Behavior analysis and early warning method and system based on AI situation awareness

Abstract

The application discloses an AI situation awareness-based behavior analysis early warning method and system, and relates to the technical field of data recognition. The method comprises the following steps: collecting multi-source perception data and extracting a numerical feature vector; adopting an edge correlation degree dynamic threshold self-learning algorithm to filter effective edges, construct a dynamic space-time graph, and extract space-time correlation features; calculating a modal weight coefficient based on historical detection accuracy, data integrity, and scene adaptability, and weightedly fusing multi-modal features; inputting a deep reinforcement learning model to output a threat risk value and a security response strategy and executing; updating dynamic weights, thresholds, and strategy parameters according to early warning accuracy and threat interception success rate, and realizing closed-loop optimization. The method solves the technical problems of lack of unified feature representation of multi-source heterogeneous data, loss of cross-modal correlation, inability of dynamic updating of space-time correlation, fixed influence of multi-modal feature fusion weight on fusion effectiveness, lack of adaptability of threat evaluation, and performance decay caused by lagging model parameter updating.

Description

Technical Field

[0001] This application relates to the field of data recognition technology, and in particular to a behavior analysis and early warning method and system based on AI situational awareness. Background Technology

[0002] In existing technologies, behavioral analysis and early warning methods based on data recognition and processing still have shortcomings in multi-source information fusion, dynamic correlation analysis, and adaptive decision-making. For heterogeneous data such as video, sensor, network traffic, and behavioral logs, feature extraction is often processed independently, lacking a unified feature representation framework, and the correlation between cross-modal information is difficult to fully reflect. In spatiotemporal correlation analysis, traditional methods often rely on fixed rules to construct relationships between nodes, making it difficult to reflect dynamically changing spatiotemporal features in real time and failing to achieve dynamic filtering of effective edges. In multimodal feature fusion, weight settings are often preset fixed values, without dynamic adjustment based on real-time quality indicators of each modality (such as completeness, accuracy, and scene adaptability), affecting the reliability of the fusion results. In the threat assessment stage, existing methods often rely on manual rules or static models, lacking adaptability to complex scenarios and resource consumption, making it difficult to output accurate threat risk values ​​and response strategies. In terms of model optimization, the updates of correlation thresholds, fusion weights, and strategy parameters are lagging, failing to dynamically adjust based on feedback such as early warning accuracy and threat interception success rate, leading to long-term performance degradation.

[0003] Therefore, there is an urgent need for a behavioral analysis and early warning technology that can achieve dynamic correlation of multi-source data, real-time weight adjustment, adaptive threat assessment, and closed-loop optimization to improve the accuracy of early warning and response efficiency in complex scenarios. Summary of the Invention

[0004] The purpose of this application is to provide a behavior analysis and early warning method and system based on AI situational awareness, in order to solve the technical problems in the prior art, such as the lack of unified feature representation of multi-source heterogeneous data leading to the loss of cross-modal correlation, the inability to dynamically update spatiotemporal correlation and make it difficult to capture real-time changes, the fixed weight of multimodal feature fusion affecting the fusion effectiveness, the lack of adaptability of threat assessment and its difficulty in adapting to complex scenarios, and the long-term performance degradation caused by the lag in model parameter updates.

[0005] In view of the above technical issues, this application provides a behavior analysis and early warning method and system based on AI situational awareness.

[0006] A first aspect of this application provides a behavior analysis and early warning method based on AI situational awareness, the method comprising:

[0007] Multi-source sensing data, including video, sensor data, network traffic, and behavior logs, are acquired through acquisition devices. The corresponding target spatiotemporal features, device operation features, transmission features, and operation sequence features are extracted and converted into numerical feature vectors.

[0008] Using the feature vectors as graph nodes, the real-time spatiotemporal correlation between nodes is calculated. Based on the real-time spatiotemporal correlation, a dynamic threshold self-learning algorithm for edge correlation is used to filter effective edges, construct a dynamic spatiotemporal graph, and extract spatiotemporal correlation features based on the effective edges. The dynamic threshold self-learning algorithm for edge correlation includes obtaining a set of historical effective edges, calculating historical observation correlation based on the set of historical effective edges, constructing a loss function through the real-time spatiotemporal correlation and the historical observation correlation, iteratively updating the dynamic weight coefficients based on the gradient descent method, and generating a dynamic threshold for edge correlation based on the updated dynamic weight coefficients and the correlation distribution of the set of historical effective edges.

[0009] Based on the historical detection accuracy, current data integrity, and scene adaptability of each modality data, modality weight coefficients are calculated, and the spatiotemporal correlation features are weighted and fused to obtain multimodal comprehensive features. The modality weight coefficients are calculated by multiplying the historical detection accuracy and scene adaptability to obtain the first factor, and the arithmetic square root of the current data integrity as the second factor. After multiplying the first factor and the second factor, the results are normalized so that the sum of all modality weight coefficients is 1.

[0010] Based on the multimodal integrated features, the historical detection accuracy and real-time resource utilization of each modality data, a deep reinforcement learning (DRL) model including policy parameters is used for threat assessment, outputting a threat risk value and a corresponding security response policy. When the threat risk value reaches a preset judgment condition, the corresponding security response policy is triggered. The deep reinforcement learning (DRL) model combines the multimodal integrated features, the historical detection accuracy and real-time resource utilization of each modality data into a multidimensional state vector, calculates the threat risk value based on the multidimensional state vector and policy parameters, and controls the feature selection weights, state transition probabilities and action decision rules in the threat risk value calculation process. It is iteratively updated based on the threat interception success rate and early warning accuracy using a temporal difference algorithm, and generates a corresponding security response policy according to the threat risk value.

[0011] Based on the threat risk value, the early warning accuracy rate after the security response strategy is executed, and the threat interception success rate, the dynamic weight coefficient and the dynamic threshold of the edge correlation are updated by the edge correlation dynamic threshold self-learning algorithm, and the strategy parameters are updated by the temporal difference algorithm of the deep reinforcement learning DRL model. The updated parameter set is output, and the parameter set is used to optimize the feature extraction, fusion and threat assessment process of the next round of multi-source perception data.

[0012] A second aspect of this application provides a behavior analysis and early warning system based on AI situational awareness, the system comprising:

[0013] The multi-source data acquisition and feature extraction module is used to acquire multi-source sensing data, including video, sensor data, network traffic data, and behavior logs, through acquisition devices, extract the corresponding target spatiotemporal features, device operation features, transmission features, and operation sequence features, and convert them into numerical feature vectors.

[0014] A dynamic spatiotemporal graph construction and spatiotemporal correlation feature extraction module is used to use the feature vector as graph nodes, calculate the real-time spatiotemporal correlation degree between nodes, and use a dynamic threshold self-learning algorithm for edge correlation degree to filter effective edges based on the real-time spatiotemporal correlation degree, construct a dynamic spatiotemporal graph, and extract spatiotemporal correlation features based on the effective edges. The dynamic threshold self-learning algorithm for edge correlation degree includes obtaining a set of historical effective edges, calculating historical observation correlation degree based on the set of historical effective edges, constructing a loss function through the real-time spatiotemporal correlation degree and the historical observation correlation degree, iteratively updating dynamic weight coefficients based on gradient descent, and generating a dynamic threshold for edge correlation degree based on the updated dynamic weight coefficients and the correlation degree distribution of the set of historical effective edges.

[0015] A multimodal feature fusion module is used to calculate modal weight coefficients based on the historical detection accuracy, current data integrity, and scene adaptability of each modality data, and to weight and fuse the spatiotemporal correlation features to obtain multimodal comprehensive features. The calculation of modal weight coefficients is to multiply the historical detection accuracy and scene adaptability to obtain a first factor, and use the arithmetic square root of the current data integrity as a second factor. After multiplying the first factor and the second factor, the result is normalized so that the sum of all modal weight coefficients is 1.

[0016] The threat assessment and response strategy generation module is used to perform threat assessment based on the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate, using a deep reinforcement learning (DRL) model that includes strategy parameters. It outputs a threat risk value and a corresponding security response strategy. When the threat risk value reaches a preset judgment condition, the corresponding security response strategy is triggered. The DRL model combines the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate into a multidimensional state vector. Based on the multidimensional state vector and strategy parameters, it calculates the threat risk value. The strategy parameters control the feature selection weights, state transition probabilities, and action decision rules during the threat risk value calculation process. It iteratively updates the strategy based on the threat interception success rate and early warning accuracy using a temporal difference algorithm, generating a corresponding security response strategy according to the threat risk value.

[0017] The parameter dynamic optimization module is used to update the dynamic weight coefficients and dynamic threshold of the edge correlation degree through the edge correlation degree dynamic threshold self-learning algorithm, and update the strategy parameters through the temporal difference algorithm of the deep reinforcement learning DRL model based on the threat risk value, the early warning accuracy rate after the security response strategy is executed, and the threat interception success rate. The updated parameter set is used to optimize the feature extraction, fusion and threat assessment process of the next round of multi-source perception data.

[0018] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0019] Multi-source sensing data, including video, sensor data, network traffic, and behavior logs, is acquired through acquisition devices. Corresponding target spatiotemporal features, device operation features, transmission features, and operation sequence features are extracted and converted into numerical feature vectors. These feature vectors are used as graph nodes to calculate the real-time spatiotemporal correlation between nodes. Based on the real-time spatiotemporal correlation, a dynamic threshold self-learning algorithm for edge correlation is used to filter effective edges, constructing a dynamic spatiotemporal graph. Spatiotemporal correlation features are extracted based on the effective edges. The dynamic threshold self-learning algorithm for edge correlation includes obtaining a set of historical effective edges, calculating historical observation correlation based on the historical effective edge set, and using the real-time spatiotemporal correlation... A loss function is constructed based on the correlation with historical observations. Dynamic weight coefficients are iteratively updated using gradient descent. A dynamic threshold for edge correlation is generated based on the updated dynamic weight coefficients and the correlation distribution of the historical effective edge set. Modal weight coefficients are calculated based on the historical detection accuracy, current data integrity, and scene adaptability of each modality. The spatiotemporal correlation features are then weighted and fused to obtain multimodal comprehensive features. The modal weight coefficients are calculated by multiplying the historical detection accuracy by the scene adaptability to obtain a first factor, using the square root of the current data integrity as a second factor, and then multiplying the first and second factors. After normalization, all modal weight coefficients are calculated to ensure that all modal weights are equal. The sum of the state weight coefficients is 1. Based on the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate, a deep reinforcement learning (DRL) model containing policy parameters is used for threat assessment, outputting a threat risk value and a corresponding security response strategy. When the threat risk value reaches a preset judgment condition, the corresponding security response strategy is triggered. The deep reinforcement learning (DRL) model combines the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate into a multidimensional state vector. Based on the multidimensional state vector and policy parameters, the threat risk value is calculated. The policy parameters are used to control the calculation of the threat risk value. The process involves selecting feature selection weights, state transition probabilities, and action decision rules, and iteratively updating them using a temporal difference algorithm based on threat interception success rate and early warning accuracy. A corresponding security response strategy is generated based on the threat risk value. Based on the threat risk value, the early warning accuracy after the security response strategy is executed, and the threat interception success rate, the dynamic weight coefficients and dynamic threshold of the edge correlation degree are updated using a self-learning algorithm. The strategy parameters are updated using a temporal difference algorithm based on a deep reinforcement learning (DRL) model, outputting an updated parameter set. This parameter set is used to optimize the feature extraction, fusion, and threat assessment process of the next round of multi-source sensing data. This addresses the technical problems in existing technologies, such as the lack of unified feature representation for multi-source heterogeneous data leading to loss of cross-modal correlation, the inability to dynamically update spatiotemporal correlations to capture real-time changes, fixed multi-modal feature fusion weights affecting fusion effectiveness, lack of adaptability in threat assessment making it difficult to adapt to complex scenarios, and long-term performance degradation due to lagging model parameter updates.

[0020] The above description is merely an overview of the technical solution of this application. In order to more clearly explain the technical means of this application, and to enable its implementation in accordance with the contents of the specification, and to make the above and other objectives, features and advantages of this application more apparent and understandable, specific embodiments of this application are described below. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments of this disclosure will be briefly described below. Flowcharts are used in this application to illustrate the operations performed by the system according to the embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed precisely in sequence. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from these processes.

[0022] Figure 1 A flowchart illustrating the behavior analysis and early warning method based on AI situational awareness provided in this application embodiment;

[0023] Figure 2 This is a schematic diagram of the structure of an AI-based situational awareness-based behavior analysis and early warning system provided in an embodiment of this application.

[0024] Figure labeling: Module 1 for multi-source data acquisition and feature extraction, Module 2 for dynamic spatiotemporal graph construction and spatiotemporal correlation feature extraction, Module 3 for multimodal feature fusion, Module 4 for threat assessment and response strategy generation, and Module 5 for dynamic parameter optimization. Detailed Implementation

[0025] This application provides a behavior analysis and early warning method and system based on AI situational awareness, which solves the technical problems in the prior art, such as the lack of unified feature representation of multi-source heterogeneous data leading to the loss of cross-modal correlation, the inability to dynamically update spatiotemporal correlation and make it difficult to capture real-time changes, the fixed weights of multimodal feature fusion affecting the effectiveness of fusion, the lack of adaptability of threat assessment and its difficulty in adapting to complex scenarios, and the long-term performance degradation caused by the lag in model parameter updates.

[0026] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0027] It should be noted that the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such processes, methods, products, or devices.

[0028] Example 1, as Figure 1 As shown, this application provides a behavior analysis and early warning method based on AI situational awareness, wherein the method includes:

[0029] By acquiring multi-source sensing data, including video, sensor data, network traffic, and behavior logs, through acquisition devices, the corresponding target spatiotemporal features, device operation features, transmission features, and operation sequence features are extracted and converted into numerical feature vectors.

[0030] Specifically, the system acquires multi-source sensing data, including video data, equipment operation sensor data, network transmission traffic data, and user operation behavior logs, through acquisition devices such as cameras, temperature and humidity sensors, network traffic analyzers, and operation auditing tools. For video data, a deep learning-based target detection and tracking algorithm is used to extract spatiotemporal features of the target, such as position coordinates, movement speed, and duration of appearance. For sensor data, signal analysis is used to extract equipment operation features such as operating temperature, vibration frequency, and energy consumption. For network traffic data, protocol analysis is used to extract transmission features such as source IP, destination IP, transmission rate, and data packet size distribution of data packets. For behavior logs, instruction analysis is used to extract operation sequence features such as user operation type, execution time, and operation object. All of the above features are then converted into numerical feature vectors through Min-Max normalization (mapping feature values ​​to the [0,1] interval) and one-hot encoding (for categorical features).

[0031] The feature vectors are used as graph nodes. The real-time spatiotemporal correlation between nodes is calculated. Based on the real-time spatiotemporal correlation, a dynamic threshold self-learning algorithm for edge correlation is used to filter effective edges, construct a dynamic spatiotemporal graph, and extract spatiotemporal correlation features based on the effective edges.

[0032] Furthermore, the construction of the dynamic spatiotemporal graph includes:

[0033] The feature vectors of multi-source sensing data within the same observation time or a preset time window are used as graph nodes. The spatial coordinate difference of the nodes is used as the spatial distance, the timestamp difference is used as the time interval, and the cosine similarity of the feature vectors is used as the feature similarity. The real-time spatiotemporal correlation between nodes is calculated through a dynamic weight fusion function. ;

[0034] The dynamic weight fusion function is:

[0035] ;

[0036] in For normalized spatial distance, For the normalized time interval, For feature similarity, The dynamic weight coefficients are updated using a self-learning algorithm for dynamic thresholds based on edge correlation, satisfying... ;

[0037] A self-learning algorithm with dynamic threshold for edge correlation is adopted to select node pairs with real-time spatiotemporal correlation not less than the dynamic threshold for edge correlation and historical effective edge accuracy not less than the preset accuracy threshold as effective edges in the current period.

[0038] The historical effective edge accuracy rate is the proportion of the number of times the threat interception behavior of the edge was confirmed to be effective within a preset evaluation period, out of the total number of times the edge was determined to be effective.

[0039] Based on the nodes corresponding to the feature vectors and the filtered valid edges, a dynamic spatiotemporal graph is constructed.

[0040] Furthermore, the edge correlation degree dynamic threshold self-learning algorithm includes:

[0041] Get the set of valid historical edges The set of historical effective edges is the set of edges whose accuracy rate is not less than a preset accuracy threshold within a preset evaluation period.

[0042] Based on the original multi-source sensing data corresponding to the time period of the historical effective edge set, the historical observation correlation degree is calculated through the dynamic weight fusion function. ;

[0043] To minimize the real-time spatiotemporal correlation Correlation with historical observations The difference between the two values ​​is used as the objective to construct a loss function, and the dynamic weight coefficients are iteratively updated based on gradient descent. Until the loss function converges to the preset convergence threshold;

[0044] The loss function for:

[0045] ;

[0046] in, For the set of historical effective edges The number of samples;

[0047] Based on the updated dynamic weight coefficients and the correlation distribution of the historical effective edge set, a dynamic threshold for edge correlation in the current period is generated.

[0048] Furthermore, the step of generating the dynamic threshold for edge correlation in the current period based on the updated dynamic weight coefficients and the correlation distribution of the historical effective edge set includes:

[0049] The correlation distribution of the historical effective edge set is weighted, and the weighting is obtained by combining the dynamic weight coefficient with the historical observation correlation.

[0050] An initial edge correlation threshold is generated based on the weighted correlation distribution and the historical effective edge accuracy.

[0051] The initial threshold is adjusted based on the real-time threat false alarm rate of the current period to obtain the dynamic threshold of edge correlation. The real-time threat false alarm rate is the proportion of instances that are identified as threats by the system in the current period, but are confirmed as non-threats after manual review or subsequent analysis.

[0052] The dynamic threshold for edge correlation is used to filter valid edges in the current period.

[0053] Furthermore, the extraction of spatiotemporal correlation features includes:

[0054] Using the node feature vector in the dynamic spatiotemporal graph as input, the features of each node and its neighboring nodes connected by effective edges are weighted and fused to obtain dynamic weighted fused features. The fusion weight is determined by the real-time spatiotemporal correlation degree of the corresponding edge after normalization.

[0055] Calculate the rate of change of the average edge weight, which is the relative rate of change of the average weight of all valid edges of the node in the current time window with the corresponding average weight in the previous time window;

[0056] The dynamic weighted fusion features, the rate of change of the average edge weights, and the node location information encoding vector are combined to generate the spatiotemporal correlation feature vector.

[0057] Specifically, the feature vectors are used as graph nodes. The real-time spatiotemporal correlation between nodes is calculated, and a dynamic threshold self-learning algorithm for edge correlation is used to filter effective edges based on the real-time spatiotemporal correlation, constructing a dynamic spatiotemporal graph. Spatiotemporal correlation features are then extracted based on the effective edges. The process of constructing the dynamic spatiotemporal graph includes: using the feature vectors of multi-source sensing data within the same observation time or a preset time window (10 seconds) as nodes; using the spatial coordinate difference of nodes as spatial distance, the timestamp difference as time interval, and the cosine similarity of feature vectors as feature similarity; and calculating the real-time spatiotemporal correlation between nodes using a dynamic weight fusion function. The dynamic weight fusion function is... ;in For nodes and nodes The normalized spatial distance between them is calculated using the following formula: ,in It is a node spatial coordinates, It is a node The spatial coordinates are determined by the coordinate system of the actual application scenario, such as meters. The normalized time interval is calculated using the following formula: ,in It is a node Data collection time, It is a node The data collection time is expressed in seconds or other time units. : for nodes and nodes The similarity of feature vectors is calculated using cosine similarity, and the formula is as follows: ,in It is a node eigenvectors, It is a node eigenvectors. The dynamic weighting coefficients are initialized to 0.3, 0.25, and 0.45, respectively, satisfying the following conditions: =1, with a lower limit of 0.05 for each coefficient. The initial value is calculated based on the average contribution of each modal feature in successful threat interception cases under similar historical scenarios. The dynamic weight coefficients are updated through a dynamic threshold self-learning algorithm for edge correlation. The dynamic threshold self-learning algorithm for edge correlation includes: obtaining a set of historical effective edges from the system threat interception record database. The set of historical effective edges is the set of edges whose accuracy is not less than a preset accuracy threshold (0.8) within a preset evaluation period (past 7 days), and pairing it with the original multi-source perception data of the corresponding time period; calculating the historical observation correlation based on the dynamic weight fusion function; and constructing a loss function with the objective of minimizing the difference between the real-time spatiotemporal correlation and the historical observation correlation. for: ;in, Let be the set of historical valid edges. For historical effective boundary sets The number of samples is determined; and the dynamic weight coefficients are iteratively updated based on the gradient descent method until the loss function converges to a preset convergence threshold (0.001). The gradient descent method... Through the partial derivatives Based on the preset learning rate Perform iterative updates, while satisfying The process stops when the number of iterations falls below the preset convergence threshold or reaches the maximum number of iterations. The sign is for the partial derivative; the dynamic threshold for edge correlation in the current period is generated based on the updated dynamic weight coefficients and the correlation distribution of the historical effective edge set, where the correlation distribution is calculated by taking the historical effective edge set as an example. The intervals are divided with a step size of 0.05, and the sample proportions within each interval are statistically analyzed and normalized to a probability distribution. The generation process includes: weighting the correlation distribution of the historical effective edge set using the following formula: ;in, The mean of historical observation correlation. It is the maximum value of the historical observation correlation mean. For real-time spatiotemporal association of corresponding edges, an initial edge association threshold is generated based on the weighted association degree distribution and the historical effective edge accuracy. This initial threshold is then adjusted using the real-time threat false alarm rate (statistics from the past hour) for the current period to obtain a dynamic edge association threshold. The real-time threat false alarm rate is the proportion of instances identified as threats by the system within the current period that are confirmed as non-threats after manual review or subsequent analysis. The dynamic edge association threshold is used to filter effective edges for the current period. Based on the nodes corresponding to the feature vectors and the filtered effective edges, a dynamic spatiotemporal graph is constructed. The extraction of spatiotemporal correlation features includes: using the node feature vector in the dynamic spatiotemporal graph as input, weighting and fusing the features of each node with its neighboring nodes connected by effective edges to obtain dynamic weighted fusion features, where the fusion weights are determined by normalization of the real-time spatiotemporal correlation degree of the corresponding edges; calculating the average change rate of edge weights, where the average change rate of edge weights is the relative change rate of the average weight of all effective edges of a node in the current time window to the corresponding average weight in the previous time window; and expanding the dynamic weighted fusion features (from the original 128-dimensional features to 256-dimensional features via a graph convolutional network), the average change rate of edge weights (1-dimensional), and the node location information encoding vector (255-dimensional). The node location information encoding vector is obtained by: firstly, obtaining the physical location information corresponding to the node from the metadata of the multi-source sensing data, including longitude, latitude, installation height, orientation angle, and region number; and then normalizing the longitude, latitude, and installation height to [0,1][0,1][0,1]. The system deployment environment uses the highest installation height; the orientation angle is normalized to [0,1][0,1][0,1], and the area number is represented using one-hot encoding; then, sine-cosine position encoding is performed on the four continuous fields of longitude, latitude, installation height, and orientation angle, with an encoding dimension of 51. The encoding results of each field are concatenated to form a 204-dimensional vector; the one-hot encoded vector of the area number (51-dimensional) is concatenated to the above vector to obtain a total of 255-dimensional position information encoding vector; this vector is used to preserve the relative relationship and distribution characteristics of nodes in spatial layout. These vectors are then concatenated sequentially to generate a 512-dimensional spatiotemporal correlation feature vector, which is used as input for the subsequent threat assessment and response decision module.

[0058] Based on the historical detection accuracy, current data integrity, and scene adaptability of each modality data, modality weight coefficients are calculated. The spatiotemporal correlation features are then weighted and fused to obtain multimodal comprehensive features. The modality weight coefficients are calculated by multiplying the historical detection accuracy by the scene adaptability to obtain a first factor, and using the square root of the current data integrity as a second factor. After multiplying the first factor and the second factor, the results are normalized to make the sum of all modality weight coefficients equal to 1.

[0059] Furthermore, including:

[0060] Based on the video, sensor, network traffic and behavior log data in the multi-source perception data, the historical detection accuracy is obtained for each modality. The historical detection accuracy is the proportion of the number of times the real threat event corresponding to each modality data is correctly identified within a preset historical evaluation period to the total number of all detected events of that modality within that period.

[0061] Based on the historical detection accuracy, current data integrity, and scene adaptability, a weighted fusion is performed to obtain the normalized modal weight coefficients.

[0062] The scenario adaptability is evaluated by setting applicability indicators for each modal data in the current environment and application scenario. These applicability indicators include factors such as ambient light, equipment installation location, signal quality, and sensor status.

[0063] The data integrity is obtained by detecting the missing proportion of each modality data, where the missing proportion is the proportion of unavailable or abnormal data in the current collection cycle to the total amount of data to be collected.

[0064] Based on the modality weight coefficients, the spatiotemporal correlation features are weighted and fused. The spatiotemporal correlation features corresponding to each modality are multiplied by its modality weight coefficients, and the resulting multimodal comprehensive features are obtained.

[0065] Specifically, based on the historical detection accuracy, current data integrity, and scene adaptability of each modality, modal weight coefficients are calculated, and the spatiotemporal correlation features are weighted and fused to obtain multimodal comprehensive features. The process is as follows: First, the historical detection accuracy is calculated for each modality of multi-source sensing data (video, sensor, network traffic, and behavior logs). The historical detection accuracy is calculated as follows: within a preset historical evaluation period (the past 7 days), the number of times the real threat event corresponding to each modality is correctly identified is divided by the total number of all detected events for that modality within that period, and the result is rounded to four decimal places. Second, the integrity of the multi-source sensing data in the current collection period is evaluated, specifically by detecting the missing proportion of each modality. The missing proportion is calculated as follows: the amount of unavailable or abnormal data in the current collection period is divided by the total amount of data to be collected, and the result is rounded to four decimal places. The criteria for determining missing data include packet loss, video frame corruption, sensor readings exceeding physical threshold ranges, and abnormal log timestamps. Then, the adaptability of the current scene is quantitatively evaluated. The scene adaptability is calculated by comprehensively considering preset applicability indicators, including ambient light intensity (unit: lux), equipment installation location and monitoring area coverage (percentage), signal quality (signal-to-noise ratio dB value), and sensor status (working / abnormal markers). Each indicator is normalized to the range of 0 to 1 and then weighted to obtain the scene adaptability value. Next, the historical detection accuracy, current data integrity (1 minus the missing percentage), and scene adaptability are input into the weighted fusion calculation module. The historical detection accuracy is multiplied by the scene adaptability to obtain the first factor, and the arithmetic square root of the current data integrity is taken to obtain the second factor. The first factor and the second factor are multiplied and then normalized to generate normalized modal weight coefficients. The sum of all modal weight coefficients is 1. Finally, based on the modality weight coefficients, the spatiotemporal correlation features are weighted and fused. Specifically, the spatiotemporal correlation feature vector corresponding to each modality is multiplied element by element by the modality weight coefficient of that modality, and then the weighted results of all modalities are summed along the vector dimension to obtain multimodal comprehensive features, which are then called by the subsequent threat assessment and response strategy generation module.

[0066] Based on the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate, a deep reinforcement learning (DRL) model including policy parameters is used for threat assessment, outputting a threat risk value and a corresponding security response strategy. When the threat risk value reaches a preset judgment condition, the corresponding security response strategy is triggered. The DRL model combines the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate into a multidimensional state vector. Based on the multidimensional state vector and policy parameters, the threat risk value is calculated. The policy parameters are used to control the feature selection weights, state transition probabilities, and action decision rules in the threat risk value calculation process. Based on the threat interception success rate and early warning accuracy rate, the model is iteratively updated using a temporal difference algorithm to generate a corresponding security response strategy according to the threat risk value.

[0067] Furthermore, including:

[0068] The multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate are combined into a multidimensional state vector input to the deep reinforcement learning (DRL) model. The real-time resource utilization rate includes processor utilization rate, memory utilization rate, and bandwidth utilization rate.

[0069] The threat risk value is calculated based on the multidimensional state vector and the current policy parameters. The policy parameters are used to control the feature selection weights, state transition probabilities, and action decision rules in the threat risk value calculation process.

[0070] A corresponding security response strategy is generated based on the threat risk value. The security response strategy includes at least one warning, threat blocking, or access control instruction.

[0071] When the threat risk value reaches the preset judgment condition, the security response strategy is executed.

[0072] Specifically, based on the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource occupancy rate, a deep reinforcement learning (DRL) model containing policy parameters is used for threat assessment, outputting a threat risk value and a corresponding security response strategy. When the threat risk value reaches a preset judgment condition, the corresponding security response strategy is triggered. The specific process is as follows: First, the multimodal integrated features are concatenated with the historical detection accuracy of each modality data statistically analyzed in the current period, and the real-time resource occupancy rate (including processor occupancy rate, memory occupancy rate, and bandwidth utilization rate) collected and calculated in a 1-minute sliding window in a predetermined order to form a multidimensional state vector. The historical detection accuracy of each modality data is obtained from the system annotation and review database according to a preset historical evaluation period (set to 7 days), and is normalized to the [0,1] interval by minimum-maximum. The real-time resource occupancy rate is reported in real time by resource monitoring agents deployed on edge nodes and central nodes and normalized within the same time window to ensure consistency of dimensions. Secondly, the multidimensional state vector is input into a deep reinforcement learning (DRL) model containing policy parameters. The DRL model includes a policy network for mapping the multidimensional state vector to a risk score and an evaluation network for assessing the current state-action value. The policy parameters control the feature selection weights, state transition probabilities, and action decision rules during threat risk value calculation. The feature selection weights are initialized with a normalized weighting based on the historical detection accuracy of each modality as a positive factor and the real-time resource occupancy rate as a negative factor. During the training phase, these weights are solidified into a parameter set for the current period through historical data playback and online incremental training. During the inference phase, the policy network performs feature weighting and nonlinear mapping on the multidimensional state vector based on the policy parameters, outputting a threat risk value normalized to [0,1]. The evaluation network assists in stabilizing the policy output and constraining the state transition probability, ensuring that high-risk states receive higher action priority under resource constraints. Thirdly, a corresponding security response strategy is generated based on the threat risk value and the preset action decision rules in the policy parameters. This security response strategy includes warnings, threat blocking, and access control commands. The execution intensity and order are dynamically adjusted based on the real-time resource occupancy rate to meet resource constraints. Finally, a preset judgment condition is set as a trigger threshold (the threshold is given by the system parameter table and bound to the business scenario). When the threat risk value reaches the preset judgment condition, the security response strategy is immediately executed and the execution log (including the risk value, the multi-dimensional state vector summary, the strategy parameter version number and the execution result) is recorded for subsequent evaluation and traceability. This forms a closed-loop processing process that takes the multi-modal comprehensive features, the historical detection accuracy and real-time resource utilization rate of each modality data as input, calculates the threat risk value through a deep reinforcement learning (DRL) model containing strategy parameters, generates a security response strategy, and triggers execution when the preset judgment condition is met.

[0073] Based on the threat risk value, the early warning accuracy rate after the security response strategy is executed, and the threat interception success rate, the dynamic weight coefficient and the dynamic threshold of the edge correlation are updated by the edge correlation dynamic threshold self-learning algorithm, and the strategy parameters are updated by the temporal difference algorithm of the deep reinforcement learning DRL model. The updated parameter set is output, and the parameter set is used to optimize the feature extraction, fusion and threat assessment process of the next round of multi-source perception data.

[0074] Furthermore, based on the threat risk value, the early warning accuracy rate after the security response strategy is executed, and the threat interception success rate, the dynamic weight coefficients and dynamic threshold of the edge correlation degree are updated through the edge correlation degree dynamic threshold self-learning algorithm, and the strategy parameters are updated through the temporal difference algorithm of the deep reinforcement learning DRL model, outputting the updated parameter set, including:

[0075] Based on the warning accuracy rate, threat interception success rate, and threat risk value, a comprehensive evaluation index is calculated. The warning accuracy rate is the proportion of correctly identified real threat events in the total number of warning events, and the threat interception success rate is the proportion of threat events that are successfully blocked or contained.

[0076] When the deviation between the comprehensive evaluation index and the preset performance target exceeds the deviation threshold, parameter adjustment is initiated.

[0077] Based on the changing trend of the number of effective edges and the effectiveness of threat detection, the dynamic weight coefficient and the dynamic threshold of edge correlation are updated.

[0078] Based on the contribution of each modality data to the early warning accuracy and threat interception success rate in the current period, the modality weight coefficients are adjusted. The weight ratio of modalities with high contribution is increased, and the weight ratio of modalities with low contribution is decreased. After adjustment, the total weight is kept at 1 through normalization.

[0079] Based on the changes in reward signals and deviations in comprehensive evaluation indicators of the DRL model in the current period, the strategy parameters are updated using a time-series difference algorithm.

[0080] The adjusted parameter set is formed by combining the adjusted dynamic threshold of edge correlation, modal weight coefficient and strategy parameters.

[0081] Specifically, based on the threat risk value, the early warning accuracy rate after the security response strategy is executed, and the threat interception success rate, the dynamic weight coefficients and dynamic threshold of the edge correlation degree are updated through the edge correlation degree dynamic threshold self-learning algorithm, and the strategy parameters are updated through the temporal difference algorithm of the deep reinforcement learning DRL model. The updated parameter set is output, which is used to optimize the feature extraction, fusion, and threat assessment process of the next round of multi-source perception data. The specific process is as follows: First, after the current detection period (set to 10 minutes) ends, the system calls the threat assessment and response execution record module to read the threat risk value, the security response strategy execution result, and the corresponding real threat event labels (generated by manual review and annotation) of this period. The early warning accuracy rate (the proportion of correctly identified real threat events in the early warning events to the total number of early warning events) and the threat interception success rate (the proportion of successfully blocked or contained threat events to the total number of threat events) are calculated. Then, the early warning accuracy rate, threat interception success rate, and threat risk value are weighted by the weight coefficient α1. α2, α3, and α1+α2+α3=1, with initial values ​​set to α1=0.4, α2=0.4, α3=0.2 based on historical 30-day evaluation results. Calculate the comprehensive evaluation index (comprehensive evaluation index = α1×early warning accuracy + α2×threat interception success rate + α3×(1-threat risk value deviation), where the threat risk value deviation is the absolute difference between the predicted value and the actual risk value), and compare it with the system's preset performance targets (early warning accuracy ≥90%, threat interception success rate ≥85%). When the absolute value of the deviation between the two exceeds the preset deviation threshold δ (δ=5%), the parameter adjustment process is initiated. Secondly, based on the trend of the number of effective edges in the current period (output every 5 minutes by the dynamic spatiotemporal graph construction module) and the correlation between the threat detection effect (calculated by the Pearson correlation coefficient, a correlation coefficient ≥ 0.6 is considered a strong correlation), the system calls the edge correlation dynamic threshold self-learning algorithm to update the dynamic weight coefficient and the edge correlation dynamic threshold. The adjustment of the dynamic weight coefficient is based on the contribution of each modality data to the warning accuracy and threat interception success rate in the current period (contribution = 0.5 × warning accuracy improvement + 0.5 × interception success rate improvement, the improvement is the difference between the indicators when the modality participates and when it does not participate). The modalities with the highest contribution increase the weight percentage (5%-15%, linearly distributed according to contribution), and the modalities with the lowest contribution decrease the weight percentage (5%-15%, linearly distributed according to contribution). After adjustment, the weight coefficients of all modalities are normalized to keep the total weight of 1.Furthermore, regarding the strategy optimization part, the system updates the strategy parameters based on the reward signal change curve obtained by the DRL model in the current period (reward signal = 0.6 × threat interception success rate - 0.3 × false alarm rate - 0.1 × resource utilization rate) and the deviation value of the comprehensive evaluation index. It adopts the temporal difference algorithm (TD(λ), where λ is 0.8-0.95, with λ=0.95 for high-risk scenarios to focus on long-term benefits and λ=0.8 for normal scenarios to focus on short-term response). The state value estimation update rate is proportional to the reward signal change amplitude (update rate = 0.1 × reward signal change amplitude, where the change amplitude is the difference between the current period and the previous period), ensuring that the model can quickly converge to a new strategy when the performance decline trend occurs (the comprehensive evaluation index is lower than the preset target for two consecutive periods). Finally, the system combines the updated dynamic threshold of edge correlation, modal weight coefficient, and strategy parameters to form an adjusted parameter set, stores it in the parameter management module, and immediately applies it to the next detection cycle. At the same time, the system writes the parameter update record (including the reason for adjustment, the adjustment range of each parameter, the comparison of the warning accuracy / interception success rate before and after the adjustment, timestamp, and version number) into the log database, providing a traceable basis for subsequent backtracking and model retraining, thereby realizing a closed-loop mechanism for adaptive iterative optimization of parameters.

[0082] In summary, the embodiments of this application have at least the following technical effects:

[0083] Multi-source sensing data, including video, sensor data, network traffic, and behavior logs, is acquired through acquisition devices. Corresponding target spatiotemporal features, device operation features, transmission features, and operation sequence features are extracted and converted into numerical feature vectors. These feature vectors are used as graph nodes, and the real-time spatiotemporal correlation between nodes is calculated. Based on the real-time spatiotemporal correlation, a dynamic threshold self-learning algorithm for edge correlation is used to filter effective edges, constructing a dynamic spatiotemporal graph. Spatiotemporal correlation features are extracted based on the effective edges. Modal weight coefficients are calculated based on the historical detection accuracy, current data integrity, and scene adaptability of each modality. The spatiotemporal correlation features are then weighted and fused to obtain multimodal comprehensive features. The modal weight coefficients are calculated by multiplying the historical detection accuracy by the scene adaptability to obtain a first factor, using the square root of the current data integrity as a second factor, multiplying the first and second factors, and then normalizing the results so that the sum of all modal weight coefficients is 1. Based on the multimodal comprehensive features, the historical detection accuracy of each modality, and the real-time resource utilization rate, a deep reinforcement learning (DRL) model containing policy parameters is used. Threat assessment is performed, and a threat risk value and corresponding security response strategy are output. When the threat risk value reaches a preset judgment condition, the corresponding security response strategy is triggered. The deep reinforcement learning (DRL) model combines the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate into a multidimensional state vector. The threat risk value is calculated based on the multidimensional state vector and strategy parameters. The strategy parameters are used to control the feature selection weights, state transition probabilities, and action decision rules in the threat risk value calculation process. Based on the threat interception success rate and warning accuracy rate, the model is iteratively updated using a temporal difference algorithm. A corresponding security response strategy is generated based on the threat risk value. Based on the threat risk value, the warning accuracy rate after the security response strategy is executed, and the threat interception success rate, the dynamic weight coefficients and the dynamic threshold of the edge correlation are updated using the edge correlation dynamic threshold self-learning algorithm. The strategy parameters are updated using the temporal difference algorithm of the deep reinforcement learning (DRL) model. The updated parameter set is output, and the parameter set is used to optimize the feature extraction, fusion, and threat assessment process of the next round of multi-source sensing data.

[0084] Example 2, based on the same inventive concept as the AI-based situational awareness-based behavior analysis and early warning method in the foregoing examples, such as... Figure 2 As shown, this application provides a behavior analysis and early warning system based on AI situational awareness. The system and method embodiments in this application are based on the same inventive concept. The system includes:

[0085] Multi-source data acquisition and feature extraction module 1 is used to acquire multi-source sensing data including video, sensors, network traffic and behavior logs through acquisition devices, extract the corresponding target spatiotemporal features, device operation features, transmission features and operation sequence features respectively, and convert them into numerical feature vectors.

[0086] The dynamic spatiotemporal graph construction and spatiotemporal correlation feature extraction module 2 is used to use the feature vector as graph nodes, calculate the real-time spatiotemporal correlation degree between nodes, and use the edge correlation degree dynamic threshold self-learning algorithm to filter effective edges based on the real-time spatiotemporal correlation degree to construct a dynamic spatiotemporal graph and extract spatiotemporal correlation features based on the effective edges. The edge correlation degree dynamic threshold self-learning algorithm includes obtaining a set of historical effective edges, calculating the historical observation correlation degree based on the set of historical effective edges, constructing a loss function through the real-time spatiotemporal correlation degree and the historical observation correlation degree, iteratively updating the dynamic weight coefficients based on the gradient descent method, and generating a dynamic threshold for edge correlation degree based on the updated dynamic weight coefficients and the correlation degree distribution of the historical effective edge set.

[0087] The multimodal feature fusion module 3 is used to calculate modal weight coefficients based on the historical detection accuracy, current data integrity, and scene adaptability of each modal data, and to weight and fuse the spatiotemporal correlation features to obtain multimodal comprehensive features. The calculation of modal weight coefficients is to multiply the historical detection accuracy and scene adaptability to obtain a first factor, and use the arithmetic square root of the current data integrity as a second factor. After multiplying the first factor and the second factor, the result is normalized so that the sum of all modal weight coefficients is 1.

[0088] The threat assessment and response strategy generation module 4 is used to perform threat assessment based on the multimodal integrated features, the historical detection accuracy and real-time resource utilization of each modality data, through a deep reinforcement learning (DRL) model containing strategy parameters, and output a threat risk value and a corresponding security response strategy. When the threat risk value reaches a preset judgment condition, the corresponding security response strategy is triggered. The deep reinforcement learning (DRL) model combines the multimodal integrated features, the historical detection accuracy and real-time resource utilization of each modality data into a multidimensional state vector, calculates the threat risk value based on the multidimensional state vector and strategy parameters, and controls the feature selection weight, state transition probability and action decision rules in the threat risk value calculation process. It is iteratively updated based on the threat interception success rate and early warning accuracy through a temporal difference algorithm, and generates a corresponding security response strategy according to the threat risk value.

[0089] The parameter dynamic optimization module 5 is used to update the dynamic weight coefficients and dynamic threshold of the edge correlation degree through the edge correlation degree dynamic threshold self-learning algorithm, and update the strategy parameters through the temporal difference algorithm of the deep reinforcement learning DRL model based on the threat risk value, the early warning accuracy rate after the security response strategy is executed, and the threat interception success rate, and output the updated parameter set. The parameter set is used to optimize the feature extraction, fusion and threat assessment process of the next round of multi-source perception data.

[0090] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, specific embodiments have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0091] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0092] This specification and accompanying drawings are merely illustrative examples of this application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from its scope. Therefore, if such modifications and modifications fall within the scope of this application and its equivalents, this application intends to include such modifications and modifications.

Claims

1. A behavior analysis and early warning method based on AI situational awareness, characterized in that, Includes the following steps: Multi-source sensing data, including video, sensor data, network traffic, and behavior logs, are acquired through acquisition devices. The corresponding target spatiotemporal features, device operation features, transmission features, and operation sequence features are extracted and converted into numerical feature vectors. Using the feature vectors as graph nodes, the real-time spatiotemporal correlation between nodes is calculated. Based on the real-time spatiotemporal correlation, a dynamic threshold self-learning algorithm for edge correlation is used to filter effective edges, construct a dynamic spatiotemporal graph, and extract spatiotemporal correlation features based on the effective edges. The dynamic threshold self-learning algorithm for edge correlation includes obtaining a set of historical effective edges, calculating historical observation correlation based on the set of historical effective edges, constructing a loss function through the real-time spatiotemporal correlation and the historical observation correlation, iteratively updating the dynamic weight coefficients based on the gradient descent method, and generating a dynamic threshold for edge correlation based on the updated dynamic weight coefficients and the correlation distribution of the set of historical effective edges. Based on the historical detection accuracy, current data integrity, and scene adaptability of each modality data, modality weight coefficients are calculated, and the spatiotemporal correlation features are weighted and fused to obtain multimodal comprehensive features. The modality weight coefficients are calculated by multiplying the historical detection accuracy and scene adaptability to obtain the first factor, and the arithmetic square root of the current data integrity as the second factor. After multiplying the first factor and the second factor, the results are normalized so that the sum of all modality weight coefficients is 1. Based on the multimodal integrated features, the historical detection accuracy and real-time resource utilization of each modality data, a deep reinforcement learning (DRL) model including policy parameters is used for threat assessment, outputting a threat risk value and a corresponding security response policy. When the threat risk value reaches a preset judgment condition, the corresponding security response policy is triggered. The deep reinforcement learning (DRL) model combines the multimodal integrated features, the historical detection accuracy and real-time resource utilization of each modality data into a multidimensional state vector, calculates the threat risk value based on the multidimensional state vector and policy parameters, and controls the feature selection weights, state transition probabilities and action decision rules in the threat risk value calculation process. It is iteratively updated based on the threat interception success rate and early warning accuracy using a temporal difference algorithm, and generates a corresponding security response policy according to the threat risk value. Based on the threat risk value, the early warning accuracy rate after the security response strategy is executed, and the threat interception success rate, the dynamic weight coefficient and the dynamic threshold of the edge correlation are updated by the edge correlation dynamic threshold self-learning algorithm, and the strategy parameters are updated by the temporal difference algorithm of the deep reinforcement learning DRL model. The updated parameter set is output, and the parameter set is used to optimize the feature extraction, fusion and threat assessment process of the next round of multi-source perception data.

2. The behavior analysis and early warning method based on AI situational awareness as described in claim 1, characterized in that, The construction of the dynamic spatiotemporal graph includes: The feature vectors of multi-source sensing data within the same observation time or a preset time window are used as graph nodes. The spatial coordinate difference of the nodes is used as the spatial distance, the timestamp difference is used as the time interval, and the cosine similarity of the feature vectors is used as the feature similarity. The real-time spatiotemporal correlation between nodes is calculated through a dynamic weight fusion function. ; The dynamic weight fusion function is: ； in For normalized spatial distance, For the normalized time interval, For feature similarity, The dynamic weight coefficients are updated using a self-learning algorithm for dynamic thresholds based on edge correlation, satisfying... ; A self-learning algorithm with dynamic threshold for edge correlation is adopted to select node pairs with real-time spatiotemporal correlation not less than the dynamic threshold for edge correlation and historical effective edge accuracy not less than the preset accuracy threshold as effective edges in the current period. The historical effective edge accuracy rate is the proportion of the number of times the threat interception behavior of the edge was confirmed to be effective within a preset evaluation period, out of the total number of times the edge was determined to be effective. A dynamic spatiotemporal graph is constructed based on the nodes corresponding to the feature vectors and the filtered valid edges.

3. The behavior analysis and early warning method based on AI situational awareness as described in claim 2, characterized in that, The edge correlation dynamic threshold self-learning algorithm includes: Get the set of valid historical edges The set of historical effective edges is the set of edges whose accuracy rate is not less than a preset accuracy threshold within a preset evaluation period. Based on the original multi-source sensing data corresponding to the time period of the historical effective edge set, the historical observation correlation degree is calculated through the dynamic weight fusion function. ; To minimize the real-time spatiotemporal correlation Correlation with historical observations The difference between the two values ​​is used as the objective to construct a loss function, and the dynamic weight coefficients are iteratively updated based on gradient descent. Until the loss function converges to the preset convergence threshold; The loss function for: ； in, For the set of historical effective edges The number of samples; Based on the updated dynamic weight coefficients and the correlation distribution of the historical effective edge set, a dynamic threshold for edge correlation in the current period is generated.

4. The behavior analysis and early warning method based on AI situational awareness as described in claim 3, characterized in that, The process of generating a dynamic threshold for edge correlation in the current period based on the updated dynamic weight coefficients and the correlation distribution of the historical effective edge set includes: The correlation distribution of the historical effective edge set is weighted, and the weighting is obtained by combining the dynamic weight coefficient with the historical observation correlation. An initial edge correlation threshold is generated based on the weighted correlation distribution and the historical effective edge accuracy. The initial threshold is adjusted based on the real-time threat false alarm rate of the current period to obtain the dynamic threshold of edge correlation. The real-time threat false alarm rate is the proportion of instances that are identified as threats by the system in the current period, but are confirmed as non-threats after manual review or subsequent analysis. The dynamic threshold for edge correlation is used to filter valid edges in the current period.

5. The behavior analysis and early warning method based on AI situational awareness as described in claim 1, characterized in that, The extraction of spatiotemporal correlation features includes: Using the node feature vector in the dynamic spatiotemporal graph as input, the features of each node and its neighboring nodes connected by effective edges are weighted and fused to obtain dynamic weighted fused features. The fusion weight is determined by the real-time spatiotemporal correlation degree of the corresponding edge after normalization. Calculate the rate of change of the average edge weight, which is the relative rate of change of the average weight of all valid edges of the node in the current time window with the corresponding average weight in the previous time window; The dynamic weighted fusion features, the rate of change of the average edge weights, and the node location information encoding vector are combined to generate the spatiotemporal correlation feature vector.

6. The behavior analysis and early warning method based on AI situational awareness as described in claim 1, characterized in that, Based on the historical detection accuracy, current data integrity, and scene adaptability of each modality data, modality weight coefficients are calculated, and the spatiotemporal correlation features are weighted and fused to obtain multimodal comprehensive features, including: Based on the video, sensor, network traffic and behavior log data in the multi-source perception data, the historical detection accuracy is obtained for each modality. The historical detection accuracy is the proportion of the number of times the real threat event corresponding to each modality data is correctly identified within a preset historical evaluation period to the total number of all detected events of that modality within that period. Based on the historical detection accuracy, current data integrity, and scene adaptability, a weighted fusion is performed to obtain the normalized modal weight coefficients. The scenario adaptability is evaluated by setting applicability indicators for each modal data in the current environment and application scenario. These applicability indicators include factors such as ambient light, equipment installation location, signal quality, and sensor status. The data integrity is obtained by detecting the missing proportion of each modality data, where the missing proportion is the proportion of unavailable or abnormal data in the current collection cycle to the total amount of data to be collected. Based on the modality weight coefficients, the spatiotemporal correlation features are weighted and fused. The spatiotemporal correlation features corresponding to each modality are multiplied by its modality weight coefficients, and the resulting multimodal comprehensive features are obtained.

7. The behavior analysis and early warning method based on AI situational awareness as described in claim 1, characterized in that, Based on the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate, a deep reinforcement learning (DRL) model including policy parameters is used to perform threat assessment, outputting a threat risk value and a corresponding security response strategy. When the threat risk value reaches a preset judgment condition, the corresponding security response strategy is triggered, including: The multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate are combined into a multidimensional state vector input to the deep reinforcement learning (DRL) model. The real-time resource utilization rate includes processor utilization rate, memory utilization rate, and bandwidth utilization rate. The threat risk value is calculated based on the multidimensional state vector and the current policy parameters. The policy parameters are used to control the feature selection weights, state transition probabilities, and action decision rules in the threat risk value calculation process. A corresponding security response strategy is generated based on the threat risk value. The security response strategy includes at least one warning, threat blocking, or access control instruction. When the threat risk value reaches the preset judgment condition, the security response strategy is executed.

8. The behavior analysis and early warning method based on AI situational awareness as described in claim 1, characterized in that, Based on the threat risk value, the early warning accuracy rate after the security response strategy is executed, and the threat interception success rate, the dynamic weight coefficients and dynamic threshold of the edge correlation degree are updated through the edge correlation degree dynamic threshold self-learning algorithm, and the strategy parameters are updated through the temporal difference algorithm of the deep reinforcement learning DRL model, outputting the updated parameter set, including: Based on the warning accuracy rate, threat interception success rate, and threat risk value, a comprehensive evaluation index is calculated. The warning accuracy rate is the proportion of correctly identified real threat events in the total number of warning events, and the threat interception success rate is the proportion of threat events that are successfully blocked or contained. When the deviation between the comprehensive evaluation index and the preset performance target exceeds the deviation threshold, parameter adjustment is initiated. Based on the changing trend of the number of effective edges and the effectiveness of threat detection, the dynamic weight coefficient and the dynamic threshold of edge correlation are updated. Based on the contribution of each modality data to the early warning accuracy and threat interception success rate in the current period, the modality weight coefficients are adjusted. The weight ratio of modalities with high contribution is increased, and the weight ratio of modalities with low contribution is decreased. After adjustment, the total weight is kept at 1 through normalization. Based on the changes in reward signals and deviations in comprehensive evaluation indicators of the DRL model in the current period, the strategy parameters are updated using a time-series difference algorithm. The adjusted parameter set is formed by combining the adjusted dynamic threshold of edge correlation, modal weight coefficient and strategy parameters.

9. A behavior analysis and early warning system based on AI situational awareness, characterized in that: The system is used to implement the AI-based situational awareness-based behavior analysis and early warning method according to any one of claims 1 to 8, and the system comprises: The multi-source data acquisition and feature extraction module is used to acquire multi-source sensing data, including video, sensor data, network traffic data, and behavior logs, through acquisition devices, extract the corresponding target spatiotemporal features, device operation features, transmission features, and operation sequence features, and convert them into numerical feature vectors. A dynamic spatiotemporal graph construction and spatiotemporal correlation feature extraction module is used to use the feature vector as graph nodes, calculate the real-time spatiotemporal correlation degree between nodes, and use a dynamic threshold self-learning algorithm for edge correlation degree to filter effective edges based on the real-time spatiotemporal correlation degree, construct a dynamic spatiotemporal graph, and extract spatiotemporal correlation features based on the effective edges. The dynamic threshold self-learning algorithm for edge correlation degree includes obtaining a set of historical effective edges, calculating historical observation correlation degree based on the set of historical effective edges, constructing a loss function through the real-time spatiotemporal correlation degree and the historical observation correlation degree, iteratively updating dynamic weight coefficients based on gradient descent, and generating a dynamic threshold for edge correlation degree based on the updated dynamic weight coefficients and the correlation degree distribution of the set of historical effective edges. A multimodal feature fusion module is used to calculate modal weight coefficients based on the historical detection accuracy, current data integrity, and scene adaptability of each modality data, and to weight and fuse the spatiotemporal correlation features to obtain multimodal comprehensive features. The calculation of modal weight coefficients is to multiply the historical detection accuracy and scene adaptability to obtain a first factor, and use the arithmetic square root of the current data integrity as a second factor. After multiplying the first factor and the second factor, the result is normalized so that the sum of all modal weight coefficients is 1. The threat assessment and response strategy generation module is used to perform threat assessment based on the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate, using a deep reinforcement learning (DRL) model that includes strategy parameters. It outputs a threat risk value and a corresponding security response strategy. When the threat risk value reaches a preset judgment condition, the corresponding security response strategy is triggered. The DRL model combines the multimodal integrated features, the historical detection accuracy of each modality data, and the real-time resource utilization rate into a multidimensional state vector. Based on the multidimensional state vector and strategy parameters, it calculates the threat risk value. The strategy parameters control the feature selection weights, state transition probabilities, and action decision rules during the threat risk value calculation process. It iteratively updates the strategy based on the threat interception success rate and early warning accuracy using a temporal difference algorithm, generating a corresponding security response strategy according to the threat risk value. The parameter dynamic optimization module is used to update the dynamic weight coefficients and dynamic threshold of the edge correlation degree through the edge correlation degree dynamic threshold self-learning algorithm, and update the strategy parameters through the temporal difference algorithm of the deep reinforcement learning DRL model based on the threat risk value, the early warning accuracy rate after the security response strategy is executed, and the threat interception success rate. The updated parameter set is used to optimize the feature extraction, fusion and threat assessment process of the next round of multi-source perception data.

Images