Smart city management system based on big data and Internet of Things communication

Abstract

The invention provides a smart city management system based on big data and Internet of Things communication, the smart city management system is applied to the technical field of smart city management, and a first construction module identifies small changes of parameters and provides a basis for identifying hidden attacks. And the first comparison module detects the deviation condition of the associated parameters relative to the base line through comparison. The first association module identifies associated event pairs composed of a plurality of scattered events through association analysis based on event occurrence time, related equipment and occurrence positions. The first evaluation module quantifies the risk caused by the potential attack behavior to the actual operation efficiency and service quality of the system. And the attack identification module generates structured alarm information and provides information required for identifying, positioning and coping with hidden attacks for operation and security personnel. Therefore, the method and the device have the beneficial effects of identifying hidden attacks, evaluating operation risks and providing alarm information so as to facilitate timely processing of managers or operators.

Description

Technical Field

[0001] The present application relates to the field of smart city management technology, and in particular to a smart city management system based on big data and Internet of Things communications. Background Art

[0002] The development of smart cities relies on efficient and reliable infrastructure, of which energy infrastructure is a key component. As a typical smart city energy infrastructure, the urban heating system is large in scale and complex in structure. It usually includes the heat source side (such as the boiler room), the primary heating pipeline network, the heat exchange station, the secondary heating pipeline network, and the user-end equipment. In order to ensure the quality of heating, optimize energy utilization, and ensure the safe and stable operation of the system, the operation center continuously collects massive amounts of operating data and uses big data analysis technology to process and analyze the aggregated data to support heat load forecasting, pipeline network hydraulic and thermal balance assessment, equipment status monitoring, and the generation and issuance of optimized control strategies. These measures are aimed at achieving on-demand and precise heating, minimizing energy consumption, while ensuring the heating quality of users and the safe operation of the entire system.

[0003] However, the data analysis and security protection capabilities of current operations management platforms primarily focus on identifying single parameter anomalies exceeding preset thresholds or known cyberattack patterns. In actual operational environments, the sheer scale of the system, the diverse range of equipment, the dispersed data sources, and the complexity of communication links, coupled with the inherent physical topology of the heating network and the complex thermal and hydraulic coupling between equipment (e.g., between heat exchange stations and between the network and heat exchange stations), make covert attacks targeting operational processes even more difficult to detect.

[0004] These subtle attacks often don't manifest as dramatic fluctuations in a single parameter or obvious network intrusions, but rather through minute parameter adjustments distributed across different devices or systems over long periods of time. These small perturbations, below typical anomaly thresholds, may not trigger alarms individually, but acting in concert can mislead operational decisions or influence control parameters, ultimately resulting in cumulative and subtle impacts on key operational indicators such as energy efficiency, heating quality, and hydraulic balance.

[0005] Traditional detection methods based on thresholds or known patterns struggle to effectively correlate these scattered, subtle events, nor can they deeply understand their transmission effects within complex system topologies and coupling relationships. Consequently, they struggle to identify these new, covert attack patterns. Furthermore, they are unable to accurately assess the actual risks and urgency of these attacks to the operational efficiency, costs, and service quality of urban energy systems based on the real-time operating status of the infrastructure and system structure. Consequently, existing technologies lack a management system that can effectively identify covert attacks. Summary of the Invention

[0006] In view of the above-mentioned shortcomings of the existing technology, the present application provides a smart city management system based on big data and Internet of Things communication, which has the beneficial effects of identifying hidden attacks, assessing operational risks, and providing alarm information to facilitate timely processing by management or operation personnel.

[0007] In a first aspect, a smart city management system based on big data and Internet of Things communications is provided, the system comprising:

[0008] The first building block: obtaining historical operating data of the heating system and using the historical operating data to build a multi-dimensional operating behavior baseline model;

[0009] The first comparison module collects the heating system operation data in real time, compares it with the operation behavior baseline model, detects the deviation of the associated parameters from the baseline, and obtains the operation status deviation event;

[0010] The first correlation module: analyzes the time, device, and location correlation of operational status deviation events with low-priority events in the security log to identify correlated event pairs;

[0011] The first assessment module: assesses the impact of related events on key operational indicators and calculates operational risk scores;

[0012] Attack identification module: When the risk score exceeds the preset security score, an alarm message including the attack path, impact range, consequences, and operational risk score is generated based on the key event pair corresponding to the risk score.

[0013] Furthermore, the first building block includes:

[0014] A first acquisition module: acquiring historical operation data, cleaning the historical operation data, and obtaining cleaned historical operation data;

[0015] Time series extraction module: for the cleaned historical operation data, the sliding window method is used to extract time series feature data, and the time series feature data is reduced in dimension to obtain the reduced-dimensional time series feature data;

[0016] The second construction module: Based on the time series feature data after dimensionality reduction, the mutual information method is used to calculate the correlation between parameters, and the parameter pairs with mutual information values greater than the threshold are selected to build a parameter correlation model;

[0017] A first extraction module is used to extract the equipment parameters and pipe network status of the heating system based on the parameter association model;

[0018] The third construction module: Based on historical operation data, a regression analysis method is used to establish a mapping relationship between equipment parameters, pipeline network status and operation indicators to obtain an operation indicator mapping model; the multi-dimensional operation behavior baseline model at least includes a parameter association model and the operation indicator mapping model.

[0019] Furthermore, the first building block also includes:

[0020] Partitioning module: divides the heating system into multiple areas according to the physical topology of the heating network;

[0021] The fourth construction module: calculates the thermal coupling coefficient and the hydraulic coupling coefficient between regions and constructs a regional coupling model; the multi-dimensional operation behavior baseline model also includes the regional coupling model.

[0022] Furthermore, the second building block includes:

[0023] The first screening module: for the time series feature data after dimensionality reduction, preliminarily screens the candidate parameter set whose correlation with the target parameter is greater than the set threshold;

[0024] The first calculation module calculates the mutual information value between each parameter in the candidate parameter set and the target parameter to obtain the mutual information matrix between parameters;

[0025] The first training module: selects parameter pairs whose mutual information values are greater than a preset threshold from the mutual information matrix, uses the parameter pairs and their mutual information values as input features of the LSTM neural network, and trains the LSTM neural network using the historical operation data;

[0026] The fifth construction module: constructs the parameter association model based on the trained LSTM neural network.

[0027] Furthermore, the first comparison module includes:

[0028] The second acquisition module collects the real-time operating data of the heating system, uses Kalman filtering to reduce noise interference, and obtains filtered operating data;

[0029] A second extraction module is configured to extract associated parameters of the parameter association model, the regional coupling model, the operation indicator mapping model, and the operation behavior baseline model;

[0030] A second calculation module: inputs the plurality of associated parameters into the operational behavior baseline model, and calculates a predicted value of each associated parameter, as well as a residual between the real-time operating data and the predicted value;

[0031] Judgment module: judges whether the residual of each associated parameter exceeds the corresponding adaptive threshold. If so, it determines that the event corresponding to the real-time operation data is an operation status deviation event, and records the deviation parameters, deviation degree and occurrence time.

[0032] Furthermore, the second calculation module includes:

[0033] The third calculation module: Input the correlation parameters into the parameter correlation model in the operational behavior baseline model to obtain the preliminary predicted values of each parameter. At the same time, based on the correlation parameters and the regional coupling model, the correction coefficient of each parameter due to the influence of regional coupling is obtained;

[0034] The fourth calculation module: uses a multiplication method to adjust the preliminary predicted values of each parameter according to the correction coefficient of the regional coupling effect to obtain the refined predicted values of each associated parameter;

[0035] A fifth calculation module is configured to calculate the residual according to the real-time operation data and the refined prediction value.

[0036] Furthermore, the judgment module includes: an adaptive threshold acquisition module, and the adaptive threshold acquisition module includes:

[0037] The sixth calculation module: for the residual of the associated parameter, obtains the historical residual data within a preset time window and calculates the mean and standard deviation of the historical residual data;

[0038] The seventh calculation module: According to the mean and standard deviation of the historical residual data, the adaptive threshold is calculated using the formula Threshold = Mean + K * Std, where Threshold represents the adaptive threshold, Mean represents the mean of the historical residual data, Std represents the standard deviation of the historical residual data, and K is the adaptive coefficient.

[0039] Furthermore, the first association module includes:

[0040] A third extraction module is configured to extract the set of operation status deviation events and the set of low-priority events in the security log respectively;

[0041] The second correlation module calculates the time distance between each event in the operational status deviation event set and each event in the low-priority event set. If the time distance is less than a preset time threshold, it is determined to be a time-correlated event pair.

[0042] The third correlation module: For a time-correlated event pair, if the operation status deviation event and the low-priority event in the event pair occur on the same device, it is determined to be a device-correlated event pair;

[0043] The fourth association module: For a device-associated event pair, if the geographical distance between the operating status deviation event and the location of the low-priority event in the event pair is less than a preset distance threshold, it is determined to be a location-associated event pair, and the location-associated event pair is output as an associated event pair.

[0044] Furthermore, the first evaluation module includes:

[0045] The sixth construction module: constructing a topological model including heating network nodes, pipelines, and heat exchange stations;

[0046] The first positioning module: for the associated event pairs, locates the affected nodes or pipelines in the topology model and determines the event impact area based on the regional coupling model;

[0047] An eighth calculation module: calculating the energy consumption increase data, heating quality decline data, and hydraulic balance deviation data of the associated event pair based on the topological model and the regional coupling model;

[0048] A ninth calculation module: performing weighted calculation on the energy consumption increase data, the heating quality decrease data, and the hydraulic balance deviation data to obtain an operation risk score.

[0049] Furthermore, the attack identification module includes:

[0050] Path acquisition module: when the operational risk score exceeds the preset security score, the attacked device, attack time sequence, and attack type are determined based on the associated event pairs to form an attack path;

[0051] Impact range acquisition module: Based on the attack path and combined with the topology model, the module determines the affected nodes, pipelines, heat exchange stations, and users, and obtains the attack impact range;

[0052] Consequences Acquisition Module: This module analyzes energy waste, heating service interruption duration, and user complaints based on the attack impact scope and operational risk score to determine the consequences of the attack.

[0053] Alarm information acquisition module: Integrates attack paths, attack impact ranges, attack consequences, and operational risk scores into structured alarm information for easy processing by operations and security personnel.

[0054] Beneficial effects: The present application proposes a smart city management system based on big data and Internet of Things communications. The first building module establishes a multi-dimensional operational behavior baseline model by acquiring historical operational data, identifies slight changes in parameters, and provides a basis for identifying hidden attacks. The first comparison module detects the deviation of related parameters from the baseline through comparison, and captures small, continuous or scattered abnormal behaviors that are not enough to trigger traditional threshold alarms. The first correlation module identifies related event pairs consisting of multiple scattered events based on the time of event occurrence, the equipment involved, and the location of occurrence through correlation analysis. The first evaluation module quantifies the risks posed by potential attack behaviors to the actual operational efficiency and service quality of the system. The attack identification module generates structured alarm information, providing operations and security personnel with the information needed to identify, locate and respond to hidden attacks. Therefore, the present application has the beneficial effects of identifying hidden attacks, evaluating operational risks, and providing alarm information for management or operations personnel to handle in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a structural diagram of a smart city management system based on big data and Internet of Things communication proposed in this application.

[0056] Figure 2 This is a system block diagram of the smart city management system based on big data and Internet of Things communication proposed in this application.

[0057] Explanation of reference numerals: 101, first construction module; 102, first comparison module; 103, first association module; 104, first evaluation module; 105, attack identification module. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and marked in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work fall within the scope of protection of the present application.

[0059] It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0060] Please refer to Figure 1 、 Figure 2 , a smart city management system based on big data and Internet of Things communications, the system includes:

[0061] The first construction module 101: obtaining historical operation data of the heating system and using the historical operation data to construct a multi-dimensional operation behavior baseline model;

[0062] The first comparison module 102 collects heating system operation data in real time, compares it with the operation behavior baseline model, detects the deviation of related parameters from the baseline, and obtains an operation status deviation event;

[0063] The first correlation module 103 performs time, device, and location correlation analysis on the operation status deviation event and the low-priority events in the security log to identify the correlation event pair;

[0064] The first assessment module 104 is used to assess the impact of related events on key operational indicators and calculate operational risk scores;

[0065] Attack identification module 105: When the risk score exceeds the preset security score, it generates alarm information including attack path, impact range, consequences, and operational risk score based on the key event pair corresponding to the risk score.

[0066] Specifically, the system first processes the historical operating data of the heating system through the first building module 101 to establish a multi-dimensional operating behavior baseline model that reflects the normal operation status of the system. This multi-dimensional operating behavior baseline model captures the normal relationship between parameters and the change patterns over time.

[0067] Subsequently, the first comparison module 102 continuously collects real-time operating data from the heating system and inputs it into the established baseline model of operational behavior for comparison. By calculating the difference between the real-time data and the baseline model's predicted values, the system can detect parameter deviations, even those that are minimal and insufficient to trigger traditional threshold alarms, thereby identifying operational status deviation events.

[0068] Next, the first correlation module 103 receives these operational status deviation events and correlates them with low-priority events in the system's collected security logs. This analysis considers the temporal proximity of the events, the device identifiers involved, and the geographic proximity of the event locations. Through this multi-dimensional correlation, the system can discover possible connections between seemingly isolated operational anomalies and inconspicuous security incidents, identifying pairs of correlated events that represent potential coordinated attacks.

[0069] Furthermore, the first assessment module 104 receives the identified associated event pairs and assesses their potential impact on key operational indicators of the heating system (e.g., energy consumption, heating quality, and hydraulic balance). Based on the assessment results, the system calculates a quantitative operational risk score that reflects the degree of risk posed by potential attacks to the system's actual operational efficiency and service quality.

[0070] Finally, the attack identification module 105 monitors the operational risk score. When the calculated risk score exceeds the preset security score threshold, the system determines that a potential covert attack exists. At this point, the system generates a structured alert based on the associated event pairs that resulted in the high risk score. This alert details the possible attack path, the scope of the affected system, the expected consequences of the attack, and the calculated operational risk score, providing operations and security personnel with the information necessary to identify, locate, and respond to covert attacks.

[0071] Furthermore, the first building block includes:

[0072] The first acquisition module: acquires historical operation data, cleans the historical operation data, and obtains the cleaned historical operation data;

[0073] Time series extraction module: For the cleaned historical operation data, the sliding window method is used to extract time series feature data, and the time series feature data is reduced in dimension to obtain the reduced-dimensional time series feature data;

[0074] The second construction module: Based on the time series feature data after dimensionality reduction, the mutual information method is used to calculate the correlation between parameters, and the parameter pairs with mutual information values greater than the threshold are selected to build a parameter correlation model;

[0075] The first extraction module: extracts the equipment parameters and pipe network status of the heating system based on the parameter association model;

[0076] The third construction module: Based on historical operation data, the regression analysis method is used to establish the mapping relationship between equipment parameters, pipeline network status and operation indicators to obtain an operation indicator mapping model; the multi-dimensional operation behavior baseline model at least includes a parameter association model and an operation indicator mapping model.

[0077] The first acquisition module acquires historical operating data and cleans the historical operating data to obtain cleaned historical operating data. Cleaning may include removing outliers, filling missing values, or smoothing noisy data.

[0078] The time series extraction module uses the sliding window method to extract time series feature data from the cleaned historical operation data, and reduces the dimension of the time series feature data to obtain the reduced-dimensional time series feature data.

[0079] The sliding window method extracts local features by moving a fixed-size window across the time series, and dimensionality reduction can be performed using methods such as principal component analysis (PCA) or t-SNE.

[0080] The second construction module uses the mutual information method to calculate the correlation between parameters based on the reduced time series feature data. Parameter pairs with mutual information values greater than a threshold are selected to construct a parameter correlation model. Mutual information measures the interdependence between two random variables; larger values indicate stronger correlation.

[0081] The first extraction module extracts the equipment parameters and pipe network status of the heating system based on the parameter association model.

[0082] The third construction module uses regression analysis method based on historical operation data to establish the mapping relationship between equipment parameters, pipeline network status and operation indicators to obtain the operation indicator mapping model.

[0083] Regression analysis can use methods such as linear regression, polynomial regression, or support vector regression. The multidimensional operational behavior baseline model includes at least a parameter association model and an operational indicator mapping model. The parameter association model describes the mutual influence between system internal parameters, while the operational indicator mapping model describes the relationship between system status and operational performance.

[0084] Specifically, in the context of smart city energy infrastructure, which is characterized by large scale, heterogeneous data, complex pipeline networks, and coupled devices, this solution addresses the challenge of effectively processing historical operational data, extracting key features, and accurately constructing a multidimensional baseline model that reflects complex system dynamics and parameter relationships. This solution uses the first acquisition module to cleanse raw historical operational data, improving data quality. The time series extraction module uses a sliding window method to capture the temporal dynamics of the data and reduces data complexity through dimensionality reduction.

[0085] The second construction module uses the mutual information method to identify the true correlation between parameters and construct a parameter correlation model, revealing the structural dependencies within the system. Based on this model, the first extraction module determines the key equipment parameters and pipeline network status.

[0086] The third building block uses regression analysis to establish quantitative relationships between these key parameters and states and operational indicators, forming an operational indicator mapping model. This multidimensional operational behavior baseline model combines the correlations between parameters (parameter correlation model) and the impact of system states on operational performance (operational indicator mapping model). This model more comprehensively and accurately depicts the normal operational behavior of the heating system, providing a refined reference baseline for subsequent detection of operational status deviations.

[0087] Furthermore, the first building block also includes:

[0088] Partitioning module: divides the heating system into multiple areas according to the physical topology of the heating network;

[0089] The fourth construction module: calculate the thermal coupling coefficient and hydraulic coupling coefficient between regions and construct a regional coupling model; the multi-dimensional operation behavior baseline model also includes a regional coupling model.

[0090] Among them, the possible implementation method of the zoning module is: using the geographic information system data and equipment connection relationship of the heating pipeline network to identify key nodes in the pipeline network, such as heat exchange stations or main branch points, and based on the service scope or physical connection relationship of these key nodes, the entire heating system is spatially divided into several independent or interrelated areas.

[0091] A possible implementation method for the fourth building block is to collect parameters such as flow, temperature, and pressure at the boundaries of each area in historical operating data, and use the principles of thermodynamics and hydraulics to quantify the degree of mutual influence of heat and water between different areas through data analysis or physical model calculation methods, obtain the thermal coupling coefficient and hydraulic coupling coefficient, and construct a mathematical model describing the interaction between regions based on these coefficients.

[0092] Furthermore, the second building block includes:

[0093] The first screening module: for the time series feature data after dimensionality reduction, preliminarily screens the candidate parameter set whose correlation with the target parameter is greater than the set threshold;

[0094] The first calculation module calculates the mutual information value between each parameter in the candidate parameter set and the target parameter to obtain the mutual information matrix between parameters;

[0095] The first training module: selects parameter pairs with mutual information values greater than a preset threshold from the mutual information matrix, uses the parameter pairs and their mutual information values as input features for the LSTM neural network, and trains the LSTM neural network using historical operation data;

[0096] The fifth building block: construct a parameter association model based on the trained LSTM neural network.

[0097] Specifically, this technical solution provides a specific method for constructing a parameter association model, aiming to address the shortcomings of existing methods in capturing complex parameter associations.

[0098] First, the first screening module processes the time series feature data after dimensionality reduction. By calculating the correlation between the parameters and the target parameters and comparing them with the set threshold, the parameters with low correlation are preliminarily eliminated, thereby narrowing the scope of subsequent analysis and improving processing efficiency.

[0099] Next, the first calculation module calculates the mutual information value between each parameter in the screened candidate parameter set and the target parameter, quantifies the degree of correlation between the parameters, and generates a mutual information matrix. The mutual information can measure the nonlinear correlation between the parameters.

[0100] Furthermore, the first training module, the core of this solution, selects parameter pairs from the mutual information matrix whose mutual information values exceed a preset threshold. These parameter pairs and their mutual information values are used as input features to train an LSTM neural network using historical operational data. LSTM neural networks process time series data and are capable of learning and capturing the complex, dynamic, and nonlinear relationships between parameters that change over time. Using mutual information values as input features helps the neural network understand the strength of associations between different parameter pairs. Through training on historical data, the neural network learns patterns in the associations between parameters under different operational conditions.

[0101] Finally, the fifth building block constructs a parameter association model based on the trained LSTM neural network. This model leverages the modeling capabilities of LSTM to form a model that reflects the complex dynamic relationships between parameters. By using the LSTM neural network and incorporating mutual information as input features, this solution can more accurately model the complex relationships between parameters in the heating system. This allows for a more detailed characterization of the interaction effects between parameters, especially when faced with small, sustained parameter changes. This more precise parameter association model improves the accuracy of the baseline model of operational behavior, thereby enhancing the ability to detect subsequent operational state deviations and helping to identify covert attacks that do not manifest as drastic fluctuations.

[0102] Furthermore, the first comparison module includes:

[0103] The second acquisition module collects the real-time operating data of the heating system, uses Kalman filtering to reduce noise interference, and obtains filtered operating data;

[0104] The second extraction module extracts the correlation parameters of the parameter correlation model, regional coupling model, operation indicator mapping model and operation behavior baseline model;

[0105] The second calculation module: inputs multiple related parameters into the operation behavior baseline model, calculates the predicted value of each related parameter, and the residual between the real-time operation data and the predicted value;

[0106] Judgment module: determines whether the residual of each associated parameter exceeds the corresponding adaptive threshold. If so, the event corresponding to the real-time operation data is determined to be an operation status deviation event, and the deviation parameters, deviation degree and occurrence time are recorded.

[0107] The first comparison module includes a second acquisition module, a second extraction module, a second calculation module, and a judgment module. The second acquisition module collects real-time operating data from the heating system and processes the data using a Kalman filter to obtain filtered operating data. The Kalman filter establishes a system state space model and combines prediction and update steps to estimate the true system state from noisy measurement data, thereby reducing the impact of noise on data accuracy.

[0108] The second extraction module identifies and extracts correlation parameters related to the current comparison from the operation behavior baseline models such as the parameter correlation model, the regional coupling model, and the operation indicator mapping model.

[0109] The second calculation module inputs the extracted correlation parameters into the operational behavior baseline model, uses the model to calculate the predicted value of each correlation parameter, and calculates the residual between the filtered real-time operation data and the predicted value. The judgment module receives this residual data and compares it with the corresponding adaptive threshold.

[0110] The adaptive threshold is dynamically calculated based on historical residual data, for example, based on the mean and standard deviation of the historical residuals. When the residual exceeds the adaptive threshold, the judgment module determines that the state corresponding to the current real-time operating data is an operational state deviation event and records the deviation parameters, degree of deviation, and time of occurrence.

[0111] Furthermore, the second calculation module includes:

[0112] The third calculation module: Input the correlation parameters into the parameter correlation model in the operational behavior baseline model to obtain the preliminary predicted values of each parameter. At the same time, based on the correlation parameters and the regional coupling model, the correction coefficient of each parameter due to the influence of regional coupling is obtained;

[0113] The fourth calculation module: uses the multiplication form to adjust the preliminary predicted values of each parameter according to the correction coefficient of regional coupling influence to obtain the refined predicted values of each associated parameter;

[0114] The fifth calculation module: calculates the residual based on the real-time operation data and the refined prediction value.

[0115] Specifically, this technical solution obtains a preliminary prediction of the parameters by inputting the correlation parameters into the parameter correlation model. Simultaneously, using the regional coupling model, the degree of regional coupling's influence on the parameters is calculated based on the correlation parameters and quantified as a correction coefficient.

[0116] The initial predictions are then corrected by multiplying them with correction factors to produce more accurate predictions. This correction process reflects the effects of interactions between zones within the heating system on local parameters.

[0117] Finally, the real-time operational data is compared with the refined forecast values corrected by regional coupling, and the residual between the two is calculated. The magnitude of the residual reflects the degree of deviation between the real-time operational status and the baseline of normal operating behavior.

[0118] In this way, the scheme improves the accuracy of parameter prediction, enabling subsequent residual-based deviation detection to more accurately identify operational status deviation events, and solves the problem of insufficient accuracy that may result from directly using a model that does not consider regional coupling for prediction.

[0119] Furthermore, the judgment module includes: an adaptive threshold acquisition module, and the adaptive threshold acquisition module includes:

[0120] The sixth calculation module: for the residual of the associated parameter, obtains the historical residual data within a preset time window and calculates the mean and standard deviation of the historical residual data;

[0121] The seventh calculation module: According to the mean and standard deviation of the historical residual data, the adaptive threshold is calculated using the formula Threshold = Mean + K * Std, where Threshold represents the adaptive threshold, Mean represents the mean of the historical residual data, Std represents the standard deviation of the historical residual data, and K is the adaptive coefficient.

[0122] Specifically, in order to solve the problem of how to accurately and robustly obtain or calculate the adaptive threshold, this solution provides a threshold determination method based on the statistical characteristics of historical residual data.

[0123] First, for the associated parameter to be determined for deviation, the system collects historical residual data for that parameter within a preset time window. This historical residual data represents the difference between the real-time operating data and the predicted value of the baseline model of operating behavior. Then, the arithmetic mean (Mean) and standard deviation (Std) of the collected historical residual data are calculated. The mean represents the average level of the residual, and the standard deviation represents the fluctuation range of the residual. These two statistics together characterize the fluctuation characteristics of the parameter under normal operating conditions. Finally, the calculated Mean and Std are substituted into the formula: Threshold = Mean + K * Std to calculate the current adaptive threshold for the associated parameter. K is an adjustable adaptive coefficient whose value can be adjusted based on the actual application scenario and the required false positive and false negative rates. When the real-time residual of the associated parameter exceeds the calculated adaptive threshold, the system determines that the event corresponding to the real-time data is an operational status deviation event. In this way, the threshold can be adaptively adjusted based on the historical fluctuation of the parameter, improving the accuracy of the judgment and reducing the false positives and false negatives that may be caused by fixed thresholds.

[0124] Furthermore, the first association module includes:

[0125] The third extraction module extracts the set of operational status deviation events and the set of low-priority events in the security log respectively;

[0126] The second correlation module calculates the time distance between each event in the operational status deviation event set and each event in the low-priority event set. If the time distance is less than a preset time threshold, it is determined to be a time-correlated event pair.

[0127] The third correlation module: For a time-correlated event pair, if the operation status deviation event and the low-priority event in the event pair occur on the same device, it is determined to be a device-correlated event pair;

[0128] The fourth association module: For a device-associated event pair, if the geographical distance between the operating status deviation event and the location of the low-priority event in the event pair is less than a preset distance threshold, it is determined to be a location-associated event pair, and the location-associated event pair is output as an associated event pair.

[0129] Among them, the third extraction module is used to obtain the data basis required for correlation analysis, that is, to collect event records of deviations in operating status and event records marked as low priority in the security log, respectively, to form two independent event sets.

[0130] The second correlation module performs preliminary time screening on the acquired event set. By calculating the time difference between the operational deviation event and all low-priority safety events and comparing it with the preset time threshold, it quickly eliminates event pairs that are not related in time and obtains a set of time-correlated event pairs.

[0131] Furthermore, the third association module adds device-level association judgment based on the time-related event pairs, checks whether the two events in the event pair are recorded under the same device identifier, thereby screening out time-related events occurring on the same device and obtaining a set of device-related event pairs.

[0132] Finally, the fourth correlation module incorporates geographic location information for a final screening of device-linked event pairs. It calculates the geographic distance between the locations of the event pairs and compares it with a preset distance threshold. This identifies geographically close pairs of device-linked events. These event pairs that pass the triple filter of time, device, and location are identified as potential linked event pairs and output. This step-by-step, layer-by-layer refined correlation analysis process effectively identifies event pairs that are closely related across multiple dimensions from massive amounts of dispersed event data, improving the accuracy of correlation analysis.

[0133] Furthermore, the first evaluation module includes:

[0134] The sixth construction module: constructing a topological model including heating network nodes, pipelines, and heat exchange stations;

[0135] The first positioning module: for the associated event pairs, locates the affected nodes or pipelines in the topology model and determines the event impact area based on the regional coupling model;

[0136] The eighth calculation module: Based on the topological model and regional coupling model, it calculates the energy consumption increase data, heating quality decline data, and hydraulic balance deviation data of the associated event pairs;

[0137] The ninth calculation module: Perform weighted calculations on the data on increased energy consumption, decreased heating quality, and hydraulic balance deviation to obtain an operational risk score.

[0138] Among them, building a topological model provides a physical structural representation of the heating system, including the connection relationship between nodes, pipelines and heat exchange stations. Locating the affected nodes or pipelines is to use the topological model to determine the specific location of the event. Determining the area affected by the event based on the regional coupling model is to use the regional coupling model that describes the thermal or hydraulic interaction relationship between different areas of the system to determine the possible scope of the event. Calculating the data on increased energy consumption, decreased heating quality, and hydraulic balance deviation is to quantify the impact of the event on operational indicators. Weighted calculation of these data is to integrate different types of quantitative impacts into a single risk score, and the weighting coefficient can be set according to the importance of different indicators.

[0139] Furthermore, the attack identification module includes:

[0140] Path acquisition module: When the operational risk score exceeds the preset security score, the module determines the attacked device, attack time sequence, and attack type based on the associated event pairs, and forms an attack path;

[0141] Impact range acquisition module: Based on the attack path and combined with the topology model, it determines the affected nodes, pipelines, heat exchange stations, and users, and obtains the attack impact range;

[0142] Consequences Acquisition Module: This module analyzes energy waste, heating service interruption duration, and user complaints based on the attack impact scope and operational risk score to determine the consequences of the attack.

[0143] Alarm information acquisition module: Integrates attack paths, attack impact ranges, attack consequences, and operational risk scores into structured alarm information for easy processing by operations and security personnel.

[0144] Specifically, this technical solution provides specific implementation steps of the attack identification module to solve the problem of how to convert detected potential covert attacks into alarm information that can be understood and processed by operations and security personnel.

[0145] When the operational risk score exceeds the preset security score, the path acquisition module activates, receiving correlated event pairs as input. By analyzing these correlated event pairs, the path acquisition module identifies the specific devices targeted by the attack, the chronological order of the events, and the likely attack type, thereby constructing an attack path. This provides information about the attack process.

[0146] The impact range acquisition module uses the attack path determined by the path acquisition module and combines it with the heating system's topological model to infer the range of the attack's propagation within the physical system. This module identifies the specific system components affected by the attack and the users that may ultimately be affected, thereby defining the attack's impact boundary.

[0147] The Consequence Capture module further quantifies the actual operational consequences of the attack based on the impact scope determined by the Impact Capture module and the operational risk score calculated. This module analyzes specific operational metrics, such as the increase in energy consumption caused by the attack, the potential duration of heating service interruptions, and the number of potential customer complaints. This module translates the abstract risk score into a concrete, measurable description of operational losses.

[0148] The alert information acquisition module is the final step in the attack identification process. It integrates the attack path, impact scope, and consequences obtained in the previous steps with the original operational risk score to generate a structured alert. This structured format enables operations and security personnel to quickly and accurately understand the nature, scope, potential impact, and risk level of the attack, enabling more effective development and execution of response measures. By integrating these modules, this technical solution transforms abstract risk detection results into detailed alerts that encompass the full scope of the attack, directly addressing the technical challenge of providing effective alert information to support subsequent action.

[0149] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0150] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Persons skilled in the art will readily appreciate that the present application may be modified and altered in various ways. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A smart city management system based on big data and Internet of Things communication, characterized by: The system comprises: The first building block: obtaining historical operating data of the heating system and using the historical operating data to build a multi-dimensional operating behavior baseline model; The first comparison module collects the heating system operation data in real time, compares it with the operation behavior baseline model, detects the deviation of the associated parameters from the baseline, and obtains the operation status deviation event; The first correlation module: analyzes the time, device, and location correlation of operational status deviation events with low-priority events in the security log to identify correlated event pairs; The first assessment module: assesses the impact of related events on key operational indicators and calculates operational risk scores; Attack identification module: When the risk score exceeds the preset security score, an alarm message including the attack path, impact range, consequences, and operational risk score is generated based on the key event pair corresponding to the risk score.

2. A smart city management system based on big data and Internet of Things communication according to claim 1, characterized in that: The first building block includes: A first acquisition module: acquiring historical operation data, cleaning the historical operation data, and obtaining cleaned historical operation data; Time series extraction module: for the cleaned historical operation data, the sliding window method is used to extract time series feature data, and the time series feature data is reduced in dimension to obtain the reduced-dimensional time series feature data; The second construction module: Based on the time series feature data after dimensionality reduction, the mutual information method is used to calculate the correlation between parameters, and the parameter pairs with mutual information values greater than the threshold are selected to build a parameter correlation model; A first extraction module is used to extract the equipment parameters and pipe network status of the heating system based on the parameter association model; The third construction module: Based on historical operation data, a regression analysis method is used to establish a mapping relationship between equipment parameters, pipeline network status and operation indicators to obtain an operation indicator mapping model; the multi-dimensional operation behavior baseline model at least includes a parameter association model and the operation indicator mapping model.

3. A smart city management system based on big data and Internet of Things communication according to claim 2, characterized in that: The first building block also includes: Partitioning module: divides the heating system into multiple areas according to the physical topology of the heating network; The fourth construction module: calculates the thermal coupling coefficient and the hydraulic coupling coefficient between regions and constructs a regional coupling model; the multi-dimensional operation behavior baseline model also includes the regional coupling model.

4. A smart city management system based on big data and Internet of Things communication according to claim 2, characterized in that: The second building block includes: The first screening module: for the time series feature data after dimensionality reduction, preliminarily screens the candidate parameter set whose correlation with the target parameter is greater than the set threshold; The first calculation module calculates the mutual information value between each parameter in the candidate parameter set and the target parameter to obtain the mutual information matrix between parameters; The first training module: selects parameter pairs whose mutual information values are greater than a preset threshold from the mutual information matrix, uses the parameter pairs and their mutual information values as input features of the LSTM neural network, and trains the LSTM neural network using the historical operation data; The fifth construction module: constructs the parameter association model based on the trained LSTM neural network.

5. The smart city management system based on big data and Internet of Things communication according to claim 3 is characterized in that: The first comparison module includes: The second acquisition module collects the real-time operating data of the heating system, uses Kalman filtering to reduce noise interference, and obtains filtered operating data; A second extraction module is configured to extract associated parameters of the parameter association model, the regional coupling model, the operation indicator mapping model, and the operation behavior baseline model; A second calculation module: inputs the plurality of associated parameters into the operational behavior baseline model, and calculates a predicted value of each associated parameter, as well as a residual between the real-time operating data and the predicted value; Judgment module: judges whether the residual of each associated parameter exceeds the corresponding adaptive threshold. If so, it determines that the event corresponding to the real-time operation data is an operation status deviation event, and records the deviation parameters, deviation degree and occurrence time.

6. The smart city management system based on big data and Internet of Things communication according to claim 5, characterized in that: The second calculation module includes: The third calculation module: Input the correlation parameters into the parameter correlation model in the operational behavior baseline model to obtain the preliminary predicted values of each parameter. At the same time, based on the correlation parameters and the regional coupling model, the correction coefficient of each parameter due to the influence of regional coupling is obtained; The fourth calculation module: uses a multiplication method to adjust the preliminary predicted values of each parameter according to the correction coefficient of the regional coupling effect to obtain the refined predicted values of each associated parameter; A fifth calculation module is configured to calculate the residual according to the real-time operation data and the refined prediction value.

7. The smart city management system based on big data and Internet of Things communication according to claim 5, characterized in that: The judgment module includes: an adaptive threshold acquisition module, and the adaptive threshold acquisition module includes: The sixth calculation module: for the residual of the associated parameter, obtains the historical residual data within a preset time window and calculates the mean and standard deviation of the historical residual data; The seventh calculation module: According to the mean and standard deviation of the historical residual data, the adaptive threshold is calculated using the formula Threshold = Mean + K * Std, where Threshold represents the adaptive threshold, Mean represents the mean of the historical residual data, Std represents the standard deviation of the historical residual data, and K is the adaptive coefficient.

8. The smart city management system based on big data and Internet of Things communication according to claim 1 is characterized in that: The first association module includes: A third extraction module is configured to extract the set of operation status deviation events and the set of low-priority events in the security log respectively; The second correlation module calculates the time distance between each event in the operational status deviation event set and each event in the low-priority event set. If the time distance is less than a preset time threshold, it is determined to be a time-correlated event pair. The third correlation module: For a time-correlated event pair, if the operation status deviation event and the low-priority event in the event pair occur on the same device, it is determined to be a device-correlated event pair; The fourth association module: For a device-associated event pair, if the geographical distance between the operating status deviation event and the location of the low-priority event in the event pair is less than a preset distance threshold, it is determined to be a location-associated event pair, and the location-associated event pair is output as an associated event pair.

9. The smart city management system based on big data and Internet of Things communication according to claim 1, characterized in that: The first assessment module includes: The sixth construction module: constructing a topological model including heating network nodes, pipelines, and heat exchange stations; The first positioning module: for the associated event pairs, locates the affected nodes or pipelines in the topology model and determines the event impact area based on the regional coupling model; An eighth calculation module: calculating the energy consumption increase data, heating quality decline data, and hydraulic balance deviation data of the associated event pair based on the topological model and the regional coupling model; A ninth calculation module: performing weighted calculation on the energy consumption increase data, the heating quality decrease data, and the hydraulic balance deviation data to obtain an operation risk score.

10. A smart city management system based on big data and Internet of Things communication according to claim 9, characterized in that: The attack identification module includes: Path acquisition module: when the operational risk score exceeds the preset security score, the attacked device, attack time sequence, and attack type are determined based on the associated event pairs to form an attack path; Impact range acquisition module: Based on the attack path and combined with the topology model, the module determines the affected nodes, pipelines, heat exchange stations, and users, and obtains the attack impact range; Consequences Acquisition Module: This module analyzes energy waste, heating service interruption duration, and user complaints based on the attack impact scope and operational risk score to determine the consequences of the attack. Alarm information acquisition module: Integrates attack paths, attack impact ranges, attack consequences, and operational risk scores into structured alarm information for easy processing by operations and security personnel.

Images