert experience.

[0047] The matching degree between the current ripple frequency parameter of the second protocol data stream and the operation command is restored, and the second anomaly confidence data is generated.

[0048] Specifically, this step focuses on extracting key features from the second protocol data stream obtained from the OT system that reflect the operating status of physical equipment and the accuracy of control command execution. Equipment current ripple frequency parameters, such as the amplitude or energy of specific frequency harmonic or interharmonic components obtained through spectral analysis of the equipment's supply current, can effectively indicate whether the OT equipment has early wear or potential faults. Operation command restoration matching degree assesses the timeliness, accuracy, and overall performance of the OT equipment's response by comparing the consistency between the operation commands issued to the OT equipment and the actual actions performed by the equipment. The generation of Second Anomaly Confidence Data (SACD) can employ a comprehensive evaluation method similar to FACD to quantify the confidence level of anomalies indicated by OT-side parameters. The calculation of SACD can refer to the following exemplary formula:

[0049] SACD = w3 * X ot1 +w4*X ot2 ,

[0050] In the formula, SACD represents the second anomaly confidence data, which can also be normalized; X ot1 X represents the quantified value of the degree of equipment condition abnormality calculated based on various characteristics of the current ripple frequency parameter; ot2 This represents the quantitative value of the degree of abnormality in instruction execution, calculated based on the magnitude and duration of the deviation between the operation instruction and the actual state; w3 and w4 are the corresponding weighting coefficients, and their sum is 1.

[0051] Based on a preset spatiotemporal stamp alignment algorithm, the first anomaly confidence data and the second anomaly confidence data are merged to generate a two-dimensional event stream of spatiotemporal stamp and anomaly confidence.

[0052] Specifically, this step is the core of building a unified event view across IT and OT domains. It utilizes the completed spatiotemporal stamp alignment results, combined with a pre-defined spatiotemporal stamp alignment algorithm or more advanced event fusion logic, to merge the FACD and SACD generated in the previous two steps. This merging is not merely a simple aggregation of data; more importantly, it effectively correlates the anomaly confidence data from the IT side with the anomaly confidence data from the OT side in both time and space dimensions based on the precise spatiotemporal stamp information of the event occurrence. The final generated event stream is a two-dimensional event stream of spatiotemporal stamps and anomaly confidence, where each event entry contains at least: a timestamp accurate to milliseconds or higher, a spatial stamp identifying the event source or location, and FACD values ​​from the IT side and SACD values ​​from the OT side, respectively. This structured event stream provides standardized and information-rich input data for subsequent cross-domain causal analysis, complex failure mode identification, comprehensive risk assessment, and precise early warning decisions, such as... Figure 2 As shown.

[0053] Optionally, constructing a causal relationship map between the IT system and the OT system using preset historical event stream data includes:

[0054] Extract the IT server response time parameter and the OT signal light current fluctuation parameter from the preset historical event stream data, and generate a parameter correlation weight matrix;

[0055] Specifically, this step aims to extract key parameters from the pre-defined historical event stream data for both IT and OT ends, and quantify the statistical correlation between these parameters. Statistical analysis methods, such as Mutual Information (MI), are applied to assess the dependence strength between different parameter time series. The calculated correlation strength values ​​between each parameter pair are organized into a Parameter Correlation Weight Matrix (PCWM). For example, the correlation PCWMuv between parameter u and parameter v can be calculated using the following MI formula:

[0056]

[0057] In the formula, s u ,s v Given time series data with parameters u and v, p(s) u ,s v ) is their joint probability distribution, p(s) u ), p(s v The marginal probability distributions are shown below. This PCWM provides foundational data for subsequent construction of causal graphs, such as... Figure 3 As shown.

[0058] According to the preset sparsity processing rules, the associated edges in the parameter correlation weight matrix that are less than the preset weight are removed to generate a causal relationship graph between the IT system and the OT system.

[0059] Specifically, the generated PCWM may contain a large number of weak or indirect correlations. This step simplifies these by using pre-defined sparsity rules to highlight core dependencies. These rules may include setting a preset weight threshold, removing correlation edges in the PCWM with weights below this threshold as insignificant, or employing a strategy of retaining the strongest correlation edge for each node. After sparsity processing, the correlations with higher weights that are retained in the matrix are considered to be the main causal paths between IT and OT system elements. These selected strong correlation parameters together constitute a more clearly structured causal relationship graph between IT and OT systems that effectively reflects core dependencies.

[0060] For example, if the correlation weight between parameter A and parameter B is calculated to be 0.7, and the weight between parameter A and parameter C is 0.1, and if the preset weight threshold is set to 0.3, then during the sparsification process, the correlation between parameter A and B will be retained in the final causal relationship graph because its weight of 0.7 is greater than 0.3. Conversely, the correlation between parameter A and C will be removed because its weight of 0.1 is less than 0.3. Through this operation, the final causal relationship graph will mainly show paths with strong correlations, thereby improving the readability and analysis efficiency of the graph.

[0061] Optionally, generating an active monitoring node set and issuing monitoring commands to the OT devices corresponding to the active monitoring node set includes:

[0062] When the server latency parameter is detected to exceed a preset threshold, the associated OT device current ripple node is matched and obtained from the causal relationship graph.

[0063] Specifically, this step describes how to proactively locate potentially affected key nodes on the OT side based on specific anomaly signals from the IT side. When the real-time or statistical values ​​of important server latency parameters in the IT system exceed a pre-set performance warning threshold, this usually indicates a potential performance bottleneck or abnormal state on the IT side. At this time, a causal relationship graph is used to perform matching queries within the graph. The goal of the query is to find OT-related nodes that have a strong causal correlation or logical dependency with the IT server nodes currently experiencing latency. In this embodiment, particular attention is paid to OT nodes related to the characteristics of device current ripple, as current ripple is an important indirect indicator reflecting the health status and operational stability of OT equipment. Through graph matching algorithms, such as path search based on predefined rules or similarity node query based on graph embedding, one or more OT device current ripple monitoring nodes most likely related to the current IT anomaly are finally identified and obtained. These nodes will become the focus of subsequent refined monitoring and analysis.

[0064] Based on the preset traffic flow time period division rules, the abnormal confidence tolerance range of the associated OT equipment current ripple node is corrected.

[0065] Specifically, this step aims to adaptively adjust the sensitivity of monitoring parameters based on external, dynamically changing environmental factors. A pre-defined traffic flow time-segmentation rule is built-in or referenced, which automatically categorizes the current operating environment into the corresponding traffic flow state based on different time periods of the day or accessed real-time traffic information. For identified associated OT equipment current ripple nodes, the anomaly confidence tolerance interval originally used to determine whether they are abnormal will be dynamically adjusted according to the characteristics of the current traffic flow time period. For example, during peak traffic hours, the stability of certain OT equipment related to traffic signal control or rail transit operations is crucial; in this case, the anomaly confidence tolerance interval for their corresponding parameters may be tightened, making even small parameter deviations more easily identified as potential anomalies.

[0066] An active monitoring node set is generated based on the corrected anomaly confidence tolerance interval, and the monitoring command is issued to the OT device corresponding to the active monitoring node set.

[0067] Specifically, this step, based on the previous analysis and dynamic adjustment results, ultimately identifies the OT devices that most urgently require enhanced monitoring and initiates corresponding monitoring actions. Using a dynamically adjusted, more context-relevant anomaly confidence tolerance range based on traffic flow time periods, previously identified associated OT device current ripple nodes exceeding this adjusted, stricter or more lenient tolerance range are reassessed. These nodes are judged as having high potential risk or exhibiting obvious early signs of anomalies. All these successfully identified nodes collectively constitute the activated monitoring node set. This set dynamically indicates the group of OT devices that currently require more monitoring resources and closer tracking. Subsequently, monitoring instructions are issued to each OT device in this activated monitoring node set. These instructions may include, but are not limited to, requesting the target device to report its detailed operating parameters more frequently, activating the device's built-in self-diagnostic program, executing specific test sequences to obtain more in-depth fault characteristic information, or temporarily adjusting certain non-critical operating parameters to observe their impact on abnormal states, thereby achieving enhanced monitoring and in-depth status assessment of these high-risk or activated nodes.

[0068] For example, suppose a critical OT device current ripple node has a basic anomaly confidence tolerance range set at ±5% of its normal average value for a certain characteristic parameter. During off-peak traffic hours, the adjustment factor might be set to 1.0 according to traffic flow time-segmentation rules, and the corrected tolerance range remains ±5%. However, during peak traffic hours, to ensure the absolute reliability of traffic light control systems at critical intersections, this rule might set the adjustment factor to 0.6. In this case, the anomaly confidence tolerance range for the node would be tightened to ±3%. If the node's characteristic parameter fluctuates by 4% in real-time during peak hours, while this might not be considered immediately activating monitoring during off-peak hours, during peak hours, because it exceeds the corrected ±3% tolerance range, the node would be included in the activated monitoring node set and issued higher-level monitoring instructions, such as requiring it to report detailed status data every second instead of the usual once per minute.

[0069] Optionally, the tolerance range for the abnormal confidence level of the associated OT device current ripple node includes:

[0070] The current time period is determined according to the preset traffic flow time period division rules;

[0071] Specifically, this step is a prerequisite for achieving dynamic and differentiated correction of the tolerance range. First, the pre-defined traffic flow time-segmentation rules are invoked and applied. These rules map the current actual time or perceived environmental state to one or more predefined traffic flow characteristic time periods. For example, this rule might be a static timetable that divides a 24-hour day into several intervals, such as defining 7:00-9:00 AM and 5:00-7:00 PM on weekdays as peak hours, 9:00-5:00 PM as off-peak hours, and other times and holidays as low-peak hours. Alternatively, this rule can be dynamic, dynamically evaluating and determining whether the current actual traffic flow time period belongs to peak, off-peak, or other pre-defined categories based on real-time external data and pre-defined judgment logic or machine learning models. The output of this step is a clear determination of the current time period type.

[0072] If the current time period is determined to be a peak period, the abnormal confidence tolerance range of the associated OT equipment current ripple node is compressed and corrected.

[0073] Specifically, once the current time period is determined to be a peak period, a targeted tolerance range adjustment strategy is initiated. For the identified associated OT equipment current ripple nodes, a compression correction operation is performed on their current anomaly confidence tolerance range used to determine whether operating parameters are abnormal. This means that during this critical peak period, the monitoring sensitivity of these nodes will be increased, and the tolerance for parameters deviating from the normal range will be reduced. This compression correction can be manifested, for example, by assigning an adjustment factor a value less than 1 during peak periods. In this way, even small parameter fluctuations are more easily detected and identified as potential anomalies, thereby facilitating earlier risk identification and intervention during critical periods with heavy loads and high potential risks.

[0074] If the current time period is determined to be a non-peak period, the abnormal confidence tolerance range of the associated OT equipment current ripple node is adjusted to relax its tolerance.

[0075] Specifically, corresponding to the peak-hour strategy, once the current period is determined to be an off-peak period, adjustments will be made to relax the tolerance of the abnormal confidence tolerance range for the same associated OT equipment current ripple nodes. During these normal operating periods, the tolerance for small, transient fluctuations in equipment parameters can be appropriately increased. This helps reduce excessive unnecessary attention or low-level alarms caused by normal operational disturbances or non-critical fluctuations, thereby optimizing the allocation of monitoring resources and reducing operator interference. Relaxing the tolerance can also be achieved by adjusting factors. Through this differentiated and adaptive tolerance range adjustment strategy based on different time periods, this invention ensures that the monitoring system can guarantee high security during critical periods while maintaining operational stability and monitoring efficiency during normal periods.

[0076] Optionally, generating the progressive early warning signal includes:

[0077] Receive feedback data from the OT device, extract the device current ripple abnormal signal from the feedback data, and match the device current ripple abnormal signal with a preset set of normal operation instructions;

[0078] Specifically, the system first receives feedback data from the target OT device and extracts key abnormal current ripple signals, such as abnormal fluctuations in specific frequency components of the current or significant changes in the Total Harmonic Distortion (THD) value. To initially distinguish between faults and normal operation, these extracted abnormal signal features are matched against a preset instruction set that stores signal patterns under normal operating conditions. If the current signal features do not match any normal pattern in this set, it is preliminarily considered that there may be a genuine device malfunction.

[0079] When the abnormal current ripple signal of the device does not match the preset set of normal operation instructions, the traffic flow density data of adjacent nodes in the preset area are obtained.

[0080] Specifically, if the current ripple anomaly signal of the current device is confirmed to indicate a potential real anomaly, cross-node information collection is further initiated. At this time, within a preset area, traffic flow density data of other nodes that are logically or physically adjacent to or associated with the OT device currently experiencing the anomaly are collected. This type of density data generally refers to information that can reflect the operating load, interaction intensity, or activity level of these adjacent nodes, such as the throughput of network nodes, the operating parameters or processing rates of other devices, etc., to build a more comprehensive understanding of the contextual environment of the current anomaly.

[0081] The spatial correlation between the traffic flow density data and the abnormal current ripple signal of the equipment is determined. When the spatial correlation conforms to the preset diffusion chain pattern, a progressive early warning signal is generated.

[0082] Specifically, the next step involves comprehensively analyzing the abnormal current ripple signal of the target node's equipment and traffic flow density data obtained from its neighboring nodes to determine whether there is a significant spatial correlation between the two. This determination aims to analyze whether the anomaly at the target node occurs in isolation or is synergistic with the operational status or environmental changes of surrounding nodes. When the determined spatial correlation characteristics match a pre-defined diffusion chain pattern that characterizes the potential spread of a fault or risk or the formation of a chain reaction, a progressive early warning signal is generated. This diffusion chain pattern is a predefined combination of typical characteristics used to identify the propagation of a specific fault or the accumulation of risks. The level of the early warning signal can be dynamically determined based on the degree of matching of the diffusion chain pattern or the scope of its influence; for example, its early warning level L. warn The following function can be used for calculation:

[0083] L warn =f(S) match N nodes V spread ),

[0084] In the formula, S match N represents the matching score between the current state and the preset diffusion chain pattern. nodes V represents the number of affected nodes involved in this diffusion chain pattern. spread The estimated risk diffusion rate or trend strength is represented by f, which is a predefined function that determines the warning level based on a combination of these factors. The warning level is dynamically adjusted as the risk scenario evolves, reflecting a gradual approach. Figure 4 As shown.

[0085] For example, if an OT device A exhibits an abnormal current ripple pattern that deviates from its normal operating mode, the current load rate of its neighboring device B and the network bandwidth utilization rate of the relevant IT node C are then acquired as traffic flow density data. Analysis reveals a strong temporal and logical correlation between the abnormal condition of device A, the high load rate of device B, and the high bandwidth utilization of node C. This combination of characteristics precisely matches a pre-defined high-risk diffusion chain pattern. At this point, based on the pattern's matching score, the number of involved nodes, and the potential diffusion trend, an initial warning level, such as a medium level, is calculated using a pre-defined function, and a corresponding progressive warning signal is generated. If subsequent monitoring shows that this diffusion chain pattern further expands or worsens, for example, if more associated nodes exhibit abnormalities, the warning level may be upgraded to a higher category.

[0086] Optionally, the generation of the progressive early warning signal further includes:

[0087] Acquire all abnormal signals within a preset area and analyze the geographical distribution characteristics of the all abnormal signals;

[0088] Specifically, to enhance early warning capabilities, the first step is to broadly acquire all anomaly signals within a pre-defined area. These signals are aggregated from various anomaly indications from different IT and OT monitoring points, and their scope may extend beyond the specific signal types focused on in the preceding steps. Subsequently, the geographical distribution characteristics of these all anomaly signals will be analyzed, such as their spatial density in the physical or network topology, degree of clustering, or the existence of specific arrangement patterns, aiming to grasp the overall situation of anomalies and their potential spatial correlations from a more macroscopic perspective.

[0089] If the geographical distribution characteristics match the preset cascading fault propagation path, a cross-system fault alarm report is generated.

[0090] Specifically, the analyzed geographical distribution characteristics are matched against a set of pre-defined cascading fault propagation path templates. These templates are predefined patterns that characterize typical patterns of faults or risks that cross IT and OT domains and gradually spread their impact. If the analyzed geographical distribution characteristics closely match one of these pre-defined path templates, for example, if the calculated matching score exceeds a certain threshold, this usually indicates that a cascading fault event with a clear propagation trend and a potentially large impact range may be occurring. In this case, a detailed cross-system fault alarm report is generated. This report differs from general progressive warning signals; it specifically targets the identified cascading fault propagation path, providing in-depth information including key nodes involved, current fault status, and possible evolution trends to support operations personnel in conducting higher-level, targeted emergency responses.

[0091] The fault source node is marked according to the cascaded fault propagation path, and the fault source node is injected into the weight update queue of the causal relationship graph.

[0092] Specifically, once a cascading fault propagation path is identified and confirmed, one or more most likely fault source nodes are initially marked based on the path's characteristics, such as its starting point, propagation direction, or key bottleneck nodes. This marking helps narrow down the scope of subsequent fault investigation. Subsequently, the information on these marked fault source nodes, along with related confirmed fault propagation characteristics, impact range, and other key diagnostic information, is organized and injected into a weight update queue. This weight update queue acts as an information buffer, temporarily storing data that reflects the dynamic characteristics and deep causal relationships in actual fault events. This information can then be used to learn and optimize the structural parameters or connection weights of the causal relationship graph at appropriate times, thereby continuously improving the accuracy and effectiveness of the graph model in future tasks such as fault prediction, risk analysis, and intelligent diagnosis.

[0093] Optionally, adjusting the IT system's resource allocation strategy and generating OT device operation instruction correction parameters based on the progressive early warning signal includes:

[0094] Based on the progressive early warning signal, the resource allocation strategy update parameters of the IT system are determined, and the resource allocation strategy update parameters are applied to adjust the API response latency threshold of the IT system.

[0095] Specifically, upon receiving a progressive warning signal, the system analyzes and determines the corresponding IT system resource allocation policy update parameters based on the content and level of the warning, such as service priorities or resource quotas that need to be adjusted. Subsequently, these updated parameters are applied to proactively optimize IT resource allocation by specifically adjusting key control points within the IT system, such as API response latency thresholds, in order to effectively address the potential risks or performance issues indicated by the warning.

[0096] Based on the current ripple frequency parameters, a signal light timing adjustment command for the OT device is generated, and the signal light timing adjustment command is sent to the corresponding OT device.

[0097] Specifically, to achieve precise control of OT (Operational Technology), the mentioned current ripple frequency parameter is used to generate signal light timing adjustment commands for specific OT devices. This command generation based on the real-time state of specific devices makes the OT-side response more targeted. For example, based on the potential fault risk indicated by the current ripple, the operating timing of the signal lights can be adjusted to ensure safety. These generated commands constitute part of the OT device operation command correction parameters and are sent to the corresponding OT devices for execution.

[0098] The results of the coordinated execution of the resource allocation strategy update parameters and the traffic light timing adjustment instructions are fed back to the causal relationship graph update weight matrix of the IT system and the OT system.

[0099] Specifically, to achieve continuous learning and optimization capabilities, this step is responsible for collecting the collaborative execution results generated after the actual operation of IT resource strategy adjustments and OT equipment operation command adjustments. These results, such as changes in IT system performance indicators, improvements in OT equipment status, or the degree of risk mitigation, will be analyzed and fed back into the causal relationship graph to update the weight matrix. Updating the weight matrix here refers to adjusting the connection weights or node attributes between nodes within the graph. Through this feedback mechanism based on actual control effects, the causal graph model can self-evolve, thereby improving the accuracy of future early warnings and the effectiveness of response decisions.

[0100] For example, if a progressive warning signal is generated indicating that IT network congestion may affect the issuance of critical OT control commands, IT resource policy update parameters may be determined to prioritize relevant network traffic, and this policy may be implemented by adjusting API parameters. Simultaneously, if current ripple frequency parameters indicate a risk of delayed response from an OT signaling device due to unstable power supply, a semaphore timing adjustment command is generated to slightly optimize its safety interval. When subsequent monitoring shows that IT network congestion has eased and OT device responses have returned to normal, these successful adjustments and their effects will be fed back into the causal graph to update its weight matrix, for example, by strengthening the correlation weight between the corresponding warning mode and these effective control measures.

[0101] Optionally, the method further includes:

[0102] The system acquires real-time location data from vehicle-to-everything (V2X) terminals and calculates the current vehicle queue length and corresponding vehicle queue length threshold using a pre-set intersection congestion prediction model.

[0103] Specifically, this step obtains real-time vehicle location information from an external Internet of Vehicles (IoV) terminal. Using this location data and a pre-defined intersection congestion prediction model, the current actual vehicle queue length at a specific intersection of interest is calculated and analyzed. Simultaneously, a threshold is generated to determine whether this queue length constitutes congestion. These two values ​​form the basis for subsequent congestion status assessment and decision-making.

[0104] When the current vehicle queue length exceeds the vehicle queue length threshold, the congestion prediction result of the current vehicle queue length is injected into the dynamic pruning process of the causal relationship graph to generate a dynamic node monitoring priority correction value.

[0105] Specifically, if the calculated current vehicle queue length exceeds its corresponding queue length threshold, traffic congestion is determined to have occurred or is about to occur at the intersection. In this case, the predicted congestion situation is treated as an external dynamic influencing factor and injected into the dynamic pruning logic of the causal relationship graph. The purpose of this injection is to adjust the focus of the graph analysis based on the current traffic congestion situation and ultimately generate a dynamic node monitoring priority correction value.

[0106] The monitoring order of the set of active monitoring nodes is adjusted according to the dynamic node monitoring priority correction value.

[0107] Specifically, a dynamic node monitoring priority correction value is used to dynamically adjust the attention order or monitoring resource allocation of each monitoring node within the active monitoring node set. For example, the monitoring priority of IT or OT monitoring nodes that are considered to have a high correlation with the currently congested intersection area through causal graph analysis may be temporarily increased based on this correction value. In this way, it is possible to ensure that monitoring resources are prioritized for key units that are most likely to be affected by traffic congestion or that influence traffic congestion, thereby achieving more targeted and proactive risk prevention.

[0108] Optionally, the method further includes:

[0109] Receive regional pedestrian and vehicle traffic data from an external smart street light network, and generate brightness gradient adjustment instructions based on the regional pedestrian and vehicle traffic data;

[0110] Specifically, this step receives real-time or near real-time data on pedestrian and vehicle traffic flow within a specific area from an external smart street light network system. Based on the analysis of this traffic flow data to determine the actual lighting needs of the current area, the method of this invention generates corresponding brightness gradient adjustment instructions. These instructions are designed to guide the external smart street light system to dynamically adjust the lighting brightness levels of its relevant streetlights, for example, automatically increasing lighting when pedestrian and vehicle traffic is high, and appropriately reducing brightness when traffic is low, thereby achieving the goals of on-demand lighting and energy conservation.

[0111] When abnormal street light voltage parameters are detected from the external smart street light network, power supply strategy correction parameters for adjacent street light devices are generated based on the current associated feature set.

[0112] Specifically, if the external smart street light network receives parameters indicating an abnormal voltage in a particular street light or area of ​​street lights—such as persistently high or low voltage—this may indicate a potential electrical problem with the street light itself or its local power supply line. In this case, a comprehensive analysis is performed using a set of associated features. Based on this analysis, corresponding power supply strategy correction parameters are generated for adjacent street light devices located at the street light with the abnormal voltage, either geographically or electrically. These parameters aim to guide adjustments to the power supply mode or operating parameters of these adjacent street lights, such as temporarily slightly reducing their operating power to alleviate potential power supply pressure at the fault point, or preparing for potential fault isolation or switching to a backup power supply link, thereby ensuring the overall reliability and safety of the area's lighting.

[0113] The brightness gradient adjustment command and the power supply strategy correction parameters are jointly sent to the relevant devices in the external smart street light network, and a cross-system optimization execution log is generated.

[0114] Specifically, the brightness gradient adjustment commands and power supply strategy correction parameters will be integrated or prioritized. These collaboratively considered commands and parameters will then be uniformly or separately issued to the relevant streetlight devices or their control units in the external smart streetlight network for execution, thereby achieving comprehensive and dynamic control of the streetlight system's lighting effect and power supply safety. Key aspects of this entire cross-system collaborative operation, the content of the issued commands, the device responses, and the final execution results will all be recorded, forming a cross-system optimization execution log. This log can be used for subsequent operational status auditing, system performance analysis, fault diagnosis, and continuous improvement of optimization strategies.

[0115] For example, if an external smart street light network system reports extremely low pedestrian and vehicle traffic data for a commercial street late at night, the method of this invention generates an instruction based on this data, requiring the overall brightness of the street lights in that street to be reduced to energy-saving mode. Almost simultaneously, if a street light in that street uploads an abnormal parameter indicating a persistently low operating voltage, the current IT / OT system's associated feature set is retrieved and analyzed to determine if this low voltage might affect other nearby street lights. If a risk is identified, power supply strategy correction parameters are generated, suggesting a temporary slight reduction in the rated power of several healthy street lights near the abnormal street light to balance the load. Subsequently, the brightness reduction instruction and power reduction parameters are sent to the street light control system for execution according to preset collaborative logic. All these interactions and execution results are recorded in the cross-system optimization execution log.

[0116] It should be noted that the formulas described above, through the principle of dimensional consistency and mathematical standardization methods (such as normalization, dimensionless parameter conversion, or unit system unification), can translate physical quantities with different properties into unitless standard values ​​or parameters that can be superimposed in the same dimension. This eliminates the interference of different dimensions on the computational logic, allowing the formulas to retain the original data distribution characteristics while possessing mathematical rationality and adaptability to objective laws. These are conventional technical methods and will not be elaborated further. The electrical connections between the various units described above do not necessarily represent direct or indirect connections; any indirect connection method is applicable to the embodiments of this invention as long as it achieves the purpose of this invention. The above descriptions are merely exemplary embodiments of this invention and should not be construed as limiting the scope of this invention.

[0117] All equivalent changes and modifications made in accordance with the teachings of this invention are still within the scope of this invention. Those skilled in the art will readily conceive of other embodiments of this invention upon considering the specification and the disclosure of practical truth. This application is intended to cover any variations, uses, or adaptations of this invention that follow the general principles of this invention and include common knowledge or conventional techniques in the art not described herein.

Claims

1. An IT+OT full-link state detection and early warning method, characterized in that, The method comprises: obtaining a server delay parameter of an IT system and a device current ripple parameter of an OT system, converting the server delay parameter into a first protocol data stream through a lightweight probe, and converting the device current ripple parameter into a second protocol data stream through a non-intrusive modem; based on a preset protocol mapping white box, the first protocol data stream and the second protocol data stream are processed by space-time stamp alignment and confidence quantification, and a space-time stamp and abnormal confidence double-dimensional event stream is generated; wherein the generation of the space-time stamp and abnormal confidence double-dimensional event stream comprises: analyzing the API call timestamp and packet loss rate parameter of the first protocol data stream to generate first abnormal confidence data; analyzing the current ripple frequency parameter and operation instruction restoration matching degree of the second protocol data stream to generate second abnormal confidence data; based on a preset space-time stamp alignment algorithm, the first abnormal confidence data and the second abnormal confidence data are combined to generate a space-time stamp and abnormal confidence double-dimensional event stream; a causal relationship graph of the IT system and the OT system is constructed using preset historical event stream data, and a current correlation feature set is extracted according to the space-time stamp of the double-dimensional event stream; wherein the construction of the causal relationship graph of the IT system and the OT system using the preset historical event stream data comprises: extracting the IT end server response time parameter and the OT end signal lamp current fluctuation parameter in the preset historical event stream data to generate a parameter correlation degree weight matrix; according to a preset sparsification processing rule, remove the correlation edges in the parameter correlation degree weight matrix that are less than a preset weight to generate a causal relationship graph of the IT system and the OT system; according to the current correlation feature set, the causal relationship graph is dynamically pruned to generate an activated monitoring node set, and a monitoring instruction is issued to the OT device corresponding to the activated monitoring node set; wherein the generation of the activated monitoring node set and the issuance of the monitoring instruction to the OT device corresponding to the activated monitoring node set comprises: when it is detected that the server delay parameter exceeds a preset threshold, an associated OT device current ripple node is matched and obtained from the causal relationship graph; based on a preset traffic flow period division rule, the abnormal confidence tolerance interval of the associated OT device current ripple node is corrected; according to the corrected abnormal confidence tolerance interval, an activated monitoring node set is generated, and a monitoring instruction is issued to the OT device corresponding to the activated monitoring node set; receiving feedback data of the OT device, performing cross-node verification on the feedback data, and generating a progressive early warning signal when the number of abnormal events in a preset area exceeds a preset threshold; wherein the generation of the progressive early warning signal comprises: receiving the feedback data of the OT device, extracting a device current ripple abnormal signal from the feedback data, and matching the device current ripple abnormal signal with a preset normal operation instruction set; when the device current ripple abnormal signal does not match the preset normal operation instruction set, obtaining traffic flow density data of adjacent nodes in a preset area; judging the spatial correlation of the traffic flow density data and the device current ripple abnormal signal, and generating a progressive early warning signal when the spatial correlation meets a preset diffusion chain mode; the generation of the progressive early warning signal further comprises: obtaining a full-quantity abnormal signal in a preset area, and analyzing the geographical distribution characteristics of the full-quantity abnormal signal; if the geographical distribution characteristics meet a preset cascading failure diffusion path, a cross-system failure warning report is generated; the source node of the cascading failure diffusion path is marked, and the source node is injected into the weight update queue of the causal relationship graph; adjusting the resource allocation strategy of the IT system and generating an OT device operation instruction correction parameter according to the progressive early warning signal; wherein the adjustment of the resource allocation strategy of the IT system and the generation of the OT device operation instruction correction parameter according to the progressive early warning signal comprise: determining an IT system resource allocation strategy update parameter according to the progressive early warning signal, and applying the resource allocation strategy update parameter to adjust the API response delay threshold of the IT system; generating a signal lamp timing adjustment instruction of the OT device based on the current ripple frequency parameter, and issuing the signal lamp timing adjustment instruction to the corresponding OT device; the cooperative execution result of the resource allocation strategy update parameter and the signal lamp timing adjustment instruction is fed back to the causal relationship graph update weight matrix of the IT system and the OT system.

2. The IT+OT full-link state detection and early warning method according to claim 1, characterized in that, The modification of the abnormal confidence tolerance interval of the associated OT device current ripple node comprises: determining the current period according to a preset traffic flow period division rule; if it is determined that the current period is a peak period, the abnormal confidence tolerance interval of the associated OT device current ripple node is compressed and modified; if it is determined that the current period is a flat peak period, the abnormal confidence tolerance interval of the associated OT device current ripple node is adjusted and the tolerance is relaxed.

3. The IT+OT full link state detection and early warning method of claim 1, wherein, The method further comprises: obtaining real-time positioning data of the Internet of Vehicles terminal, and calculating the current vehicle queue length and the corresponding vehicle queue length threshold value through a preset intersection congestion prediction model; when the current vehicle queue length exceeds the vehicle queue length threshold value, the congestion prediction result of the current vehicle queue length is injected into the dynamic pruning process of the causal relationship graph to generate a dynamic node monitoring priority correction value; adjusting the monitoring order of the activated monitoring node set according to the dynamic node monitoring priority correction value.

4. The IT+OT full link state detection and early warning method of claim 1, wherein, The method further comprises: Receive regional people and vehicle flow data from an external intelligent street lamp network, and generate a brightness gradient adjustment instruction based on the regional people and vehicle flow data; When detecting an abnormal street lamp voltage parameter from the external intelligent street lamp network, generate a power supply strategy correction parameter for a neighboring street lamp device according to the current associated feature set; Distribute the brightness gradient adjustment instruction and the power supply strategy correction parameter to related devices of the external intelligent street lamp network, and generate a cross-system optimization execution log.

Images