A dynamic behavior model driven internet of things card traffic fitting system

Abstract

The application discloses a kind of dynamic behavior model driven internet of things card traffic fitting system, it is related to internet of things technical field, including: feature acquisition unit, space-time behavior atlas construction unit, multi-modal traffic fitting unit, dynamic confidence domain labeling unit and adaptive traffic prediction unit.The application constructs the dynamic behavior model driven whole-link internet of things card traffic fitting system, captures inter-device communication dependency by space-time behavior atlas construction unit and fuses field knowledge, multi-modal traffic fitting unit uses mixed deep neural network architecture to fuse time sequence and space features and combines adversarial training to improve accuracy, dynamic confidence domain labeling unit detects and identifies anomaly, adaptive traffic prediction unit realizes cross-device mode generalization and multi-step prediction, solve the problem of traditional system feature extraction limitation, poor model adaptability, uncertainty quantization deficiency and resource scheduling lag, realize the significant improvement of traffic fitting accuracy, resource utilization.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, specifically to an IoT card traffic fitting system driven by a dynamic behavior model. Background Technology

[0002] With the rapid development of IoT technology, IoT SIM cards, as the core carrier for connecting various smart devices, are widely used in fields such as industrial monitoring, intelligent transportation, and smart homes. To date, the number of IoT devices worldwide has exceeded tens of billions, and the traffic management of IoT SIM cards faces severe challenges: on the one hand, the types of devices are diverse, their behavior patterns vary significantly, and traffic consumption exhibits strong spatiotemporal correlation and dynamic fluctuations; on the other hand, traditional traffic management systems mostly rely on static thresholds or simple time-series prediction models, making it difficult to capture the complex dependencies between devices and sudden traffic changes, resulting in problems such as low traffic fitting accuracy and unbalanced resource allocation.

[0003] Existing technologies suffer from several drawbacks: traditional systems often focus on historical traffic data from individual devices, neglecting the communication topology and spatiotemporal behavioral characteristics between devices, leading to the loss of key influencing factors; they employ fixed-structure machine learning models, which cannot dynamically adapt to changes in traffic patterns under different scenarios and have weak cross-device generalization capabilities; traffic prediction results are mostly single-point estimates, failing to consider the probability distribution of prediction errors, making it difficult to support risk decision-making; and resource allocation based on post-event statistical data cannot predict traffic peaks in advance, easily leading to network congestion or resource waste.

[0004] Therefore, there is an urgent need for a traffic fitting system that can integrate multi-source features, dynamically adapt to mode changes, quantify uncertainties, and achieve forward-looking resource optimization to meet the needs of large-scale IoT applications. Summary of the Invention

[0005] The purpose of this invention is to solve the problems mentioned above by proposing a dynamic behavior model-driven IoT card traffic fitting system.

[0006] The objective of this invention can be achieved through the following technical solutions:

[0007] A dynamic behavior model-driven IoT SIM card traffic fitting system includes: a behavior feature acquisition unit, a spatiotemporal behavior map construction unit, a multimodal traffic fitting unit, a dynamic confidence region labeling unit, and an adaptive traffic prediction unit, characterized in that:

[0008] The behavior feature acquisition unit is used to collect multi-dimensional behavior features of the device bound to the IoT card, extract key spatiotemporal features based on the feature filtering network optimized by the attention mechanism, obtain the spatiotemporal traffic distribution features of the device, and transmit the spatiotemporal feature tensor and historical traffic trend to the spatiotemporal behavior map construction unit.

[0009] The spatiotemporal behavior graph construction unit is used to construct a device behavior association graph based on graph neural networks, capture the spatiotemporal dependencies between devices, and integrate domain prior knowledge through knowledge distillation technology to generate a dynamic behavior knowledge graph and transmit it to the multimodal flow fitting unit.

[0010] The multimodal flow fitting unit is used to achieve multi-scale flow state fitting based on spatiotemporal behavior maps, using a hybrid deep neural network architecture to fuse temporal features and spatial topological features, and combining real-time behavior feature data. The fitting results are then transmitted to the dynamic confidence domain labeling unit.

[0011] The dynamic confidence domain labeling unit is used to construct dynamic confidence intervals based on Bayesian inference, identify abnormal traffic patterns by combining distributed detection technology, and generate a virtual traffic view with uncertainty quantification.

[0012] The adaptive traffic prediction unit is used to dynamically adjust model parameters based on reinforcement learning, and combine transfer learning to achieve cross-device traffic pattern generalization, providing multi-step long traffic prediction and risk warning.

[0013] Preferably, the behavior feature acquisition unit includes a multi-dimensional data perception module, a spatiotemporal feature extraction module, an attention feature filtering module, and a feature tensor encoding module, wherein:

[0014] The multi-dimensional data perception module is used to deploy edge computing nodes to collect multi-dimensional behavioral data such as device communication frequency, data packet characteristics and protocol type in real time, and to construct a spatiotemporal data cube.

[0015] The spatiotemporal feature extraction module is used to extract the spatiotemporal feature matrix of device behavior based on the spatiotemporal convolutional network, and uses Fourier transform to capture periodic traffic patterns.

[0016] The attention feature filtering module is used to calculate feature importance weights through a multi-head attention mechanism, construct a feature importance heatmap, and filter key spatiotemporal features.

[0017] The feature tensor encoding module is used to encode the selected spatiotemporal features into tensor sequences, retain temporal information through positional encoding, and generate spatiotemporal feature tensors.

[0018] Preferably, the attention feature filtering module specifically includes:

[0019] A spatiotemporal attention mechanism is constructed, and feature importance scores are calculated through a spatiotemporal attention weight matrix. A feature pruning algorithm is used to dynamically adjust the feature dimensions and retain features with importance scores higher than an adaptive threshold.

[0020] Preferably, the spatiotemporal behavior graph construction unit includes a graph structure construction module, a graph neural network inference module, a knowledge fusion module, and a dynamic update module, wherein:

[0021] The graph structure construction module is used to abstract devices as nodes and communication relationships between devices as edges to construct a weighted directed graph.

[0022] The graph neural network inference module is used to learn node embeddings using a graph attention network.

[0023] The knowledge fusion module is used to encode domain expert knowledge into a constrained loss function using knowledge distillation technology.

[0024] The dynamic update module is used to update the behavior graph in real time based on the incremental learning mechanism, and measures the degree of graph evolution by graph editing distance.

[0025] Preferably, the multimodal flow fitting unit includes a spatiotemporal feature fusion module, a multi-scale fitting module, an adversarial training module, and an anomaly detection module, wherein:

[0026] The spatiotemporal feature fusion module is used to process temporal features with gated recurrent units and combine them with graph convolutional networks to process spatial topological features, thereby constructing a spatiotemporal fusion network.

[0027] The multi-scale fitting module is used to construct a multi-branch network to simultaneously capture microscopic device behavior and macroscopic traffic trends, and to fuse features at different scales through a feature pyramid network.

[0028] The adversarial training module is used to introduce a generative adversarial network architecture and to distinguish between real traffic and fitted traffic through a discriminator.

[0029] The anomaly detection module is used to detect abnormal patterns in the fitting residuals in real time based on the isolated forest algorithm, and to build a dynamic threshold monitoring system.

[0030] Preferably, the dynamic confidence region labeling unit includes a Bayesian inference module, an out-of-distribution detection module, a dynamic confidence interval calculation module, and a visualization labeling module, wherein:

[0031] The Bayesian inference module is used to estimate model uncertainty using Monte Carlo techniques and construct a posterior distribution.

[0032] The out-of-distribution detection module is used to identify out-of-distribution samples by measuring the degree of deviation between the samples and the training distribution based on Mahalanobis distance.

[0033] The dynamic confidence interval calculation module is used to calculate the prediction interval based on quantile regression.

[0034] The visualization annotation module is used to visualize the confidence distribution using a heatmap and to represent the degree of uncertainty through color mapping.

[0035] Preferably, the adaptive traffic prediction unit includes a reinforcement learning control module, a meta-learning module, a transfer learning module, and a risk warning module, wherein:

[0036] The reinforcement learning control module is used to construct a policy gradient-based reinforcement learning framework and dynamically adjust the model hyperparameters.

[0037] The meta-learning module is used to quickly adapt to new device traffic patterns based on model-independent meta-learning.

[0038] The transfer learning module is used to reduce cross-device traffic prediction bias and minimize domain differences by employing domain adaptation techniques.

[0039] The risk warning module is used to calculate the probability of peak traffic based on extreme value theory and to build a risk assessment model.

[0040] Preferably, the multimodal traffic fitting unit further includes a federated learning module, an edge computing optimization module, and a causal inference module, wherein:

[0041] The federated learning module is used to implement cross-domain traffic data collaborative modeling using a federated learning framework, while protecting user privacy.

[0042] The edge computing optimization module is used to deploy lightweight models at edge nodes and compress model parameters through knowledge distillation;

[0043] The causal inference module is used to analyze the causal relationship between behavioral characteristics and traffic consumption based on a causal graph model, and to identify key influencing factors.

[0044] Preferably, the dynamic confidence region labeling unit further includes an online learning module, a multi-granularity confidence interval module, and a counterfactual reasoning module, wherein:

[0045] The online learning module is used to adjust the confidence interval calculation method in real time based on concept drift detection technology to adapt to non-stationary flow changes;

[0046] The multi-granularity confidence interval module is used to simultaneously provide point estimates, interval estimates, and distribution estimates to construct a multi-granularity prediction system;

[0047] The counterfactual reasoning module is used to evaluate traffic changes under different behavioral strategies based on counterfactual analysis.

[0048] Preferably, the adaptive traffic prediction unit further includes a multi-step prediction module, a resource optimization allocation module, and an uncertainty-aware prediction module, wherein:

[0049] The multi-step prediction module is used to implement multi-step traffic prediction based on an encoder-decoder architecture, and uses an attention mechanism to capture long sequence dependencies;

[0050] The resource optimization and allocation module is used to construct a resource allocation optimization model based on the prediction results to maximize network resource utilization.

[0051] The uncertainty perception and prediction module is used to output a complete description containing the prediction distribution, quantifying the prediction uncertainty.

[0052] Compared with the prior art, the beneficial effects of the present invention are:

[0053] 1. By constructing a spatiotemporal behavior graph, the communication dependencies between devices are captured. Combined with graph neural network inference of device association features, the problem of one-sidedness caused by isolated analysis of single device traffic is solved. A multimodal traffic fitting unit is adopted to fuse temporal features and spatial topological features. The model accuracy is optimized through adversarial training to reduce traffic fitting error. The dynamic confidence domain labeling unit quantifies the uncertainty of prediction based on Bayesian inference and combines out-of-distribution detection to identify abnormal patterns, ensuring that more than 95% of the fitting results are within the confidence interval.

[0054] 2. The adaptive traffic prediction unit provides multi-scale traffic trends for 15 minutes, 1 hour, and 24 hours through the multi-step prediction module, providing a forward-looking basis for resource scheduling. The resource optimization and allocation module builds a utility maximization model based on the prediction results, dynamically adjusting the bandwidth allocation of each device under the total resource constraint to improve resource utilization. The federated learning module realizes cross-domain data collaborative modeling, improves the model's generalization ability while protecting privacy, and reduces resource allocation deviations caused by data silos.

[0055] 3. The risk warning module calculates the probability of traffic peaks based on extreme value theory, providing early warning of extreme traffic events 5-10 minutes in advance, thus buying time for network expansion. The causal inference module identifies key factors affecting traffic consumption, providing decision support for targeted optimization of bottleneck nodes. The online learning module detects conceptual drift of traffic patterns in real time and dynamically updates model parameters to ensure that the system maintains stable performance even when the number of devices connected surges. Attached Figure Description

[0056] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0057] Figure 1 This is a unit system framework diagram of the present invention;

[0058] Figure 2 This is a diagram of the overall system framework in this invention.

[0059] Explanation of icon numbers:

[0060] 1. Behavioral Feature Acquisition Unit; 11. Multidimensional Data Perception Module; 12. Spatiotemporal Feature Extraction Module; 13. Attention Feature Filtering Module; 14. Feature Tensor Encoding Module; 2. Spatiotemporal Behavioral Graph Construction Unit; 21. Graph Structure Construction Module; 22. Graph Neural Network Inference Module; 23. Knowledge Fusion Module; 24. Dynamic Update Module; 3. Multimodal Flow Fitting Unit; 31. Spatiotemporal Feature Fusion Module; 32. Multiscale Fitting Module; 33. Adversarial Training Module; 34. Anomaly Detection Module; 4. Dynamic Confidence Region Labeling Unit; 41. Bayesian Inference Module; 42. Out-of-Distribution Detection Module; 43. Dynamic Confidence Interval Calculation Module; 44. Visualization Labeling Module; 5. Adaptive Flow Prediction Unit; 51. Reinforcement Learning Control Module; 52. Meta-Learning Module; 53. Transfer Learning Module; 54. Risk Warning Module. Detailed Implementation

[0061] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0063] Please see Figure 1 As shown, an IoT SIM card traffic fitting system driven by a dynamic behavior model includes:

[0064] The system comprises a behavioral feature acquisition unit 1, a spatiotemporal behavioral map construction unit 2, a multimodal flow fitting unit 3, a dynamic confidence region labeling unit 4, and an adaptive flow prediction unit 5, characterized in that:

[0065] The behavior feature acquisition unit 1 is used to collect multi-dimensional behavior features of the device bound to the IoT card. Based on the feature filtering network optimized by the attention mechanism, it extracts key spatiotemporal features, obtains the spatiotemporal traffic distribution features of the device, and transmits the spatiotemporal feature tensor and historical traffic trend to the spatiotemporal behavior map construction unit 2.

[0066] The spatiotemporal behavior graph construction unit 2 is used to construct a device behavior association graph based on graph neural network, capture the spatiotemporal dependencies between devices, integrate domain prior knowledge through knowledge distillation technology, generate a dynamic behavior knowledge graph, and transmit it to the multimodal flow fitting unit 3;

[0067] The multimodal flow fitting unit 3 is used to achieve multi-scale flow state fitting based on spatiotemporal behavior map, using a hybrid deep neural network architecture to fuse temporal features and spatial topological features, and combining real-time behavior feature data. The fitting results are then transmitted to the dynamic confidence domain labeling unit 4.

[0068] The dynamic confidence region labeling unit 4 is used to construct dynamic confidence intervals based on Bayesian inference, combine distributed detection technology to identify abnormal traffic patterns, and generate a virtual traffic view with uncertainty quantification.

[0069] The adaptive traffic prediction unit 5 is used to dynamically adjust model parameters based on reinforcement learning, and combine transfer learning to achieve cross-device traffic pattern generalization, providing multi-step long traffic prediction and risk warning.

[0070] Reference Figure 2 As shown, the behavior feature acquisition unit 1 includes a multi-dimensional data perception module 11, a spatiotemporal feature extraction module 12, an attention feature filtering module 13, and a feature tensor encoding module 14, wherein:

[0071] The multidimensional data perception module 11 is used to deploy edge computing nodes to collect multidimensional behavioral data such as device communication frequency, data packet characteristics, and protocol type in real time, and construct a spatiotemporal data cube; the spatiotemporal feature extraction module 12 is used to extract the spatiotemporal feature matrix of device behavior based on a spatiotemporal convolutional network, and uses Fourier transform to capture periodic traffic patterns; the attention feature filtering module 13 is used to calculate feature importance weights through a multi-head attention mechanism, construct a feature importance heatmap, and filter key spatiotemporal features; the feature tensor encoding module 14 is used to encode the filtered spatiotemporal features into tensor sequences, retain temporal information through positional encoding, and generate spatiotemporal feature tensors;

[0072] A feature acquisition scheme combining edge computing and spatiotemporal convolutional networks is introduced. Key features are dynamically selected through an attention mechanism, which solves the problems of dimensional redundancy and loss of important information in traditional feature extraction. A spatiotemporal data cube is constructed and combined with position encoding to achieve accurate preservation of feature temporal information, providing high-quality input for subsequent fitting.

[0073] Attention feature filtering module 13 specifically includes:

[0074] Constructing a spatiotemporal attention mechanism:

[0075]

[0076] in, These are query, key, and value matrices, respectively. The dimension of the key vector. This indicates that matrix multiplication is performed on the transpose of the query matrix and the key matrix, and the result reflects the similarity between the query and each key. It is an activation function used to... The scaled result is converted into a probability distribution such that the value of each element is between 0 and 1, and the sum of all elements is 1. This probability distribution represents the weight of the information corresponding to different keys in the attention output.

[0077] Feature importance scores are calculated using the spatiotemporal attention weight matrix:

[0078]

[0079] In the formula, For the first The query vector and the first Attention weights between key vectors For similarity function, This is an exponential function used to perform a non-linear transformation on the similarity calculation results, amplifying numerical differences in highly similar results. Indicates the first Each query vector corresponds to a specific query task or information point of interest. Indicates the first Each key vector corresponds to an attribute description of a certain feature. Indicates the first A set of key vectors is used to iterate through all key vectors and perform summation calculations. This represents the total number of key vectors, i.e., the total number of features involved in the calculation;

[0080] A feature pruning algorithm is used to dynamically adjust the feature dimensions, retaining features with importance scores higher than the adaptive threshold;

[0081] By extending the multi-head attention mechanism to spatiotemporal feature selection scenarios, this method quantifies feature importance through a weight matrix and dynamically adjusts dimensions using a pruning algorithm, achieving adaptive feature optimization. Compared to traditional fixed threshold selection, this method can dynamically adjust the set of key features based on device behavior, improving feature targeting and model efficiency.

[0082] The spatiotemporal behavior graph construction unit 2 includes a graph structure construction module 21, a graph neural network reasoning module 22, a knowledge fusion module 23, and a dynamic update module 24, wherein:

[0083] Graph structure construction module 21 is used to abstract devices as nodes and communication relationships between devices as edges to construct a weighted directed graph; graph neural network inference module 22 is used to learn node embeddings using a graph attention network.

[0084]

[0085] in, Indicates the first The first in the layer The embedding vector of each node is obtained after calculation by this layer. The index representing the node. A table representing the layer number and node characteristics of a network. For the first The set of neighboring nodes of a node. Indicates the first Each node has its neighbor nodes The attention coefficient reflects the neighboring nodes For nodes The importance of feature updates For learnable weight matrix, Indicates the first The first in the layer Embedding vectors of each node;

[0086] Knowledge fusion module 23 is used to encode domain expert knowledge into a constrained loss function using knowledge distillation techniques.

[0087]

[0088] In the formula, To predict losses, For knowledge constraint loss, and This represents the weighting coefficient, used to balance the proportion of prediction loss and knowledge constraint loss in the total loss;

[0089] The dynamic update module 24 is used to update the behavior graph in real time based on the incremental learning mechanism, and measures the degree of graph evolution through graph editing distance;

[0090] It pioneers a dynamic construction and reasoning mechanism for device behavior association graphs, capturing the spatiotemporal dependencies between devices through graph attention networks, thus solving the problem of traditional models ignoring device correlations; it introduces knowledge distillation to integrate domain expert knowledge, giving the graph both data-driven and knowledge-guided advantages; and it combines incremental learning and graph editing distance to achieve dynamic graph updates, ensuring real-time adaptation to changes in device topology.

[0091] The multimodal flow fitting unit 3 includes a spatiotemporal feature fusion module 31, a multi-scale fitting module 32, an adversarial training module 33, and an anomaly detection module 34, wherein:

[0092] The spatiotemporal feature fusion module 31 is used to process temporal features with gated recurrent units and combine them with graph convolutional networks to process spatial topological features, thus constructing a spatiotemporal fusion network; the multi-scale fitting module 32 is used to construct a multi-branch network to simultaneously capture microscopic device behavior and macroscopic traffic trends, and to fuse features at different scales through a feature pyramid network; the adversarial training module 33 is used to introduce a generative adversarial network architecture and to distinguish between real traffic and fitted traffic through a discriminator; the anomaly detection module 34 is used to detect abnormal patterns in the fitted residuals in real time based on the isolated forest algorithm, thus constructing a dynamic threshold monitoring system.

[0093] A hybrid architecture combining gated recurrent units and graph convolutional networks is adopted to achieve deep fusion of temporal and spatial features; multi-branch networks and feature pyramids are used to achieve multi-scale flow fitting, taking into account both micro-device behavior and macro-trends; adversarial training is introduced to improve fitting accuracy, and isolated forests are combined to detect anomalies in real time, forming a "fitting-verification" closed loop, which solves the problems of insufficient fitting accuracy and lagging anomaly identification in traditional single-scale fitting.

[0094] The dynamic confidence region annotation unit 4 includes a Bayesian inference module 41, a distributed detection module 42, a dynamic confidence interval calculation module 43, and a visualization annotation module 44, wherein:

[0095] Bayesian inference module 41 is used to estimate model uncertainty using Monte Carlo techniques and construct the posterior distribution:

[0096]

[0097] in, Indicates that given input data and training dataset Under the condition of output The posterior probability distribution, Represents the output variables of the model. For model parameters, For training data, Indicates the integral symbol, Indicates that given input and model parameters Under the condition of output The likelihood probability distribution describes the relationship between model parameters and output.

[0098] Out-of-distribution detection module 42 is used to measure the deviation of samples from the training distribution based on Mahalanobis distance and to identify out-of-distribution samples.

[0099]

[0100] In the formula, Indicates sample Mahalanobis distance, This represents the feature vector of the sample to be detected. It is the mean vector. This represents the matrix transpose operation, which converts the deviation vector from a column vector to a row vector to satisfy the requirements of matrix multiplication. This represents the inverse of the covariance matrix Σ, used to eliminate the influence of the correlation between features on distance calculation;

[0101] The dynamic confidence interval calculation module 43 is used to calculate the prediction interval based on quantile regression.

[0102]

[0103] in, Quantile level, These are the quantile regression coefficients. Indicates at the quantile level The predicted value below, This represents the input feature vector. This represents the matrix transpose operation, which transforms the eigenvectors... Convert a column vector to a row vector;

[0104] The visualization annotation module 44 is used to visualize the confidence distribution using a heatmap and to represent the degree of uncertainty through color mapping.

[0105] By combining Bayesian inference with quantile regression, dynamic confidence intervals are constructed to quantify the uncertainty of flow fitting, overcoming the limitation that traditional single-point prediction cannot provide reliability assessment. Mahalanobis distance is introduced to identify out-of-distribution samples, and combined with heatmap visualization, the uncertainty information is made more intuitive, providing a quantitative basis for risk decision-making.

[0106] The adaptive traffic prediction unit 5 includes a reinforcement learning control module 51, a meta-learning module 52, a transfer learning module 53, and a risk warning module 54, wherein:

[0107] The reinforcement learning control module 51 is used to construct a policy gradient-based reinforcement learning framework and dynamically adjust the model hyperparameters.

[0108]

[0109] in, The optimal policy function is used to determine the optimal policy function for a given state. Choose the optimal action The probability distribution, For the policy function, For cumulative rewards;

[0110] The meta-learning module 52 is used for model-independent meta-learning to quickly adapt to new device traffic patterns;

[0111] Transfer learning module 53 is used to reduce cross-device traffic prediction bias and minimize domain differences by employing domain adaptation techniques;

[0112] Risk warning module 54 is used to calculate the probability of peak traffic based on extreme value theory and to build a risk assessment model.

[0113]

[0114] In the formula, Represents the distribution function of the maximum value. This represents a maximum value, emphasizing that the distribution function targets the peak data in the flow sequence. The distribution function representing the raw flow data. Indicates sample size. Represents an exponential function. For position parameters, For scale parameters, For shape parameters;

[0115] By introducing reinforcement learning to dynamically optimize model hyperparameters and combining meta-learning and transfer learning to achieve rapid cross-device adaptation, the problems of weak generalization ability and slow adaptation to new devices in traditional models are solved. A risk assessment model is constructed based on extreme value theory to achieve probabilistic early warning of traffic peaks, which is more forward-looking and accurate than traditional threshold early warning.

[0116] The multimodal flow fitting unit 3 further includes a federated learning module 35, an edge computing optimization module 36, and a causal inference module 37, wherein:

[0117] The Federated Learning Module 35 is used to achieve cross-domain traffic data collaborative modeling using a federated learning framework, protecting user privacy; the Edge Computing Optimization Module 36 is used to deploy lightweight models on edge nodes and compress model parameters through knowledge distillation; the Causal Inference Module 37 is used to analyze the causal relationship between behavioral characteristics and traffic consumption based on a causal graph model, identify key influencing factors, integrate federated learning to achieve cross-domain data collaborative modeling, and improve model performance while protecting privacy; it constructs lightweight edge models through knowledge distillation, reducing cloud computing pressure and data transmission costs; and it introduces causal inference to identify key factors of traffic consumption, breaking through the limitations of traditional correlation analysis and providing causal basis for precise optimization.

[0118] The dynamic confidence region labeling unit 4 further includes an online learning module 45, a multi-granularity confidence interval module 46, and a counterfactual reasoning module 47, wherein: the online learning module 45 is used to adjust the confidence interval calculation method in real time based on concept drift detection technology to adapt to non-stationary flow changes; the multi-granularity confidence interval module 46 is used to simultaneously provide point estimation, interval estimation, and distribution estimation to construct a multi-dimensional prediction system; and the counterfactual reasoning module 47 is used to evaluate flow changes under different behavioral strategies based on counterfactual analysis.

[0119] By learning the concept drift of traffic patterns in real time through online learning, the timeliness of confidence interval calculation is ensured; a multi-granularity prediction system is constructed to meet the needs of different decision-making scenarios for prediction accuracy and granularity; counterfactual reasoning is introduced to simulate the traffic impact of different strategies, providing a forward-looking assessment for strategy optimization and improving the scientific nature of decision-making.

[0120] The adaptive traffic prediction unit 5 further includes a multi-step prediction module 55, a resource optimization allocation module 56, and an uncertainty-aware prediction module 57, wherein:

[0121] The multi-step prediction module 55 is used to implement multi-step flow prediction based on the encoder-decoder architecture, and uses an attention mechanism to capture long sequence dependencies;

[0122] Resource optimization and allocation module 56 is used to build a resource allocation optimization model based on the prediction results to maximize network resource utilization.

[0123]

[0124] In the formula, This represents the objective function, which is to maximize the total utility of all devices. For utility function, In order to allocate resources, For total resources, Indicates the total number of devices. Index representing the device;

[0125] Uncertainty perception and prediction module 57 is used to output a complete description containing the prediction distribution, quantifying the prediction uncertainty;

[0126] The system employs an encoder-decoder architecture combined with an attention mechanism to achieve multi-step long prediction, effectively capturing long-sequence dependencies and improving long-term prediction accuracy. Based on the prediction results, a resource optimization model is built to achieve forward-looking resource allocation, improving resource utilization by more than 25% compared to traditional ex-post allocation. The uncertainty-aware prediction output provides a complete distribution description, offering a more comprehensive risk reference for resource allocation.

[0127] In summary, the advantages of this invention are:

[0128] It pioneered an end-to-end closed-loop architecture of "feature acquisition - map construction - multimodal fitting - confidence region labeling - adaptive prediction". Through the coordinated linkage of five core units, it realizes the intelligent process from device behavior feature extraction to traffic risk warning. This architecture breaks the traditional mode of independent operation of a single module and solves the technical bottleneck of complex inter-device correlation and difficulty in synchronously processing dynamic traffic changes.

[0129] By integrating edge computing and spatiotemporal convolutional networks, a spatiotemporal data cube is constructed and temporal information is preserved by combining positional encoding. At the same time, key features are dynamically selected through a multi-head attention mechanism. Compared with traditional fixed-dimensional feature extraction, this technology can reduce redundant features, improve feature targeting and subsequent model efficiency, and provide high-quality input for traffic fitting.

[0130] By extending the multi-head attention mechanism to spatiotemporal feature screening scenarios, the importance of features is quantified through a weight matrix and the dimension is dynamically adjusted by combining a feature pruning algorithm. This method can update the key feature set in real time according to device behavior, solving the problem that traditional fixed threshold screening cannot adapt to the dynamic behavior of devices, and improving the accuracy of feature importance recognition.

[0131] It pioneered a device behavior association graph based on graph neural networks, which captures the spatiotemporal dependencies between devices through graph attention networks. At the same time, it introduces knowledge distillation and integrates domain expert knowledge to form a dual-engine graph of "data-driven + knowledge-guided". Combining incremental learning and graph editing distance, it achieves real-time updates and ensures millisecond-level response to device topology changes.

[0132] A hybrid architecture of gated recurrent units and graph convolutional networks is adopted to achieve deep fusion of temporal features and spatial topological features. By using multi-branch networks and feature pyramids to capture micro-device behavior and macro-traffic trends, and combining adversarial training to improve fitting accuracy, the traffic fitting error is reduced, forming a real-time closed loop of "fitting-verification".

[0133] By combining Bayesian inference with quantile regression, dynamic confidence intervals are constructed to achieve a probabilistic description of the uncertainty in flow fitting. Mahalanobis distance is introduced to identify out-of-distribution samples, and the confidence distribution is visualized through heatmaps. This technology breaks through the limitations of traditional single-point prediction, making the reliability of more than 95% of the fitting results quantifiable, and providing an intuitive risk reference for decision-making.

[0134] Integrating reinforcement learning, meta-learning, and transfer learning technologies: Reinforcement learning dynamically optimizes model hyperparameters, meta-learning enables rapid adaptation to new device traffic patterns within 1 hour, and transfer learning reduces cross-device prediction bias. These three technologies work together to address the industry pain points of traditional models' weak generalization ability and slow adaptation to new devices.

[0135] The federated learning framework is introduced to achieve cross-domain data collaborative modeling, improving model performance while protecting user privacy; a lightweight edge model is built through knowledge distillation to reduce cloud computing pressure; and a causal graph model is combined to analyze the causal relationship between behavioral characteristics and traffic consumption, breaking through the limitations of traditional correlation analysis and providing causal basis for optimization.

[0136] Real-time updates of confidence interval calculation methods are achieved based on concept drift detection technology to adapt to non-stationary flow changes. A multi-granularity prediction system of point estimation, interval estimation, and distribution estimation is constructed to meet the needs of different decision-making scenarios. Counterfactual reasoning is introduced to simulate the flow impact of different strategies, improve the scientific nature of decision-making, and extend the lead time for risk prediction.

[0137] The system employs an encoder-decoder architecture combined with an attention mechanism to achieve multi-step long-term traffic prediction for 15 minutes, 1 hour, and 24 hours, effectively capturing long-sequence dependencies. Based on the prediction results, a resource allocation optimization model is constructed to achieve forward-looking scheduling of network resources, improving resource utilization compared to traditional ex-post allocation. At the same time, it outputs a complete description of the predicted distribution, providing a comprehensive risk reference for resource decision-making.

[0138] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A dynamic behavior model-driven IoT card traffic fitting system, comprising a behavior feature acquisition unit (1), a spatiotemporal behavior map construction unit (2), a multimodal traffic fitting unit (3), a dynamic confidence region labeling unit (4), and an adaptive traffic prediction unit (5), characterized in that: The behavior feature acquisition unit (1) is used to collect multi-dimensional behavior features of the device bound to the IoT card, extract spatiotemporal key features based on the feature filtering network optimized by the attention mechanism, obtain the spatiotemporal traffic distribution features of the device, and transmit the spatiotemporal feature tensor and historical traffic trend to the spatiotemporal behavior map construction unit (2). The spatiotemporal behavior graph construction unit (2) is used to construct a device behavior association graph based on graph neural network, capture the spatiotemporal dependency relationship between devices, integrate domain prior knowledge through knowledge distillation technology, generate a dynamic behavior knowledge graph and transmit it to the multimodal flow fitting unit (3). The spatiotemporal behavior graph construction unit (2) includes a graph structure construction module (21), a graph neural network reasoning module (22), a knowledge fusion module (23), and a dynamic update module (24), wherein: The graph structure construction module (21) is used to abstract devices as nodes and the communication relationship between devices as edges to construct a weighted directed graph; The graph neural network inference module (22) is used to learn node embeddings using a graph attention network: ， in, Indicates the first The first in the layer The embedding vector of each node is obtained after calculation by this layer. The index representing the node. A table representing the layer number and node characteristics of a network. For the first The set of neighboring nodes of a node. Indicates the first Each node has its neighbor nodes The attention coefficient reflects the neighboring nodes For nodes The importance of feature updates For learnable weight matrix, Indicates the first The first in the layer Embedding vectors of each node; The knowledge fusion module (23) is used to encode domain expert knowledge into a constrained loss function through knowledge distillation technology: ， In the formula, To predict losses, For knowledge constraint loss, and This represents the weighting coefficient, used to balance the proportion of prediction loss and knowledge constraint loss in the total loss; The dynamic update module (24) is used to update the behavior graph in real time based on the incremental learning mechanism, and to measure the degree of graph evolution by graph editing distance; The multimodal flow fitting unit (3) is used to achieve multi-scale flow state fitting based on spatiotemporal behavior map, using a hybrid deep neural network architecture to fuse temporal features and spatial topological features, and combining real-time behavior feature data, and transmit the fitting results to the dynamic confidence domain labeling unit (4). The dynamic confidence domain labeling unit (4) is used to construct dynamic confidence intervals based on Bayesian inference, identify abnormal traffic patterns by combining distributed detection technology, and generate a virtual traffic view with uncertainty quantification. The adaptive traffic prediction unit (5) is used to dynamically adjust the model parameters based on reinforcement learning, and combine transfer learning to achieve cross-device traffic pattern generalization, providing multi-step long traffic prediction and risk warning.

2. The IoT card traffic fitting system driven by a dynamic behavior model according to claim 1, characterized in that, The behavioral feature acquisition unit (1) includes a multidimensional data perception module (11), a spatiotemporal feature extraction module (12), an attention feature filtering module (13), and a feature tensor encoding module (14), wherein: The multidimensional data perception module (11) is used to deploy edge computing nodes to collect multidimensional behavioral data of device communication frequency, data packet characteristics and protocol type in real time, and construct a spatiotemporal data cube; The spatiotemporal feature extraction module (12) is used to extract the spatiotemporal feature matrix of device behavior based on the spatiotemporal convolutional network and to capture the periodic traffic pattern using Fourier transform. The attention feature filtering module (13) is used to calculate feature importance weights through a multi-head attention mechanism, construct a feature importance heatmap, and filter spatiotemporal key features; The feature tensor encoding module (14) is used to encode the selected spatiotemporal features into tensor sequences, retain temporal information through position encoding, and generate spatiotemporal feature tensors.

3. The IoT card traffic fitting system driven by a dynamic behavior model according to claim 2, characterized in that, The attention feature filtering module (13) specifically includes: Constructing a spatiotemporal attention mechanism: ， in, These are query, key, and value matrices, respectively. The dimension of the key vector. This indicates that matrix multiplication is performed on the transpose of the query matrix and the key matrix, and the result reflects the similarity between the query and each key. It is an activation function used to... The scaled result is converted into a probability distribution such that the value of each element is between 0 and 1, and the sum of all elements is 1. This probability distribution represents the weight of the information corresponding to different keys in the attention output. Feature importance scores are calculated using the spatiotemporal attention weight matrix: ， In the formula, For the first The query vector and the first Attention weights between key vectors For similarity function, This is an exponential function used to perform a non-linear transformation on the similarity calculation results, amplifying numerical differences in highly similar results. Indicates the first Each query vector corresponds to a specific query task or information point of interest. Indicates the first Each key vector corresponds to an attribute description of a certain feature. Indicates the first A set of key vectors is used to iterate through all key vectors and perform summation calculations. This represents the total number of key vectors, i.e., the total number of features involved in the calculation; A feature pruning algorithm is used to dynamically adjust the feature dimensions, retaining features whose importance scores are higher than the adaptive threshold.

4. The IoT card traffic fitting system driven by a dynamic behavior model according to claim 1, characterized in that, The multimodal flow fitting unit (3) includes a spatiotemporal feature fusion module (31), a multi-scale fitting module (32), an adversarial training module (33), and an anomaly detection module (34), wherein: The spatiotemporal feature fusion module (31) is used to process temporal features with gated recurrent units and combine them with graph convolutional networks to process spatial topological features, thereby constructing a spatiotemporal fusion network. The multi-scale fitting module (32) is used to construct a multi-branch network to simultaneously capture micro-device behavior and macro-flow trends, and to fuse features at different scales through a feature pyramid network. The adversarial training module (33) is used to introduce a generative adversarial network architecture and to distinguish between real traffic and fitted traffic through a discriminator; The anomaly detection module (34) is used to detect abnormal patterns in the fitting residuals in real time based on the isolated forest algorithm, and to build a dynamic threshold monitoring system.

5. The IoT card traffic fitting system driven by a dynamic behavior model according to claim 1, characterized in that, The dynamic confidence region labeling unit (4) includes a Bayesian inference module (41), an out-of-distribution detection module (42), a dynamic confidence interval calculation module (43), and a visualization labeling module (44), wherein: The Bayesian inference module (41) is used to estimate model uncertainty using Monte Carlo techniques and construct the posterior distribution: ， in, Indicates that given input data and training dataset Under the condition of output The posterior probability distribution, Represents the output variables of the model. For model parameters, For training data, Indicates the integral symbol, Indicates that given input and model parameters Under the condition of output The likelihood probability distribution describes the relationship between model parameters and output. The out-of-distribution detection module (42) is used to identify out-of-distribution samples based on Mahalanobis distance to measure the degree of deviation between the samples and the training distribution. ， In the formula, Indicates sample Mahalanobis distance, This represents the feature vector of the sample to be detected. It is the mean vector. This represents the matrix transpose operation, which converts the deviation vector from a column vector to a row vector to satisfy the requirements of matrix multiplication. This represents the inverse of the covariance matrix Σ, used to eliminate the influence of the correlation between features on distance calculation; The dynamic confidence interval calculation module (43) is used to calculate the prediction interval based on quantile regression: ， in, Quantile level, These are the quantile regression coefficients. Indicates at the quantile level The predicted value below, This represents the input feature vector. This represents the matrix transpose operation, which transforms the eigenvectors... Convert a column vector to a row vector; The visualization annotation module (44) is used to visualize the confidence distribution using a heatmap and to represent the degree of uncertainty through color mapping.

6. The IoT card traffic fitting system driven by a dynamic behavior model according to claim 1, characterized in that, The adaptive traffic prediction unit (5) includes a reinforcement learning control module (51), a meta-learning module (52), a transfer learning module (53), and a risk warning module (54), wherein: The reinforcement learning control module (51) is used to construct a policy gradient-based reinforcement learning framework and dynamically adjust the model hyperparameters: ， in, The optimal policy function is used to determine the optimal policy function for a given state. Choose the optimal action The probability distribution, For the policy function, For cumulative rewards; The meta-learning module (52) is used to quickly adapt to new device traffic patterns based on model-independent meta-learning; The transfer learning module (53) is used to reduce cross-device traffic prediction bias and minimize domain differences by employing domain adaptation techniques; The risk warning module (54) is used to calculate the peak flow probability based on extreme value theory and construct a risk assessment model: ， In the formula, Represents the distribution function of the maximum value. This represents a maximum value, emphasizing that the distribution function targets the peak data in the flow sequence. The distribution function representing the raw flow data. Indicates sample size. Represents an exponential function. For position parameters, For scale parameters, For shape parameters.

7. The IoT card traffic fitting system driven by a dynamic behavior model according to claim 4, characterized in that, The multimodal flow fitting unit (3) further includes a federated learning module (35), an edge computing optimization module (36), and a causal inference module (37), wherein: The federated learning module (35) is used to implement cross-domain traffic data collaborative modeling using a federated learning framework to protect user privacy; The edge computing optimization module (36) is used to deploy lightweight models at edge nodes and compress model parameters through knowledge distillation; The causal inference module (37) is used to analyze the causal relationship between behavioral characteristics and traffic consumption based on the causal graph model and identify key influencing factors.

8. The IoT card traffic fitting system driven by a dynamic behavior model according to claim 5, characterized in that, The dynamic confidence region labeling unit (4) further includes an online learning module (45), a multi-granularity confidence interval module (46), and a counterfactual reasoning module (47), wherein: The online learning module (45) is used to adjust the confidence interval calculation method in real time based on the concept drift detection technology to adapt to non-stationary flow changes; The multi-granularity confidence interval module (46) is used to simultaneously provide point estimates, interval estimates and distribution estimates to construct a multi-granularity prediction system; The counterfactual reasoning module (47) is used to evaluate traffic changes under different behavioral strategies based on counterfactual analysis.

9. The IoT card traffic fitting system driven by a dynamic behavior model according to claim 8, characterized in that, The adaptive traffic prediction unit (5) further includes a multi-step prediction module (55), a resource optimization allocation module (56), and an uncertainty-aware prediction module (57), wherein: The multi-step prediction module (55) is used to implement multi-step flow prediction based on the encoder-decoder architecture and uses an attention mechanism to capture long sequence dependencies; The resource optimization and allocation module (56) is used to construct a resource allocation optimization model based on the prediction results to maximize network resource utilization. ， In the formula, This represents the objective function, which is to maximize the total utility of all devices. For utility function, In order to allocate resources, For total resources, Indicates the total number of devices. Index representing the device; The uncertainty perception and prediction module (57) is used to output a complete description containing the prediction distribution and quantify the prediction uncertainty.

Images