Safety production risk identification method and system based on knowledge graph

Abstract

The application discloses a kind of safety production risk identification method and system based on knowledge graph, it is related to safety production risk identification technical field, by obtaining the entity node and relationship edge data of knowledge graph and extracting feature vector, embedding representation is generated using graph neural network, the risk mode is determined using attention mechanism to calculate node weight, the risk propagation sequence is generated by traversing associated path, the entity state is updated by fusing timing characteristics and the dynamic propagation path is determined, the risk mode is optimized by extracting key node subgraph adjusting edge weight, finally, the complete risk propagation chain is identified by iteration query integration environmental characteristics.This application realizes the dynamic tracking of equipment, personnel, environmental network risk and cross-dimension cascading risk identification.

Description

Technical Field

[0001] This invention relates to the technical field of safety production risk identification, and in particular to a safety production risk identification method and system based on knowledge graphs. Background Technology

[0002] Safety in production is a crucial aspect of ensuring personnel safety, equipment stability, and production continuity in the industrial sector, directly impacting the stability of enterprise operations and the sustainable development of the social economy. With the increasing complexity of industrial systems, the sources of safety risks have become more diverse, involving multiple dimensions such as equipment operating status, personnel operational behavior, and environmental factors. Existing safety risk identification methods often rely on single-dimensional monitoring or rule-making, making it difficult to capture the dynamic correlations between different factors. For example, traditional methods may only focus on equipment fault signals, ignoring the potential impact of human error or environmental anomalies on the fault.

[0003] Furthermore, many solutions lack a comprehensive analysis of risk propagation paths when dealing with complex systems, leading to delayed detection of potential hazards and insufficient early warning capabilities. In safety production risk identification, knowledge graphs have become an important technical tool due to their ability to integrate multi-source heterogeneous data and reveal relationships between entities. However, after constructing a knowledge graph that includes equipment status, personnel behavior, and environmental factors, effectively analyzing the characteristics of entity nodes and relationship edges to uncover hidden risk patterns becomes a core challenge.

[0004] The primary technical challenge lies in extracting deep-seated correlations from multi-dimensional feature vectors. For example, in chemical production scenarios, abnormal equipment temperatures may be related to operators failing to adjust parameters according to procedures, and this correlation is often hidden within the data, making it difficult to capture directly. Furthermore, the complexity of this feature extraction leads to another challenge: how to accurately identify the propagation paths of risks between different entities based on the topological structure of the data graph. For instance, a minor equipment malfunction may spread through human error, ultimately triggering environmental anomalies and leading to major safety accidents, and current technologies struggle to accurately predict such chain reactions.

[0005] Therefore, how to automatically extract hidden risk patterns and identify risk propagation paths by deeply analyzing the multi-dimensional features of entity nodes and relationship edges in knowledge graphs, combined with the graph topology, has become a key issue in safety production risk identification. Summary of the Invention

[0006] Therefore, the technical problem to be solved by the present invention is to overcome the shortcomings of the prior art in dealing with complex systems, which lacks a comprehensive analysis of the risk propagation path, resulting in untimely discovery of potential hidden dangers and insufficient early warning capabilities. The present invention provides a safety production risk identification method based on knowledge graphs, which can realize the dynamic tracking of risks along the network of equipment, personnel and environment through a multi-level collaborative processing architecture, and automatically identify cascading risk patterns generated by cross-dimensional interactions.

[0007] To address the aforementioned technical problems, this invention provides a method for identifying safety production risks based on knowledge graphs, comprising:

[0008] Obtain entity nodes and relation edge data from the knowledge graph, and extract multi-dimensional feature vectors;

[0009] A graph neural network is used to perform convolution operations on entity nodes and relation edges to aggregate neighborhood information and generate embedded representations.

[0010] By using embedded representation and an attention mechanism, the weight distribution among entity nodes is calculated to determine risk patterns.

[0011] Based on the risk pattern, traverse the associated paths in the knowledge graph to generate a risk propagation sequence;

[0012] Based on the risk propagation sequence, the entity status is updated by integrating the temporal changes of multi-dimensional feature vectors, and the dynamic propagation path is determined.

[0013] Extract key node subgraphs from the dynamic propagation path, adjust the path edge weights, highlight the interactive influence between equipment status and personnel behavior, and generate a refined risk model.

[0014] Based on the refined risk model representation, the knowledge graph is iteratively queried, additional features of environmental factors are integrated, the complete propagation chain is determined, and the final risk identification result is obtained.

[0015] In one embodiment of the present invention, extracting a multi-dimensional feature vector includes:

[0016] By querying the preset knowledge graph database interface, an initial multi-dimensional feature vector is obtained from the entity nodes of equipment status, personnel behavior, and environmental factors. This vector includes temperature readings that record equipment status, operation logs that record personnel behavior, and humidity indicators that record environmental factors. The temperature readings, operation logs, and humidity indicators constitute a feature set.

[0017] The k-nearest neighbor algorithm is used to perform cluster analysis on the feature set, and the features are grouped according to the similarity of temperature readings, humidity index, and operation logs to obtain the feature clustering results;

[0018] If there are abnormal groups in the feature clustering results, the abnormal feature vectors are isolated by the anomaly detection algorithm, and the anomaly is judged based on the preset threshold to obtain the normal feature set;

[0019] Based on the normal feature set, contextual relationships are extracted from the knowledge graph to generate a set of association rules. Using the set of association rules, a decision tree algorithm is used to classify and predict temperature readings, humidity indicators, and operation logs to obtain equipment status prediction results.

[0020] If the device status prediction result deviates from the normal range, the entity node attributes in the knowledge graph are updated through the database interface to obtain the updated feature vector. Based on the updated feature vector, cluster analysis is re-executed to verify consistency and obtain the optimized feature set.

[0021] In one embodiment of the present invention, a graph neural network is used to perform convolution operations on entity nodes and relation edges to aggregate neighborhood information and generate an embedded representation, including:

[0022] By using a pre-defined knowledge graph database interface, entity node and relation edge data are obtained, and a graph neural network is used to perform convolution operations to aggregate neighborhood information and generate an initial embedding vector.

[0023] Based on the initial embedding vector, an attention mechanism is used to allocate weights, highlighting the local features of key entity nodes and relation edges, and generating a weighted embedding vector;

[0024] If the similarity between the weighted embedding vector and the preset topological structure template is lower than the preset threshold, the embedding vectors are grouped by cluster analysis to identify abnormal embedding vectors and obtain a set of normal embedding vectors.

[0025] Based on the set of normal embedding vectors, contextual information is extracted from the knowledge graph to generate a set of association rules. Then, the random forest algorithm is used to classify the normal embedding vectors and determine the state prediction results of the entity nodes.

[0026] If the state prediction result deviates from the preset normal range, the entity node attributes in the knowledge graph are updated through the database interface to generate updated embedding vectors. Based on the updated embedding vectors, the graph neural network convolution operation is re-executed to verify consistency and obtain the optimized embedding vector set.

[0027] In one embodiment of the present invention, the risk pattern is determined by calculating the weight distribution among entity nodes through an attention mechanism, including:

[0028] Node relationships are extracted from the embedded representation, and the weight distribution between entity nodes is calculated using an attention mechanism to obtain the connection strength. Risk patterns are then analyzed based on the connection strength.

[0029] If the connection strength exceeds a preset threshold, it is judged as a high-risk association, and a set of risk patterns is obtained;

[0030] For a set of risk patterns, a clustering algorithm is used to mine latent patterns and obtain pattern classification results. Features are extracted from the pattern classification results, data correlations are analyzed, and latent hidden patterns are obtained. Through latent hidden patterns, the correlation strength between patterns is calculated to obtain the final pattern distribution. Based on the final pattern distribution, a visual representation of risk patterns is generated to obtain the analysis results.

[0031] In one embodiment of the present invention, based on the risk pattern, a risk propagation sequence is generated by traversing the associated paths in the knowledge graph, including:

[0032] Extract related entities from the knowledge graph, traverse the connection paths between entities using breadth-first search to obtain a preliminary risk propagation sequence, and then proceed based on the preliminary risk propagation sequence;

[0033] Obtain the attribute values ​​of each entity in the path, determine the risk transmission intensity between entities through weighted calculation, generate a risk transmission matrix, and if there are high-intensity transmission paths in the risk transmission matrix, extract the main risk propagation direction through matrix factorization algorithm to obtain the key propagation subsequence;

[0034] Based on the key propagation subsequence, cluster analysis is used to group entities, obtain risk clusters, and determine risk concentration areas. If the number of entities in a risk concentration area exceeds a preset threshold, the entity clusters are mapped to a low-dimensional space using a graph embedding algorithm to obtain semantic relation vectors.

[0035] Based on semantic relation vectors, anomaly detection algorithms are used to identify potential abnormal entities, obtain an abnormal entity set, and then traverse the association paths in the knowledge graph through the abnormal entity set to generate the final risk propagation sequence.

[0036] In one embodiment of the present invention, based on the risk propagation sequence, the entity state is updated by fusing the temporal changes of multi-dimensional feature vectors to determine the dynamic propagation path, including:

[0037] Entity data in the risk propagation sequence is obtained, feature vectors are extracted from multi-dimensional time series data to obtain a set of entity feature vectors, a network topology is constructed through a graph neural network, and the topology connection is updated according to the set of entity feature vectors to obtain the network topology.

[0038] A recursive update mechanism is adopted to iteratively calculate the changes in entity states based on the network topology to obtain an entity state sequence. If any entity state in the entity state sequence exceeds a preset threshold, the propagation path weights are adjusted through a graph neural network to obtain the propagation path with adjusted weights.

[0039] Based on the propagation path after weight adjustment, the temporal change trend of the propagation path prediction is analyzed to obtain the propagation path prediction result. By integrating the state update rule with the propagation path prediction result, the dynamic propagation path is iteratively optimized to obtain the optimized dynamic propagation path.

[0040] An optimized dynamic propagation path is adopted, and time series data fusion is used to determine the final dynamic propagation path.

[0041] In one embodiment of the present invention, key node subgraphs are extracted from the dynamic propagation path, path edge weights are adjusted, the interaction between equipment status and personnel behavior is highlighted, and a refined risk model is generated, including:

[0042] The key node subgraph is extracted from the dynamic propagation path. The node connection strength is determined by the graph segmentation algorithm to obtain the key node subgraph. For the key node subgraph, the attention mechanism is used to calculate the interaction influence relationship between nodes, adjust the path edge weights, and generate a weighted path subgraph.

[0043] The interaction features between equipment status data and personnel behavior data are obtained from the weighted path subgraph. Principal component analysis is used to extract the main interaction patterns and determine the interaction influence relationship. If the intensity of the interaction influence relationship exceeds the preset threshold, the interaction features are grouped by clustering algorithm to obtain the association pattern between behavior triggering conditions and equipment abnormal signals.

[0044] Based on the correlation pattern, the correspondence between abnormal equipment signals and behavioral triggering conditions is extracted to generate risk assessment indicators. Through the risk assessment indicators, the abnormal equipment signals and behavioral triggering conditions are integrated using a weighted summation method to generate a refined risk pattern.

[0045] In one embodiment of the present invention, based on a refined risk pattern representation, an iterative query is performed on the knowledge graph to integrate additional features of environmental factors, determine the complete propagation chain, and obtain the final risk identification result, including:

[0046] The propagation chain features are obtained from the refined risk model. The knowledge graph query method is used to extract the node attributes related to environmental factor data to obtain the environmental association feature set. Based on the environmental association feature set, the propagation relationship between nodes is analyzed using graph convolutional network, and the weights of the propagation chain features are updated to obtain the weighted propagation features.

[0047] The correlation data between device status interaction and human behavior interaction is extracted from the weighted propagation features. Principal component analysis is used to extract the main interaction patterns and determine the interaction feature set. If the correlation strength of the interaction feature set exceeds the preset threshold, the K-means clustering method is used to group the interaction features to obtain the correlation pattern between behavior triggering conditions and device abnormal signals.

[0048] Based on the correlation pattern, the correspondence between abnormal equipment signals and behavior triggering conditions is extracted. Environmental factor data is fused using a weighted summation method to generate a comprehensive risk index. The changing trend of risk propagation path is extracted from the comprehensive risk index. Time series analysis is used to predict the dynamic changes of risk propagation path, resulting in dynamic risk prediction results. Based on the dynamic risk prediction results, a knowledge graph update method is used to adjust the node weights of the propagation chain features and determine the final risk identification result.

[0049] To address the aforementioned technical problems, this invention also provides a knowledge graph-based safety production risk identification system, comprising:

[0050] The data acquisition module is used to extract entity nodes and relation edge data from the knowledge graph and generate multi-dimensional feature vectors.

[0051] The graph neural network processing module is used to perform convolution operations on entity nodes and relation edges, aggregate neighborhood information, and generate embedded representations.

[0052] The risk pattern calculation module, based on the embedded representation, uses an attention mechanism to calculate the weight distribution among entity nodes and determine the risk pattern.

[0053] The risk propagation sequence generation module is used to traverse the associated paths in the knowledge graph according to the risk pattern and generate a risk propagation sequence.

[0054] The dynamic path update module is used to integrate the temporal changes of multi-dimensional feature vectors, update the entity state, and determine the dynamic propagation path.

[0055] The key subgraph extraction module is used to extract key node subgraphs from the dynamic propagation path, adjust the path edge weights to highlight the interactive influence between equipment status and personnel behavior, and generate a refined risk model.

[0056] The risk identification module is used to perform iterative queries based on refined risk patterns, integrate additional features of environmental factors, determine the complete propagation chain, and output the final risk identification result.

[0057] The technical method of the present invention has the following advantages compared with the prior art:

[0058] This invention discloses a safety production risk identification method based on knowledge graphs. It addresses the problem of difficulty in capturing hidden risk patterns under the interaction of equipment status, personnel behavior and environmental factors in business scenarios. By integrating multi-dimensional feature vector extraction, graph neural network convolution and attention mechanisms, it solves the problem of dynamic tracking and accurate identification of risk propagation paths.

[0059] This invention first extracts multi-dimensional feature vectors from a knowledge graph, then uses a graph neural network to aggregate neighborhood information and generate a deep relational embedding representation. It calculates the weights between entities using an attention mechanism to highlight risk-related connections. If abnormal weights are detected, it uses breadth-first search to trace the propagation path, recursively updates entity states based on temporal changes, and refines key node subgraphs. Finally, it iteratively queries and integrates environmental factors to construct a complete propagation chain. This invention achieves high-precision risk identification by dynamically capturing the interaction risk patterns of equipment and personnel behavior, significantly improving operational safety and management efficiency in complex industrial scenarios. Attached Figure Description

[0060] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings, wherein:

[0061] Figure 1 This is a flowchart of the steps of the knowledge graph-based safety production risk identification method of the present invention;

[0062] Figure 2 This is a flowchart of the steps for extracting multi-dimensional feature vectors in this invention;

[0063] Figure 3 This is a flowchart of the steps for generating embedded representations according to the present invention;

[0064] Figure 4 This is a flowchart of the steps for determining risk patterns in this invention;

[0065] Figure 5 This is a flowchart of the steps in this invention to generate a risk propagation sequence;

[0066] Figure 6 This is a flowchart of the steps for determining the dynamic propagation path in this invention;

[0067] Figure 7 This is a flowchart of the steps involved in generating a refining risk model according to the present invention;

[0068] Figure 8 This is a flowchart illustrating the steps involved in obtaining the final risk identification result according to the present invention.

[0069] Figure 9 This is a structural framework diagram of the knowledge graph-based safety production risk identification system of the present invention. Detailed Implementation

[0070] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0071] Reference Figure 1As shown, this invention discloses a method for identifying safety production risks based on knowledge graphs, comprising the following steps:

[0072] Obtain entity nodes and relation edge data from the knowledge graph and extract multi-dimensional feature vectors. This step is the foundation of risk identification because safe production involves multi-dimensional data such as equipment status, personnel operation, and environmental parameters. Traditional methods often process various types of data separately, resulting in the loss of related information. In this embodiment, by uniformly extracting the feature vectors of entities and relations, subsequent analysis can retain the complex correlations in the original data. For example, the time-series data of temperature sensors and the event data of maintenance records can be uniformly represented, laying the data foundation for building a complete risk propagation model.

[0073] A graph neural network is used to perform convolution operations on entity nodes and relation edges to aggregate neighborhood information and generate embedded representations. Traditional risk identification methods only consider the attributes of the nodes themselves and ignore their contextual relationships in the knowledge graph. This embodiment can capture the potential association between equipment failure and adjacent nodes through neighborhood convolution of the graph neural network and form an embedded representation containing topological structure. This aggregation mechanism enables the model to identify local risk features that traditional statistical analysis cannot discover.

[0074] By embedding representation and using an attention mechanism to calculate the weight distribution between entity nodes, risk patterns are determined. Static knowledge graph analysis often treats all connections equally, while actual risk propagation is directional and selective. This embodiment uses an attention mechanism to dynamically allocate weights between nodes, which can identify truly high-risk relationship paths rather than irrelevant ordinary inspection records. This adaptive weight allocation enables the system to focus on the most threatening risk transmission links, reducing false alarms and false negatives.

[0075] Based on the risk patterns, the associated paths in the knowledge graph are traversed to generate risk propagation sequences. Simply identifying local risk patterns is insufficient to predict systemic accidents; the complete propagation chain must be reconstructed. This embodiment, through graph traversal, can connect dispersed risk signals, such as integrating isolated events like "sensor drift → control parameter distortion → automatic adjustment failure → delay in manual intervention" into an ordered sequence. This global perspective enables safety personnel to predict how risks can evolve from local failures into global accidents, rather than simply passively responding to alarms that have already occurred.

[0076] Based on the risk propagation sequence, the entity state is updated by integrating the temporal changes of multi-dimensional feature vectors, and the dynamic propagation path is determined. Risk transmission is time-dependent, and traditional static graph analysis cannot capture this dynamic characteristic. This embodiment can identify key state change nodes by integrating temporal features. This dynamic update mechanism enables the model to adapt to the real-time changing production environment and identify gradual risks such as "slow corrosion → sudden cracking" that are difficult to capture by traditional methods.

[0077] By extracting key node subgraphs from the dynamic propagation path and adjusting the edge weights of the paths, the system highlights the interactive influence between equipment status and personnel behavior, generating a refined risk model. Accident investigations show that most major accidents originate from the failure of the "equipment-personnel" interaction. This embodiment, by constructing key subgraphs and adjusting weights, can quantify this cross-dimensional influence, extracting local networks strongly correlated with the current risk from a vast knowledge graph, and dynamically adjusting the connection strength between these elements through algorithms. For example, in the path "night shift fatigue → inspection negligence → cable wear deterioration," the system strengthens the edge weights between "fatigue" and "negligence" while weakening the influence of irrelevant factors. This refinement process removes noise interference from the graph, making the risk model present a clearer causal relationship and supporting precise intervention decisions.

[0078] Based on the refined risk model representation, the knowledge graph is iteratively queried, integrating additional features of environmental factors to determine the complete propagation chain and obtain the final risk identification result. A single analysis cycle may miss long-term environmental factors (such as seasonal humidity accelerating corrosion). This embodiment supplements environmental data through iterative queries, enabling the system to improve the risk chain. For example, it incorporates "rainy season → cable insulation degradation → short circuit sparks" into the existing analysis framework. This closed-loop optimization mechanism ensures the completeness of risk identification, ultimately outputting not isolated alarms, but a systemic risk assessment that includes root causes, propagation paths, and evolution trends, providing a complete decision-making basis for proactive prevention and control.

[0079] Reference Figure 2As shown, this embodiment constructs a complete feature engineering processing flow for the step of "acquiring entity nodes and relation edge data in the knowledge graph and extracting multi-dimensional feature vectors" proposed in the above embodiments. In the specific implementation process, firstly, multi-source data is collected through a preset knowledge graph database interface. Time-series monitoring data such as temperature readings are obtained from equipment status entity nodes, behavioral records such as operation logs are extracted from personnel behavior nodes, and operating condition parameters such as humidity indicators are read from environmental factor nodes. This structured data acquisition method ensures the integrity and standardization of feature sources. After obtaining the initial feature set, the k-nearest neighbor algorithm is used for cluster analysis. This step is based on the principle of the synergistic effect of equipment temperature, environmental humidity, and personnel operation behavior in risk formation. Through distance measurement in the multi-dimensional feature space, data with similar risk characteristics are automatically classified. This unsupervised learning method can discover potential risk patterns without relying on historical label data. When abnormal groupings that significantly deviate from the main group appear in the clustering results, an anomaly detection algorithm based on statistical distribution is activated. Outliers are identified and isolated by calculating indicators such as Mahalanobis distance. This mechanism effectively eliminates the interference of sensor fault data or human recording errors on subsequent analysis. After data cleaning, contextual relationships between entities are extracted from the knowledge graph to generate a set of association rules including support and confidence. This step leverages the semantic association advantages unique to knowledge graphs, such as discovering risk-alert combinations like "high-temperature environment + new employee operation." Subsequently, a decision tree algorithm is used to classify and predict the cleaned features. Its advantage lies in automatically identifying the importance ranking of different feature dimensions; for example, it might discover that abrupt changes in temperature readings within a specific humidity range are more risk-indicating than absolute temperature values. When the prediction results exceed a preset safety threshold, the corresponding entity node's attribute status is updated in real time. This dynamic update mechanism overcomes the limitations of traditional static knowledge graphs, capturing the evolution trend of risk factors. Finally, iterative clustering verification ensures the consistency of the feature set. This closed-loop processing maintains the stability of feature engineering while retaining flexibility to handle unexpected situations.

[0080] From a technical perspective, this method enhances the reliability of risk identification through four key innovations: First, the comprehensive collection of multi-source features constructs a panoramic risk observation dimension; second, cluster-based anomaly detection ensures the quality of input data; third, association rule mining reveals potential connections between cross-domain features; and finally, a dynamic update mechanism keeps the knowledge graph up-to-date. The entire method, through a progressive processing of "data collection-cleaning-association-prediction-updating," transforms raw industrial data into feature representations with clear risk indications, providing a high-quality input foundation for subsequent graph neural network analysis. This allows subsequent risk propagation analysis to be built upon more accurate and reliable feature representations.

[0081] Reference Figure 3 As shown, regarding the step of "generating embedding representations using graph neural networks" proposed in the above embodiments, this embodiment constructs a closed-loop processing flow of "generation-verification-optimization". First, when obtaining the original graph data through a preset interface, the graph neural network performs not only simple neighborhood aggregation, but also establishes a basic feature space through the generation of initial embedding vectors. At this point, the introduction of the attention mechanism plays a crucial role—it can identify key entities and amplify their local features through weighted embedding vectors, avoiding the dilution of the overall representation by ordinary node features. When the weighted vectors are insufficiently similar to the preset template (such as the standard topological pattern of device health status), the data is not directly discarded, but anomaly detection is achieved through cluster analysis. This grouping mechanism can distinguish between genuine device fault features and temporary noise interference, such as classifying short-term temperature fluctuations and continuous overheating into different clusters. After obtaining the set of normal embedding vectors, their implicit association rules are further mined. These rules are transformed into classification boundaries through the random forest algorithm, enabling state prediction to not only output discrete labels but also quantify the degree of risk. When the prediction result is abnormal, it is not simply an alarm, but a real-time update mechanism of the knowledge graph is triggered. This dynamic feedback ensures that the regenerated embedding vectors reflect the latest state of the system. The final optimized vector set is validated for consistency through a second convolution to ensure that new information does not disrupt the original topology.

[0082] The technical benefits of this closed-loop processing are reflected in three aspects: First, the weighted embedding mechanism allows the model to focus on truly high-risk nodes, avoiding the waste of resources caused by uniform computation across the entire graph; second, the combination of anomaly detection and classification algorithms can identify gradual failure modes (such as slow equipment aging) that are difficult to capture by traditional methods; and finally, the dynamic update mechanism enables the system to have continuous evolution capabilities, so that when the factory adds new sensors or revises operating procedures, the embedded representation can automatically adapt to the new data distribution.

[0083] Reference Figure 4As shown, regarding the step of "determining risk patterns through attention mechanisms" proposed in the above embodiments, this embodiment constructs a progressive processing flow of "strength analysis - pattern mining - visualization presentation". First, the node relationships extracted from the embedded representation are not simply calculated by pairwise connection weights, but rather the overall impact of upstream and downstream nodes is comprehensively analyzed through an attention mechanism. For example, in a power system, not only is the direct connection strength of "transformer-circuit breaker" calculated, but the composite weight of the path "transformer-relay protection-circuit breaker" is also evaluated. When certain connection strengths exceed a preset threshold, they are not mechanically marked as high-risk, but are included in a risk pattern set for deeper analysis. For example, the multi-node association of "excessive oil temperature - cooling system failure - sudden load increase" in a substation is identified as a high-risk combination. For these initially identified risk pattern sets, clustering algorithms are further used to mine potential patterns. The innovation of this step lies in its ability to discover fault modes that appear unrelated but actually have an inherent connection. For example, in power grid analysis, it may be found that two seemingly independent events, "lightning tripping" and "insulator flashover," are actually related to the hidden pattern of "humid weather + equipment aging". By calculating the correlation strength between patterns, a network structure of risk patterns can be constructed, rather than an isolated list of patterns. This in-depth analysis allows the final visualization to not only show the surface risks but also reveal the underlying mechanisms of risk transmission. For example, by overlaying a heatmap with a network diagram, it can be intuitively shown which areas of the power grid have highly correlated risk patterns and which are independent local faults.

[0084] The technological benefits of this design are mainly reflected in three aspects: First, multi-level pattern analysis can identify systemic risks that are difficult to detect using traditional methods, such as cascading failure patterns across regions in power systems. Second, clustering and correlation strength calculation enable the system to automatically categorize risks, reducing reliance on manual experience rules. Finally, innovative visualization methods allow maintenance personnel to quickly understand complex risk networks; for example, color coding and line thickness can be used to intuitively judge the similarity and correlation of risk patterns in different substations. Especially in power grid systems with numerous and complex interconnections, the technical method provided in this embodiment can effectively solve the industry pain point of "difficulty in correlation analysis of massive alarms." Through systematic pattern mining and intuitive visualization, it integrates scattered risk signals into an operable risk cognition framework, providing decision support for preventing major accidents such as large-scale power outages.

[0085] Reference Figure 5As shown, for the "generating risk propagation sequence" step proposed in the above embodiments, this embodiment constructs a progressive analysis framework of "path search - intensity analysis - area location - anomaly detection". Firstly, when extracting the connection paths of related entities from the knowledge graph using breadth-first search, it not only obtains the connectivity of the topological structure, but more importantly, it performs weighted calculations based on the dynamic attribute values ​​of each entity. For example, in a power system, when analyzing the risk of "transformer overheating", it not only finds directly connected equipment such as circuit breakers and busbars, but also calculates the probability intensity of risk propagation along different paths based on attribute values ​​such as real-time load rate and insulation status, forming a risk transmission matrix. This quantitative analysis can effectively distinguish the actual risk transmission differences between the "transformer-circuit breaker-feeder" path and the "transformer-cooling system-control cabinet" path, avoiding the defect of treating all paths equally in traditional methods.

[0086] Once high-intensity transmission paths are identified, the main propagation direction is extracted using matrix factorization algorithms. The innovation of this step lies in its ability to focus on the most critical risk transmission chains from a large number of possible paths. For example, in power grid analysis, the subsequence "generator excitation fault → voltage fluctuation → protection maloperation → large-scale power outage" might be found to be the core propagation path that truly needs attention, rather than other secondary impact paths. Subsequently, when using cluster analysis to identify risk-concentrated areas, not only the number of entities is considered, but also their topological characteristics and attribute similarity are analyzed. For instance, multiple overloaded devices within the same substation are automatically grouped into a high-risk cluster, rather than simply grouped by physical distance. This intelligent grouping makes risk area location more accurate. Especially after mapping entity clusters to a low-dimensional space using graph embedding algorithms, semantic relationships that were previously difficult to perceive in high-dimensional knowledge graphs become clearly discernible. For example, it might be found that "improper relay protection settings" and "frequent maloperation" are highly correlated in the semantic space.

[0087] Ultimately, when identifying potential anomalous entities through anomaly detection algorithms, edge risk points that are easily overlooked in traditional methods can be discovered. For example, in a power grid, a circuit breaker located far from the fault point and with a low load rate may exhibit anomalous characteristics in its semantic relationship vector due to its special protection settings, and could be identified as a potential risk amplifier. This deep analysis enables the final risk propagation sequence to not only include explicit main propagation paths but also capture implicit risk amplification factors, providing a more comprehensive risk warning for the safe operation of the power system.

[0088] The technical advantages of this method are mainly reflected in the following aspects: First, the weighted risk transmission matrix enables the system to quantitatively assess the actual threat level of different paths; second, the combined use of matrix decomposition and cluster analysis can intelligently extract the key risk propagation framework from complex power grid topologies; and finally, graph embedding-based anomaly detection can discover hidden risk nodes that are difficult to identify using traditional monitoring methods. These innovations allow power system operators to not only see how risks propagate but also understand why certain paths are more likely to become risk transmission channels, providing a scientific basis for formulating precise prevention and control strategies.

[0089] Reference Figure 6 As shown, regarding the "determining the dynamic propagation path" step proposed in the above embodiments, this embodiment constructs a closed-loop optimization system of "dynamic perception - real-time adjustment - trend prediction". Firstly, when extracting entity data from the risk propagation sequence, special emphasis is placed on the fusion processing of multi-dimensional temporal features. For example, in the power system scenario, not only are conventional monitoring data such as transformer oil temperature and load rate collected, but also temporal features such as meteorological environmental changes and maintenance record updates are integrated. These dynamically changing feature vectors are mapped to the network topology in real time using a graph neural network. This processing method allows the originally static device connection relationships to dynamically adjust their weights according to the operating status. For example, when the pollution level of the insulators of a certain transmission line is detected to be continuously increasing, the connection strength of that line in the risk propagation network will be automatically strengthened, whereas traditional methods often can only maintain fixed topological relationships.

[0090] By employing a recursive update mechanism to calculate entity state changes, true dynamic risk assessment is achieved. Taking substation circuit breakers as an example, it not only determines whether the current number of interruptions exceeds the limit but also predicts the remaining lifespan based on historical operating data. When the predicted state exceeds a threshold, the propagation path weights are immediately adjusted. This mechanism can capture the gradual changes in power equipment performance; for example, the aging of capacitor banks may upgrade a previously minor "harmonic amplification-protection maloperation" path to a major risk channel. In analyzing the propagation path prediction results, a state update rule base is innovatively introduced, integrating structured knowledge such as industry standards and operational experience into the optimization process. For instance, when the predicted risk probability of the "typhoon weather → conductor galloping → phase-to-phase short circuit" path continues to rise, the monitoring level of the relevant lines will be automatically increased in accordance with the "Guidelines for the Safety and Stability of Power Systems," and the protection settings of surrounding equipment will be adjusted accordingly.

[0091] When determining the dynamic propagation path through time-series data fusion, this technology exhibits unique adaptive capabilities. In actual power grid operation, this technology can identify risk transmission patterns that traditional static analysis cannot detect, such as how load center shifts change the direction of fault propagation, or how the intermittent output of renewable energy power plants affects the distribution of system vulnerabilities.

[0092] The technical advantages of this method are mainly reflected in three aspects: First, the fusion of temporal features enables risk path assessment to keep pace with changes in system operating status, solving the problem of "outdated" assessment results from traditional methods; second, the recursive update mechanism endows the system with the ability to identify gradual risks early, providing early warnings of potential propagation paths before equipment completes failure; and finally, integrating industry rules into the optimization process ensures that the technical solution possesses both data-driven foresight and conforms to the actual constraints of power safety production. This dynamic risk assessment mechanism is particularly suitable for the complex environment of modern power systems with high uncertainty, providing dispatchers with a real-time updated risk situation map, rather than a static risk snapshot, thereby significantly improving the ability to prevent cascading failures.

[0093] Reference Figure 7 As shown, regarding the "generating a refined risk model" step proposed in the above embodiments, this embodiment constructs a quantitative analysis framework for cross-dimensional risk interaction between "equipment and personnel". Firstly, when extracting key node subgraphs from the dynamic propagation path, the graph segmentation algorithm not only considers topological connection strength but also innovatively introduces cross-dimensional correlation analysis. For example, in power system operation and maintenance scenarios, abnormal transformer oil temperature nodes and related operator inspection record nodes are included in the same subgraph for analysis. When adjusting path edge weights through an attention mechanism, it can automatically identify which personnel behaviors have a substantial impact on equipment status. For instance, in substation operations, it may be found that the behavior of "skipping the infrared temperature measurement step" is strongly correlated with the "bushing joint overheating" fault, while the impact of regular inspection frequency adjustments is weaker. This fine-grained weight allocation makes risk analysis more accurate.

[0094] Principal component analysis (PCA) was used to extract key interaction patterns, enabling the extraction of core risk patterns from massive amounts of monitoring data. Taking relay protection devices as an example, it might be found that the correlation between "improper modification of protection settings" and "misoperation of protection" is not a simple linear relationship, but rather exhibits specific combinations of conditions, with the impact being particularly significant when the system load exceeds 85%. When the intensity of the interaction exceeds a threshold, clustering algorithms can intelligently group these complex relationships, identifying typical risk patterns in different scenarios such as "nighttime operation," "new employee operation," and "shift handover periods." This analytical depth far surpasses the simple causal relationship statistics of traditional methods, revealing the intrinsic mechanisms by which human behavior affects equipment status. For example, it might be found that operators are more likely to overlook certain inspection steps in high-temperature environments, and this behavioral pattern can lead to an increased missed detection rate for specific types of equipment defects.

[0095] When generating refined risk models, a risk assessment index was creatively constructed that integrates abnormal equipment signals and behavioral triggering conditions. In power dispatching scenarios, this index may manifest as a weighted combination of "dispatch command response delay time" and "fluctuation amplitude of renewable energy output," rather than assessing either aspect alone. This cross-dimensional integration makes the final output risk model more interpretable and operable. For example, it can clearly indicate that "when wind speed changes exceed 30% and the operator's experience is less than 3 years, the overload risk of wind farm collector lines increases significantly."

[0096] The technical advantages of this method are mainly reflected in the following aspects: First, the combined use of graph segmentation and attention mechanisms enables the system to accurately locate key interaction nodes in complex production networks; second, the combined application of principal component analysis and clustering algorithms can extract meaningful "equipment-personnel" interaction paradigms; and finally, the risk assessment indicators generated by weighted fusion provide a quantitative basis for formulating targeted prevention and control measures. This technology is particularly suitable for the complex environment of modern power systems, which highly rely on human-machine collaboration. It helps safety managers not only see abnormal equipment phenomena but also understand the human factors behind the anomalies, thereby achieving a shift from passive response to proactive prevention and effectively reducing systemic risks caused by human factors.

[0097] Reference Figure 7 As shown, regarding the step of "judging the final risk identification result" proposed in the above embodiments, this embodiment presents a three-dimensional risk identification system of "environmental factor fusion - dynamic prediction - knowledge evolution". Firstly, when extracting propagation chain features from refined risk patterns, it innovatively introduces deep integration of environmental factor data. In the power system scenario, this includes not only conventional meteorological data such as temperature and humidity, but also spatial environmental information such as construction activities and vegetation growth around the power grid. When analyzing the propagation relationship between nodes through graph convolutional networks, it can dynamically assess the modulating effect of environmental factors on the risk transmission path. For example, it discovers the implicit correlation between "conductor galloping risk during typhoon season" and "routine tree obstacle clearing cycle," a correlation often overlooked in traditional static analysis. When the vegetation growth rate in a certain area exceeds a threshold, the connection weight between the equipment nodes and tree obstacle risk features in that area is automatically enhanced, achieving proactive perception of environmental risks.

[0098] When extracting the interaction features between equipment status and personnel behavior, principal component analysis is used to remove redundant information and focus on core risk drivers. Taking substation inspection as an example, it may be found that the environmental condition of "insufficient nighttime lighting" amplifies the impact of the behavior of "simplifying the inspection process" on the equipment defect detection rate, and this interaction pattern is difficult to show in conventional data analysis. When the correlation strength of the interaction features exceeds a threshold, the K-means clustering algorithm can intelligently identify typical risk combinations under different environmental scenarios, such as distinguishing the deviation patterns of personnel behavior and their corresponding equipment vulnerabilities under different meteorological conditions such as "high temperature and dryness," "humid and rainy," and "low temperature and freezing." This ability to perceive environmental context enables risk analysis to move from two-dimensional to three-dimensional. For example, in power grid dispatching, it can identify the transformer overload risk characteristics caused by the combination of "summer high temperature period" and "surge in air conditioning load."

[0099] When generating comprehensive risk indicators, a three-dimensional fusion of equipment status, personnel behavior, and environmental factors is creatively achieved. This process is not a simple data aggregation, but rather a dynamic adjustment of the contribution of each dimension through weighted summation. For example, when assessing the lightning strike risk of transmission lines, it considers not only the line's own lightning protection configuration (equipment status) and inspection and maintenance quality (personnel behavior), but also integrates thunderstorm activity prediction (environmental factors), ultimately outputting a risk indicator with spatiotemporal characteristics. Time series analysis based on this indicator can predict the evolution trend of risk propagation paths, such as predicting the development speed and impact range of the chain reaction of "persistent drought → vegetation drying → wildfire risk → line tripping". Finally, the node weight adjustment achieved through the knowledge graph update mechanism has continuous evolution capabilities, and can quickly adjust the risk identification model when new environmental risk factors (such as new pollutants causing abnormal pollution accumulation on insulators) appear.

[0100] The technical advantages of this method are mainly reflected in the following aspects: First, the deep integration of environmental factors makes the risk identification results more targeted in time and space; second, the dynamic prediction capability enables the system to shift from passive response to active defense; and finally, the self-updating mechanism of the knowledge graph ensures the continuous adaptability of the technical solution. This three-dimensional fusion risk identification framework is particularly suitable for the complex operating environment faced by modern power systems, helping operation and maintenance personnel to grasp the evolution of risks from a more comprehensive perspective, providing a scientific basis for formulating precise prevention and control strategies, and effectively improving the early warning capability for complex risks.

[0101] Reference Figure 9 As shown, in order to implement the above method, the present invention also provides a safety production risk identification system based on knowledge graphs, including:

[0102] The data acquisition module is used to extract entity nodes and relation edge data from the knowledge graph and generate multi-dimensional feature vectors.

[0103] The graph neural network processing module is used to perform convolution operations on entity nodes and relation edges, aggregate neighborhood information, and generate embedded representations.

[0104] The risk pattern calculation module, based on the embedded representation, uses an attention mechanism to calculate the weight distribution among entity nodes and determine the risk pattern.

[0105] The risk propagation sequence generation module is used to traverse the associated paths in the knowledge graph according to the risk pattern and generate a risk propagation sequence.

[0106] The dynamic path update module is used to integrate the temporal changes of multi-dimensional feature vectors, update the entity state, and determine the dynamic propagation path.

[0107] The key subgraph extraction module is used to extract key node subgraphs from the dynamic propagation path, adjust the path edge weights to highlight the interactive influence between equipment status and personnel behavior, and generate a refined risk model.

[0108] The risk identification module is used to perform iterative queries based on refined risk patterns, integrate additional features of environmental factors, determine the complete propagation chain, and output the final risk identification result.

[0109] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A safety production risk identification method based on a knowledge graph, characterized in that, The method comprises the following steps: Obtain entity nodes and relationship edge data in a knowledge graph, and extract multi-dimensional feature vectors; Perform convolution operation on the entity nodes and relationship edges by using a graph neural network, aggregate neighborhood information, and generate embedding representation; Determine the risk mode by calculating the weight distribution between the entity nodes by using an attention mechanism based on the embedding representation; According to the risk mode, traverse the associated path in the knowledge graph to generate a risk propagation sequence; According to the risk propagation sequence, update the entity state by fusing the time sequence changes of the multi-dimensional feature vectors, and determine the dynamic propagation path; Extract a key node subgraph from the dynamic propagation path, adjust the path edge weight, highlight the interaction between the device state and the personnel behavior, and generate a refined risk mode; including: extracting a key node subgraph from the dynamic propagation path, determining the node connection strength by using a graph segmentation algorithm to obtain the key node subgraph, calculating the interaction influence relationship between the nodes by using an attention mechanism for the key node subgraph, adjusting the path edge weight, and generating a weighted path subgraph; obtaining the interaction features of the device state data and the personnel behavior data from the weighted path subgraph, extracting the main interaction mode by using principal component analysis, determining the interaction influence relationship, and if the strength of the interaction influence relationship exceeds a preset threshold, grouping the interaction features by using a clustering algorithm to obtain the associated mode of the behavior trigger condition and the device abnormal signal; according to the associated mode, extracting the corresponding relationship between the device abnormal signal and the behavior trigger condition, generating a risk assessment index, and fusing the device abnormal signal and the behavior trigger condition by using a weighted summation method to generate a refined risk mode; According to the refined risk mode representation, iteratively query the knowledge graph, integrate the additional features of environmental factors, judge the complete propagation chain, and obtain the final risk identification result.

2. The safety production risk identification method based on the knowledge graph according to claim 1, characterized in that: Extracting multi-dimensional feature vectors comprises: Querying from a preset knowledge graph database interface to obtain initial multi-dimensional feature vectors from entity nodes of device states, personnel behaviors and environmental factors, including temperature readings recording device states, operation logs recording personnel behaviors and humidity indicators recording environmental factors, which constitute a feature set; Perform clustering analysis on the feature set by using a k-neighbor algorithm, group according to the similarity of temperature readings, humidity indicators and operation logs, and obtain feature clustering results; If there is an abnormal grouping in the feature clustering results, isolate the abnormal feature vectors by using an anomaly detection algorithm, judge the anomaly based on a preset threshold, and obtain a normal feature set; According to the normal feature set, extract context relationships from the knowledge graph to generate a set of association rules, and classify and predict the temperature readings, humidity indicators and operation logs by using a decision tree algorithm based on the set of association rules to obtain a device state prediction result; If the device state prediction result deviates from the normal range, update the entity node attributes in the knowledge graph by using the database interface to obtain updated feature vectors, and re-perform clustering analysis based on the updated feature vectors to verify consistency and obtain an optimized feature set.

3. The safety production risk identification method based on the knowledge graph according to claim 1, characterized in that: Perform convolution operation on the entity nodes and relationship edges by using a graph neural network, aggregate neighborhood information, and generate embedding representation, comprising: The preset knowledge graph database interface is used to obtain entity nodes and relationship edge data, a graph neural network is used to perform convolution operation, neighborhood information is aggregated, and an initial embedding vector is generated; According to the initial embedding vector, a weighting mechanism is used to assign weights, highlight the local features of key entity nodes and relationship edges, and generate a weighted embedding vector; If the similarity of the weighted embedding vector to the preset topological structure template is lower than a preset threshold, the embedding vectors are grouped through clustering analysis, abnormal embedding vectors are determined, and a set of normal embedding vectors is obtained; According to the set of normal embedding vectors, context information is extracted from the knowledge graph, a set of association rules is generated, and the normal embedding vectors are classified by using a random forest algorithm through the set of association rules to determine the state prediction result of the entity nodes; If the state prediction result deviates from the preset normal range, the entity node attributes in the knowledge graph are updated through the database interface, an updated embedding vector is generated, the graph neural network convolution operation is re-executed according to the updated embedding vector, consistency is verified, and an optimized embedding vector set is obtained.

4. The safety production risk identification method based on the knowledge graph according to claim 1, characterized in that: The weight distribution between entity nodes is calculated through the attention mechanism to determine the risk pattern, including: The node relationship is extracted from the embedding representation, the weight distribution between entity nodes is calculated through the attention mechanism, the connection strength is obtained, and the risk pattern is analyzed according to the connection strength; If the connection strength exceeds a preset threshold, it is determined as a high-risk association, and a set of risk patterns is obtained; For the set of risk patterns, a clustering algorithm is used to mine potential patterns, a pattern classification result is obtained, features are extracted from the pattern classification result, data association is analyzed, potential hidden patterns are obtained, the association strength between patterns is calculated through the potential hidden patterns, a final pattern distribution is obtained, a visual representation of the risk pattern is generated according to the final pattern distribution, and an analysis result is obtained.

5. The knowledge graph-based safety production risk identification method according to claim 1, characterized in that: According to the risk pattern, the associated paths in the knowledge graph are traversed to generate a risk propagation sequence, including: Associated entities are extracted from the knowledge graph, a breadth-first search is used to traverse the connection paths between entities to obtain a preliminary risk propagation sequence, and the preliminary risk propagation sequence is obtained; The attribute values of each entity in the path are obtained, the risk transmission strength between entities is determined through weighted calculation, a risk transmission matrix is generated, and if there is a high-intensity transmission path in the risk transmission matrix, the main risk propagation direction is extracted through matrix decomposition algorithm to obtain a key propagation subsequence; According to the key propagation subsequence, clustering analysis is used to group entities to obtain a risk aggregation entity cluster and determine a risk concentration area, and if the number of entities in the risk concentration area exceeds a preset threshold, the entity cluster is mapped to a low-dimensional space through a graph embedding algorithm to obtain a semantic relationship vector; According to the semantic relationship vector, an anomaly detection algorithm is used to identify potential abnormal entities to obtain an abnormal entity set, and the associated paths in the knowledge graph are traversed through the abnormal entity set to generate a final risk propagation sequence.

6. The knowledge graph-based safety production risk identification method according to claim 1, characterized in that: According to the risk propagation sequence, the time sequence changes of the multi-dimensional feature vectors are fused to update the entity state and determine the dynamic propagation path, including: The entity data in the risk propagation sequence is acquired, a feature vector is extracted from multi-dimensional time sequence data to obtain an entity feature vector set, a network topology structure is constructed through a graph neural network, and the topology connection is updated according to the entity feature vector set to obtain the network topology structure; An iterative calculation of the entity state change is performed based on the network topology structure through a recursive update mechanism to obtain an entity state sequence, and if any entity state in the entity state sequence exceeds a preset threshold, the propagation path weight is adjusted through the graph neural network to obtain the propagation path after the weight adjustment; According to the propagation path after the weight adjustment, a time sequence change trend of the propagation path prediction is analyzed to obtain a propagation path prediction result, and the dynamic propagation path is iteratively optimized through the propagation path prediction result and the state update rule to obtain an optimized dynamic propagation path; The optimized dynamic propagation path is used in combination with time sequence data fusion to determine a final dynamic propagation path.

7. The knowledge graph-based safety production risk identification method according to claim 1, characterized in that: According to the refined risk mode representation, the knowledge graph is iteratively queried, the additional features of the environmental factors are integrated, the complete propagation chain is judged, and a final risk identification result is obtained, including: The propagation chain features are acquired from the refined risk mode, the node attributes related to the environmental factor data are extracted by using a knowledge graph query method to obtain an environmental correlation feature set, the propagation relationship between nodes is analyzed by using a graph convolution network according to the environmental correlation feature set, the weight of the propagation chain feature is updated, and a weighted propagation feature is obtained; The associated data of the equipment state interaction and the personnel behavior interaction are extracted from the weighted propagation feature, the main interaction mode is extracted by using principal component analysis to determine an interaction feature set, if the correlation strength of the interaction feature set exceeds a preset threshold, the K-means clustering method is used to group the interaction features to obtain the association mode of the behavior trigger condition and the equipment abnormal signal; According to the association mode, the corresponding relationship between the equipment abnormal signal and the behavior trigger condition is extracted, the environmental factor data is fused by using a weighted summation method to generate a comprehensive risk index, the change trend of the risk propagation path is extracted from the comprehensive risk index, the dynamic change of the risk propagation path is predicted by using a time sequence analysis method to obtain a dynamic risk prediction result, and the node weight of the propagation chain feature is adjusted by using a knowledge graph update method according to the dynamic risk prediction result to judge the final risk identification result.

8. A safety production risk identification system based on a knowledge graph, characterized in that: It includes: A data acquisition module is used to extract entity nodes and relationship edge data from a knowledge graph and generate multi-dimensional feature vectors; A graph neural network processing module is used to perform convolution operations on the entity nodes and relationship edges, aggregate neighborhood information, and generate embedding representations; A risk mode calculation module calculates the weight distribution between entity nodes based on the embedding representations by using an attention mechanism to determine a risk mode; A risk propagation sequence generation module is used to generate a risk propagation sequence according to the risk mode by traversing the associated paths in the knowledge graph; A dynamic path update module is used to update the entity state and determine a dynamic propagation path by fusing the time sequence changes of the multi-dimensional feature vectors. The key subgraph extraction module is configured to extract a key node subgraph from the dynamic propagation path, adjust path edge weights to highlight the interaction between the device state and the personnel behavior, and generate a refined risk pattern. The key subgraph extraction module includes: extracting a key node subgraph from the dynamic propagation path, determining the connection strength of the nodes by using a graph partitioning algorithm to obtain the key node subgraph, calculating the interaction relationship between the nodes by using an attention mechanism for the key node subgraph, adjusting the path edge weights, and generating a weighted path subgraph; obtaining the interaction features of the device state data and the personnel behavior data from the weighted path subgraph, extracting the main interaction mode by using principal component analysis, determining the interaction relationship, and if the strength of the interaction relationship exceeds a preset threshold, grouping the interaction features by using a clustering algorithm to obtain the association mode of the behavior trigger condition and the device abnormal signal; according to the association mode, extracting the corresponding relationship between the device abnormal signal and the behavior trigger condition, generating a risk assessment index, and by using the risk assessment index, fusing the device abnormal signal and the behavior trigger condition by using a weighted summation method to generate a refined risk pattern; The risk identification module is configured to perform iterative queries based on the refined risk pattern, integrate additional features of environmental factors, determine a complete propagation chain, and output a final risk identification result.

Images