Rail transit field operation and maintenance data security assessment method

Abstract

The invention relates to the technical field of rail transit operation and maintenance data safety assessment, in particular to a rail transit field operation and maintenance data safety assessment method. The problems of data splitting, static threshold limitation and insufficient depth verification in traditional evaluation are solved. The method comprises the following steps: acquiring a real-time operation and maintenance comprehensive data set based on a multi-source data acquisition system; performing continuous fluctuation screening processing to obtain a screening result; and generating an operation and maintenance data security monitoring result. According to the method, through dynamic threshold adjustment and cross-module collaborative verification, in combination with multi-level correlation analysis and real-time scene data cross comparison, the data tampering identification precision and the anomaly detection capability are improved, and full-process automatic management and control are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of rail transit operation and maintenance data security management, in particular to a rail transit field section operation and maintenance data security evaluation method. BACKGROUND

[0002] With the intelligent and digital transformation of the rail transit industry, the amount of field section operation and maintenance data is growing explosively, covering multi-dimensional data such as vehicle vibration, traction motor current, personnel operation trajectory, and equipment communication log. There are some core problems in current operation and maintenance data security evaluation that need to be solved. Data fragmentation processing is characterized by independent analysis of vehicle mechanical data (such as vibration and wheel-rail adhesion state), electrical data (such as motor current), and personnel control data (such as forbidden zone approach behavior), without establishing a security correlation logic across types of data, which may lead to insufficient identification of potential data tampering or abnormal conduction risks. The limitations of static threshold are reflected in the fact that traditional evaluation relies on fixed threshold to determine data security (such as vibration amplitude exceeding threshold to determine abnormality), which is not adaptive to data fluctuations in dynamic conditions such as rain and snow, and may lead to misjudgment or missed judgment. The problem of lack of deep verification mechanism is that the evaluation of the authenticity and integrity of operation and maintenance data is mostly limited to surface checking (such as data format compliance), without building a multi-level cross-verification model combining historical data and real-time scenarios, making it difficult to detect hidden data tampering or abnormal injection. In addition, the risk warning lag is also a shortcoming of existing systems, which is mostly passive after the occurrence of data security incidents, lacks the ability to predict based on data trends, and is difficult to block the risk conduction path in advance. To solve the above problems, the present application proposes an operation and maintenance data security evaluation method that integrates multi-source data collection, deep learning analysis, dynamic threshold evolution, and cross-module collaborative verification, realizing the whole process of safety control from data collection to risk warning. SUMMARY

[0003] In view of the deficiencies of the prior art, the present application provides a rail transit field section operation and maintenance data security evaluation method based on multi-source data fusion, which solves the problems of data fragmentation, static threshold limitations, lack of deep verification, and risk warning lag in traditional evaluation through multi-level correlation analysis and dynamic verification of equipment operation, personnel operation, and environmental condition data.

[0004] To achieve the above purpose, the present application provides a rail transit field section operation and maintenance data security evaluation method based on multi-source data fusion, comprising: S1, obtaining real-time operation and maintenance data based on a multi-source data collection system, and performing data filtering to obtain a real-time operation and maintenance data set; S2, performing continuity fluctuation screening processing according to the real-time operation and maintenance data set to obtain a continuity fluctuation screening result of the real-time operation and maintenance data; S3, generating operation and maintenance data security monitoring results by using the continuity fluctuation screening results.

[0005] Preferably, the real-time operation and maintenance comprehensive data set is obtained by filtering and processing real-time operation and maintenance data based on a multi-source data acquisition system, and the real-time operation and maintenance comprehensive data set comprises: S1-1, obtaining equipment operation data, personnel operation data and environmental working condition data as real-time operation and maintenance data based on a multi-source data acquisition system; S1-2, obtaining operation parameters of the corresponding multi-source data acquisition system according to the real-time operation and maintenance data; S1-3, calculating an output signal-to-noise ratio value according to the operation parameters of the multi-source data acquisition system; S1-4, using the operation parameters of the multi-source data acquisition system as auxiliary feature labels of the real-time operation and maintenance data; S1-5, using the output signal-to-noise ratio value as an interference feature label of the real-time operation and maintenance data; S1-6, using the real-time operation and maintenance data, the auxiliary feature labels and the interference feature labels of the real-time operation and maintenance data as the real-time operation and maintenance comprehensive data set; wherein the operation parameters of the multi-source data acquisition system comprise a sampling frequency, a data transmission rate and an equipment operation state.

[0006] Further, the continuity fluctuation screening result of the real-time operation and maintenance data is obtained by performing continuity fluctuation screening processing on the real-time operation and maintenance comprehensive data set, and the continuity fluctuation screening result comprises: S2-1, performing data cleaning on the real-time operation and maintenance comprehensive data set to obtain a real-time operation and maintenance improved data set; S2-2, establishing a continuous time period operation and maintenance improved data set by using the real-time operation and maintenance improved data set; S2-3, obtaining the continuity fluctuation screening result of the real-time operation and maintenance data by performing continuity fluctuation screening processing on the continuous time period operation and maintenance improved data set.

[0007] Further, the real-time operation and maintenance improved data set is obtained by performing data cleaning on the real-time operation and maintenance comprehensive data set, and the data cleaning comprises: S2-1-1, performing data comprehensive processing on the real-time operation and maintenance data of the real-time operation and maintenance comprehensive data set based on a data preprocessing tool to obtain a real-time operation and maintenance initial improved data set; S2-1-2, determining whether the real-time operation and maintenance initial improved data set at the current time is consistent with the auxiliary feature labels of the real-time operation and maintenance comprehensive data set, if yes, directly executing S2-1-4, otherwise, executing S2-1-3; S2-1-3, determining whether the execution number of S2-1-2 at the current time is greater than 1, if yes, abandoning the processing, otherwise, returning to S2-1-1; S2-1-4, determine whether the interference feature labels of the real-time operation and maintenance initial improvement data set and the real-time operation and maintenance comprehensive data set at the current time are consistent, if yes, use the real-time operation and maintenance initial improvement data set as the real-time operation and maintenance improvement data set, otherwise, execute S2-1-5; S2-1-5, determine whether the execution times of S2-1-4 at the current time are greater than 1, if yes, discard the processing, otherwise, return to S2-1-1; wherein, the data comprehensive processing includes abnormal data elimination, data alignment processing and noise suppression processing.

[0008] Further, using the real-time operation and maintenance improvement data set to establish a continuous period operation and maintenance improvement data set includes: Using the corresponding time of the real-time operation and maintenance improvement data set as the standard median time t; Respectively acquiring the real-time operation and maintenance improvement data sets at t-1 time and t+1 time; Using the real-time operation and maintenance data of the real-time operation and maintenance improvement data sets at t-1 time, the standard median time t and t+1 time to establish a real-time operation and maintenance data change trend; Using the auxiliary feature labels of the real-time operation and maintenance improvement data sets at t-1 time, the standard median time t and t+1 time to establish an auxiliary feature label change trend; Using the interference feature labels of the real-time operation and maintenance improvement data sets at t-1 time, the standard median time t and t+1 time to establish an interference feature label change trend; Using the real-time operation and maintenance data change trend, the auxiliary feature label change trend and the interference feature label change trend as the continuous period operation and maintenance improvement data set.

[0009] Further, using the continuous period operation and maintenance improvement data set to perform continuous fluctuation screening processing to obtain a continuous fluctuation screening result of the real-time operation and maintenance data includes: S2-3-1, determine whether the real-time operation and maintenance data change trend and the auxiliary feature label change trend of the continuous period operation and maintenance improvement data set from t-1 time to the standard median time t are consistent, if yes, execute S2-3-2, otherwise, return to S2-1-1; S2-3-2, determine whether the auxiliary feature label change trend and the interference feature label of the continuous period operation and maintenance improvement data set from t-1 time to the standard median time t are consistent, if yes, execute S2-3-3, otherwise, return to S1-2; S2-3-3, determine whether the real-time operation and maintenance data change trend and the auxiliary feature label change trend of the continuous period operation and maintenance improvement data set from the standard median time t to t+1 time are consistent, if yes, execute S2-3-4, otherwise, return to S2-1-1; S2-3-4, judging whether the variation trend of the auxiliary feature label of the continuous period operation and maintenance improvement data set at the standard median time t to t+1 time is consistent with the interference feature label, if yes, the current continuous period operation and maintenance improvement data set is retained, the continuity fluctuation screening processing result is normal, otherwise, the current continuous period operation and maintenance improvement data set is retained, and the continuity fluctuation screening processing result is abnormal.

[0010] Further, the operation and maintenance data security monitoring result is generated by using the continuity fluctuation screening result, including: S3-1, establishing a correlation analysis model of real-time operation and maintenance data according to real-time operation and maintenance data; S3-2, comparing the correlation analysis model with the continuity fluctuation screening result to obtain feature flag data of real-time operation and maintenance data; S3-3, generating operation and maintenance data security monitoring result by using the feature flag data of real-time operation and maintenance data.

[0011] Further, the correlation analysis model of real-time operation and maintenance data is established according to real-time operation and maintenance data, including: An initial correlation model is established based on a historical data storage library according to standard median time t by using real-time operation and maintenance data; A derived event set is obtained according to the initial correlation model in sequence to correspond to subsequent correlation events; A derived time set is obtained according to the derived event set to correspond to event generation time; The initial correlation model, the derived event set and the derived time set are used as the correlation analysis model of real-time operation and maintenance data.

[0012] Further, the correlation analysis model is compared with the continuity fluctuation screening result to obtain feature flag data of real-time operation and maintenance data, including: S3-2-1, judging whether the continuity fluctuation screening result is normal, if yes, executing S3-2-2, otherwise, using the derived time set of the correlation analysis model to obtain a subset of the derived event set corresponding to t+1 time as an initial comparison label according to the continuity fluctuation screening result, and directly executing S3-2-3; S3-2-2, judging whether the continuity fluctuation screening result corresponding to the continuous period operation and maintenance improvement data set and the initial correlation model of the correlation analysis model are consistent, if yes, using the continuity fluctuation screening result corresponding to the real-time operation and maintenance improvement data set and the correlation analysis model as the feature flag data of real-time operation and maintenance data, otherwise, using the initial correlation model with inconsistent trend as the feature flag data of real-time operation and maintenance data; S3-2-3, judging whether the initial comparison label is consistent with the real-time operation and maintenance data at the t+1 moment, if yes, using the continuity fluctuation screening result corresponding to the real-time operation and maintenance improvement data set and the correlation analysis model as the characteristic label data of the real-time operation and maintenance data, otherwise, using the initial comparison label as the characteristic label data of the real-time operation and maintenance data; wherein, the trend consistency is that the data content change of the continuous period operation and maintenance improvement data set and the initial correlation model correspond to each other.

[0013] Further, generating the operation and maintenance data security monitoring result by using the characteristic label data of the real-time operation and maintenance data comprises: S3-3-1, judging whether the characteristic label data of the real-time operation and maintenance data exists the real-time operation and maintenance improvement data set and the correlation analysis model, if yes, the operation and maintenance data security monitoring result is normal output, and the current real-time operation and maintenance improvement data set and the correlation analysis model are retained, otherwise, S3-3-2 is executed; S3-3-2, judging whether the characteristic label data of the real-time operation and maintenance data corresponds to the initial correlation model of inconsistent trend, if yes, the operation and maintenance data security monitoring result is abnormal output, and the current initial correlation model of inconsistent trend is used as an abnormal label, otherwise, the initial comparison label corresponding to the initial correlation model is used as an abnormal label.

[0014] Compared with the closest prior art, the present application has the beneficial effects: An effective and reliable multi-source data fusion mechanism is established, and dynamic threshold adjustment and cross-module collaborative verification are combined to solve the problems of data fragmentation, static threshold limitations and insufficient deep verification in traditional evaluation methods. Through multi-level correlation analysis and cross comparison of real-time scene data, the data tampering identification accuracy and abnormal data detection capability are improved, and the whole process automation control from data collection to risk warning is realized. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 is a flowchart of a rail transit field operation and maintenance data security evaluation method provided by the present application. DETAILED DESCRIPTION

[0016] The specific embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0017] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be described clearly and completely below with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0018] Embodiment 1: The application provides a rail transit field section operation and maintenance data security evaluation method, as shown in the method, comprising: Figure 1 S1, obtaining real-time operation and maintenance data based on a multi-source data acquisition system to perform data filtering processing to obtain a real-time operation and maintenance comprehensive data set; S2, performing continuity fluctuation screening processing on the real-time operation and maintenance comprehensive data set to obtain a continuity fluctuation screening result of the real-time operation and maintenance data; S3, generating an operation and maintenance data security monitoring result by using the continuity fluctuation screening result. S1 specifically comprises:

[0019] S1-1, obtaining equipment operation data, personnel operation data and environmental working condition data as real-time operation and maintenance data based on a multi-source data acquisition system; S1-2, obtaining operation parameters of the corresponding multi-source data acquisition system according to the real-time operation and maintenance data; S1-3, calculating an output signal-to-noise ratio value according to the operation parameters of the multi-source data acquisition system; S1-4, using the operation parameters of the multi-source data acquisition system as auxiliary feature labels of the real-time operation and maintenance data; S1-5, using the output signal-to-noise ratio value as an interference feature label of the real-time operation and maintenance data; S1-6, using the real-time operation and maintenance data, the auxiliary feature labels and the interference feature labels of the real-time operation and maintenance data as the real-time operation and maintenance comprehensive data set; Wherein, the operation parameters of the multi-source data acquisition system include sampling frequency, data transmission rate and equipment operation state.

[0020] S2 specifically comprises: S2-1, performing data cleaning on the real-time operation and maintenance comprehensive data set to obtain a real-time operation and maintenance improved data set; S2-2, establishing a continuous time period operation and maintenance improved data set by using the real-time operation and maintenance improved data set; S2-3, performing continuity fluctuation screening processing on the continuous time period operation and maintenance improved data set to obtain the continuity fluctuation screening result of the real-time operation and maintenance data.

[0021] S2-1 specifically comprises: S2-1-1, performing data comprehensive processing on the real-time operation and maintenance data of the real-time operation and maintenance comprehensive data set based on a data preprocessing tool to obtain a real-time operation and maintenance initial improved data set; S2-1-2, judging whether the real-time operation and maintenance initial improved data set at the current time and the auxiliary feature labels of the real-time operation and maintenance comprehensive data set are consistent, if yes, directly executing S2-1-4, otherwise, executing S2-1-3; ​S2-1-3, judges whether the execution times of the current time S2-1-2 are greater than 1, if yes, the processing is abandoned, otherwise, returns to S2-1-1; S2-1-4, judges whether the interference feature labels of the real-time operation and maintenance initial improvement data set and the real-time operation and maintenance comprehensive data set at the current time are consistent, if yes, the real-time operation and maintenance initial improvement data set is used as the real-time operation and maintenance improvement data set, otherwise, S2-1-5 is executed; S2-1-5, judges whether the execution times of the current time S2-1-4 are greater than 1, if yes, the processing is abandoned, otherwise, returns to S2-1-1; Among them, the data comprehensive processing includes abnormal data elimination, data alignment processing and noise suppression processing.

[0022] S2-2 specifically includes: S2-2-1, using the real-time operation and maintenance improvement data set corresponding time as the standard median time t; S2-2-2, respectively acquiring the real-time operation and maintenance improvement data set at t-1 time and t+1 time; S2-2-3, using the real-time operation and maintenance data of the real-time operation and maintenance improvement data set at t-1 time, standard median time t and t+1 time to establish the real-time operation and maintenance data change trend; S2-2-4, using the auxiliary feature labels of the real-time operation and maintenance improvement data set at t-1 time, standard median time t and t+1 time to establish the auxiliary feature label change trend; S2-2-5, using the interference feature labels of the real-time operation and maintenance improvement data set at t-1 time, standard median time t and t+1 time to establish the interference feature label change trend; S2-2-6, using the real-time operation and maintenance data change trend, the auxiliary feature label change trend and the interference feature label change trend as the continuous period operation and maintenance improvement data set.

[0023] S2-3 specifically includes: S2-3-1, judges whether the real-time operation and maintenance data change trend and the auxiliary feature label change trend of the continuous period operation and maintenance improvement data set from t-1 time to the standard median time t are consistent, if yes, S2-3-2 is executed, otherwise, returns to S2-1-1; S2-3-2, judges whether the auxiliary feature label change trend and the interference feature label of the continuous period operation and maintenance improvement data set from t-1 time to the standard median time t are consistent, if yes, S2-3-3 is executed, otherwise, returns to S1-2; S2-3-3, judges whether the real-time operation and maintenance data change trend and the auxiliary feature label change trend of the continuous period operation and maintenance improvement data set from the standard median time t to t+1 time are consistent, if yes, S2-3-4 is executed, otherwise, returns to S2-1-1; S2-3-4, judging whether the variation trend of the auxiliary feature label of the continuous period operation and maintenance improvement data set at the standard mid-time t to t+1 time is consistent with the interference feature label, if yes, the current continuous period operation and maintenance improvement data set is retained, the continuity fluctuation screening processing result is normal, otherwise, the current continuous period operation and maintenance improvement data set is retained, and the continuity fluctuation screening processing result is abnormal.

[0024] S3 specifically comprises: S3-1, establishing a correlation analysis model of real-time operation and maintenance data according to the real-time operation and maintenance data; S3-2, comparing the correlation analysis model with the continuity fluctuation screening result to obtain feature flag data of the real-time operation and maintenance data; S3-3, generating an operation and maintenance data security monitoring result by using the feature flag data of the real-time operation and maintenance data.

[0025] S3-1 specifically comprises: S3-1-1, establishing an initial correlation model based on the historical data storage according to the standard mid-time t by using the real-time operation and maintenance data; S3-1-2, sequentially obtaining a corresponding subsequent correlation event to establish a derived event set according to the initial correlation model; S3-1-3, establishing a derived time set according to the corresponding event generation time of the derived event set; S3-1-4, using the initial correlation model, the derived event set and the derived time set as the correlation analysis model of the real-time operation and maintenance data.

[0026] S3-2 specifically comprises: S3-2-1, judging whether the continuity fluctuation screening result is normal, if yes, executing S3-2-2, otherwise, using the derived time set of the correlation analysis model to obtain a corresponding subset of the derived event set as an initial comparison label according to the continuity fluctuation screening result corresponding to t+1 time, and directly executing S3-2-3; S3-2-2, judging whether the continuity fluctuation screening result corresponding to the continuous period operation and maintenance improvement data set and the initial correlation model of the correlation analysis model are consistent, if yes, using the continuity fluctuation screening result corresponding to the real-time operation and maintenance improvement data set and the correlation analysis model as the feature flag data of the real-time operation and maintenance data, otherwise, using the initial correlation model with inconsistent trend as the feature flag data of the real-time operation and maintenance data; S3-2-3, judging whether the initial comparison label is consistent with the real-time operation and maintenance data at t+1 time, if yes, using the continuity fluctuation screening result corresponding to the real-time operation and maintenance improvement data set and the correlation analysis model as the feature flag data of the real-time operation and maintenance data, otherwise, using the initial comparison label as the feature flag data of the real-time operation and maintenance data; The consistent trend is that the data content change of the continuous time period operation improvement data set and the initial associated model corresponds to the data change moment.

[0027] S3-3 specifically comprises: S3-3-1, judging whether the feature flag data of the real-time operation data exists in the real-time operation improvement data set and the associated analysis model, if yes, the operation data safety monitoring result is normal output, and the current real-time operation improvement data set and the associated analysis model are retained, otherwise, S3-3-2 is executed; S3-3-2, judging whether the feature flag data of the real-time operation data corresponds to the initial associated model of inconsistent trend, if yes, the operation data safety monitoring result is abnormal output, and the initial associated model of inconsistent trend is used as an abnormal label, otherwise, the initial associated model corresponding to the initial comparison label is used as an abnormal label.

[0028] In practical application, the present application firstly obtains equipment operation data, personnel operation data and environment working condition data as real-time operation data through a multi-source data acquisition system 1. The multi-source data acquisition system 1 is a basic module of the whole process, which realizes real-time data acquisition through connection with multiple sensors, monitoring equipment and operation terminals. These sensors and terminals are respectively installed at different positions of the rail transit field section, such as the track along the line, the station control room and the equipment room, to ensure comprehensive data sources. The operation parameters of the multi-source data acquisition system 1 include sampling frequency, data transmission rate and equipment operation state, which directly affect the quality and real-time performance of the collected data. In order to ensure the reliability of the data, the signal-to-noise ratio value is calculated according to the operation parameters during the acquisition process, and the value is attached to the real-time operation data as an interference feature label. In addition, the operation parameters of the multi-source data acquisition system 1 itself also serve as auxiliary feature labels for verification and screening in subsequent data processing steps.

[0029] After completing data acquisition, the real-time operation data is sent to a data filtering processing module to generate a real-time operation comprehensive data set 2 after preliminary processing. This process includes multiple sub-steps. First, the data preprocessing tool is used to remove abnormal data, align data and suppress noise from the real-time operation data, thereby obtaining a real-time operation initial improvement data set. Subsequently, by comparing the auxiliary feature labels and interference feature labels of the current moment real-time operation initial improvement data set and the real-time operation comprehensive data set 2, the consistency of the data is judged. If the consistency check fails, it is returned to reprocessing until the condition is met or the maximum processing number limit is reached. This process ensures that the data in the real-time operation comprehensive data set 2 has high accuracy and integrity, laying a foundation for subsequent analysis.

[0030] Next, based on the real-time operation comprehensive data set 2, a continuity fluctuation screening process is performed to generate a continuity fluctuation screening result 3. The core of this step is to establish a continuous time period operation improvement data set and perform fluctuation analysis. Specifically, first, with the standard median time t as the center, the real-time operation improvement data sets at t-1 and t+1 are obtained respectively. Then, using the data at these three time points, real-time operation data change trend, auxiliary feature label change trend and interference feature label change trend are constructed to form a continuous time period operation improvement data set. On this basis, a series of logical judgments are used to screen out fluctuation abnormal data. For example, it is judged whether the real-time operation data change trend from t-1 to the standard median time t is consistent with the auxiliary feature label change trend. If it is consistent, it is further judged whether the auxiliary feature label change trend matches the interference feature label. Otherwise, it is returned for reprocessing. Similarly, the same logical judgment is also required for the data from the standard median time t to t+1. Finally, according to the screening result, the continuity fluctuation screening result 3 is marked as normal or abnormal.

[0031] After completing the continuity fluctuation screening, the generation phase of the operation data security monitoring result 4 is entered. The key of this phase is to use the correlation analysis model 5 to compare and process the continuity fluctuation screening result 3, and extract the feature label data of the real-time operation data. The construction of the correlation analysis model 5 is based on the historical data repository. The initial correlation model is established by the historical data at the standard median time t, and the derived event set and derived time set are further expanded. In the comparison process, it is first judged whether the continuity fluctuation screening result 3 is normal. If it is normal, the trend consistency of the continuous time period operation improvement data set and the initial correlation model is directly compared. If it is abnormal, the derived event subset corresponding to t+1 time is obtained from the derived time set as the initial comparison label, and the initial comparison label and the real-time operation data at t+1 time are further compared. Finally, the feature label data of the real-time operation data is generated according to the comparison result.

[0032] Finally, the operation data security monitoring result 4 is generated based on the feature label data. This process includes two steps of logical judgment. First, it is judged whether there is a matching condition between the real-time operation improvement data set and the correlation analysis model 5 in the feature label data. If there is a match, it is determined that the operation data security monitoring result 4 is a normal output, and the current real-time operation improvement data set and the correlation analysis model 5 are retained; otherwise, the next step is entered. Second, it is judged whether the feature label data corresponds to the initial correlation model with inconsistent trend. If it corresponds, it is determined that the operation data security monitoring result 4 is an abnormal output, and the current initial correlation model with inconsistent trend is recorded as an abnormal label; if it does not correspond, the initial correlation model corresponding to the initial comparison label is used as an abnormal label.

[0033] The above steps realize the safety evaluation of the rail transit field operation and maintenance data through the cooperation of the multi-source data acquisition system 1, the real-time operation and maintenance comprehensive data set 2, the continuity fluctuation screening result 3, the operation and maintenance data safety monitoring result 4, and the correlation analysis model 5. The multi-source data acquisition system 1 is responsible for comprehensive data acquisition, the real-time operation and maintenance comprehensive data set 2 ensures the accuracy and integrity of the data, the continuity fluctuation screening result 3 realizes fine analysis of the data volatility, and the correlation analysis model 5 improves the abnormal detection capability through deep mining of historical data. The modules are closely connected through data flow and logical judgment, and together form a complete closed-loop evaluation system.

[0034] In order to better enable relevant persons in the art to fully understand and implement the present application, the specific implementation principles of the present application are further supplemented below in conjunction with a specific application scenario.

[0035] In the actual operation and maintenance scenario of the rail transit field, assuming that a certain metro vehicle depot is conducting daily operation and maintenance, the system needs to collect and evaluate real-time data such as vehicle vibration data, traction motor current data, and personnel operation trajectory from multiple sources. First, through multiple sensors and monitoring devices in the multi-source data acquisition system 1, real-time data is obtained from vibration sensors along the track, current monitoring modules of traction motors, and personnel positioning terminals. These devices operate at a preset sampling frequency and transmission rate to ensure that data can be quickly synchronized and uploaded to the system. At the same time, the system calculates the signal-to-noise ratio value based on the device operating state and adds this value as a disturbance feature label to the real-time operation and maintenance data to identify potential noise interference. In addition, the operating parameters of the multi-source data acquisition system, such as sampling frequency and transmission rate, are also recorded as auxiliary feature labels for subsequent data verification and screening.

[0036] Subsequently, the real-time operation and maintenance data is sent to the data filtering processing module to generate the real-time operation and maintenance comprehensive data set 2. In this process, the system uses data preprocessing tools to perform abnormal data elimination, data alignment processing, and noise suppression processing on the original data, thereby obtaining a preliminary improved data set. For example, for the traction motor current data at a certain time, if its amplitude exceeds the normal range and does not match the historical data trend, it will be marked as abnormal data and eliminated. At the same time, the system performs consistency checking on the auxiliary feature labels and disturbance feature labels of the real-time operation and maintenance initial improved data set and the real-time operation and maintenance comprehensive data set 2. If the checking fails, the data cleaning step is re-executed until the conditions are met or the maximum processing number limit is reached. This process ensures that the data in the real-time operation and maintenance comprehensive data set 2 has high accuracy and integrity, providing a reliable foundation for subsequent analysis.

[0037] Next, based on the real-time operation comprehensive dataset 2, the system performs continuity fluctuation screening processing to generate continuity fluctuation screening results 3. Specifically, the system takes the standard median time t as the center, respectively obtains the real-time operation improvement datasets at t-1 and t+1 time, and uses the data at the three time points to construct real-time operation data change trend, auxiliary feature label change trend and interference feature label change trend. For example, when analyzing the vibration data of a certain track section, if it is found that the vibration amplitude change trend from t-1 time to the standard median time t is consistent with the auxiliary feature label change trend, but the auxiliary feature label change trend does not match the interference feature label, the system will return to reprocess. Similarly, the system also needs to perform the same logical judgment on the data from the standard median time t to t+1 time. Finally, according to the screening results, the continuity fluctuation screening results 3 are marked as normal or abnormal. For example, if the vibration data fluctuation amplitude of a certain time point deviates significantly from the historical mean value, and cannot pass the consistency check, the data will be marked as abnormal.

[0038] After completing the continuity fluctuation screening, the system enters the generation stage of the operation data safety monitoring results 4. The key of this stage is to use the correlation analysis model 5 to compare the continuity fluctuation screening results 3. The correlation analysis model 5 is based on the historical data repository to construct an initial correlation model, and further expands the derived event set and the derived time set. For example, when the continuity fluctuation screening results 3 are normal, the system directly compares the trend consistency of the continuous period operation improvement dataset and the initial correlation model. If the trend is consistent, it is determined that the data is normal; otherwise, use the initial correlation model with inconsistent trend as an abnormal label. If the continuity fluctuation screening results 3 are abnormal, the system uses the derived time set to obtain the derived event subset at t+1 time as the initial comparison label, and further compares the initial comparison label with the real-time operation data at t+1 time. Finally, according to the comparison results, the feature label data of the real-time operation data is generated. For example, if the traction motor current data at a certain time point deviates significantly from the historical data trend, and cannot pass the comparison, the data will be marked as abnormal.

[0039] Finally, the operation and maintenance data security monitoring result 4 is generated based on the feature flag data. The system first determines whether there is a match between the real-time operation and maintenance improvement data set and the correlation analysis model 5 in the feature flag data. If there is a match, it is determined that the operation and maintenance data security monitoring result 4 is a normal output, and the current real-time operation and maintenance improvement data set and the correlation analysis model 5 are retained; otherwise, it is further determined whether the feature flag data corresponds to an initial correlation model with inconsistent trends. If it corresponds, it is determined that the operation and maintenance data security monitoring result 4 is an abnormal output, and the current initial correlation model with inconsistent trends is recorded as an abnormal label; if it does not correspond, the initial correlation model corresponding to the initial comparison label is used as an abnormal label. For example, in a certain actual scenario, the system detects that the vibration data of a certain track section has a significant deviation from the historical data trend, and cannot be compared by the correlation analysis model, so the data is marked as abnormal and triggers a risk warning mechanism.

[0040] The above steps realize the safety evaluation of the rail transit section operation and maintenance data through the cooperation of the multi-source data acquisition system 1, the real-time operation and maintenance comprehensive data set 2, the continuity fluctuation screening result 3, the operation and maintenance data security monitoring result 4, and the correlation analysis model 5. The modules are closely connected through data flow and logical judgment, and together form a complete closed-loop evaluation system. For example, in a certain rain and snow weather scenario, the system can dynamically adjust the threshold range of the vibration data according to the real-time environmental working condition data, avoiding false positives caused by fixed thresholds. At the same time, through deep mining of historical data and cross comparison of real-time scene data, the system can effectively identify hidden data tampering behavior or abnormal injection, thereby improving the data tampering identification accuracy and abnormal data detection capability. In addition, the system can also make a preliminary judgment based on the data trend before the data anomaly occurs, block the risk transmission path in advance, and realize the full-process automatic control from data acquisition to risk warning.

[0041] Those skilled in the art will appreciate that embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0042] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0043] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0044] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0045] Finally, it should be noted that the above-mentioned embodiments are merely used to illustrate the technical solutions of the present application, but are not intended to limit the present application. Although the present application has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that the specific embodiments of the present application can be modified or replaced, and any modification or replacement without departing from the spirit and scope of the present application should be covered within the protection scope of the claims of the present application.

Claims

1. A method for security assessment of rail transit depot operation and maintenance data, characterized in that, include: S1. Obtain real-time operation and maintenance data from a multi-source data acquisition system and perform data filtering to obtain a comprehensive real-time operation and maintenance dataset. S2. Perform continuous fluctuation filtering on the real-time operation and maintenance comprehensive dataset to obtain the continuous fluctuation filtering results of the real-time operation and maintenance data. S3. Utilize the continuous fluctuation screening results to generate operation and maintenance data security monitoring results.

2. The method for security assessment of rail transit depot operation and maintenance data as described in claim 1, characterized in that, The real-time operation and maintenance comprehensive dataset obtained by acquiring real-time operation and maintenance data through a multi-source data acquisition system and performing data filtering processing includes: S1-1. Acquire equipment operation data, personnel operation data, and environmental condition data based on a multi-source data acquisition system as real-time operation and maintenance data; S1-2. Obtain the operating parameters of the corresponding multi-source data acquisition system based on real-time operation and maintenance data; S1-3. Calculate the output signal-to-noise ratio value based on the operating parameters of the multi-source data acquisition system; S1-4. Use the operating parameters of the multi-source data acquisition system as auxiliary feature labels for real-time operation and maintenance data; S1-5. Use the output signal-to-noise ratio value as an interference feature label for real-time operation and maintenance data; S1-6. Use real-time operation and maintenance data, auxiliary feature labels and interference feature labels of real-time operation and maintenance data as a comprehensive real-time operation and maintenance dataset; The operating parameters of a multi-source data acquisition system include sampling frequency, data transmission rate, and equipment operating status.

3. The method for security assessment of rail transit depot operation and maintenance data as described in claim 2, characterized in that, The continuous fluctuation filtering results obtained by performing continuous fluctuation filtering on the real-time operation and maintenance comprehensive dataset include: S2-1. Use the real-time operation and maintenance comprehensive dataset to perform data cleaning to obtain the real-time operation and maintenance improvement dataset; S2-2. Establish a continuous time period operation and maintenance improvement dataset using the real-time operation and maintenance improvement dataset; S2-3. Continuous fluctuation filtering is performed on the continuous time period operation and maintenance improvement dataset to obtain the continuous fluctuation filtering results of real-time operation and maintenance data.

4. The method for security assessment of rail transit depot operation and maintenance data as described in claim 3, characterized in that, Data cleaning using the real-time operations and maintenance comprehensive dataset yielded a real-time operations and maintenance improvement dataset, which includes: S2-1-1. Using the real-time operation and maintenance data from the real-time operation and maintenance comprehensive dataset, the data is comprehensively processed based on the data preprocessing tool to obtain the initial improved dataset for real-time operation and maintenance. S2-1-2. Determine whether the auxiliary feature labels of the current real-time operation and maintenance initial improvement dataset and the real-time operation and maintenance comprehensive dataset are consistent. If they are, proceed directly to S2-1-4; otherwise, proceed to S2-1-3. S2-1-3. Determine if the number of times S2-1-2 has been executed at the current time is greater than 1. If yes, abandon the process; otherwise, return to S2-1-1. S2-1-4. Determine whether the interference feature labels of the current real-time operation and maintenance initial improvement dataset and the real-time operation and maintenance comprehensive dataset are consistent. If they are, use the real-time operation and maintenance initial improvement dataset as the real-time operation and maintenance improvement dataset. Otherwise, execute S2-1-5. S2-1-5. Determine if the number of times S2-1-4 has been executed at the current time is greater than 1. If yes, abandon the process; otherwise, return to S2-1-1. The comprehensive data processing includes outlier removal, data alignment, and noise suppression.

5. The method for security assessment of rail transit depot operation and maintenance data as described in claim 3, characterized in that, Building a continuous time-period operation and maintenance improvement dataset using a real-time operation and maintenance improvement dataset includes: The corresponding time of the improved dataset is used as the standard median time t, which is achieved through real-time operation and maintenance. Obtain the real-time operation and maintenance improvement datasets at time t-1 and t+1 respectively; Establish the real-time operation and maintenance data change trend using the real-time operation and maintenance improvement dataset at time t-1, standard median time t, and time t+1; By utilizing the auxiliary feature labels of the real-time operation and maintenance improvement dataset at time t-1, standard median time t, and time t+1, we can establish the trend of auxiliary feature label changes. By using the interference feature labels of the real-time operation and maintenance improvement dataset at time t-1, standard median time t, and time t+1, we can establish the trend of interference feature label changes. The real-time operation and maintenance data change trend, auxiliary feature label change trend, and interference feature label change trend are used as the operation and maintenance improvement dataset for continuous time periods.

6. The method for security assessment of rail transit depot operation and maintenance data as described in claim 3, characterized in that, The continuous fluctuation filtering results obtained by using the continuous time period operation and maintenance improvement dataset for continuous fluctuation filtering include: S2-3-1. Determine whether the real-time operation and maintenance data change trend of the operation and maintenance improvement dataset from time t-1 to the standard median time t is consistent with the auxiliary feature label change trend. If yes, execute S2-3-2; otherwise, return to S2-1-1. S2-3-2. Determine whether the trend of auxiliary feature labels in the continuous time period from time t-1 to the standard median time t is consistent with the trend of interference feature labels. If yes, execute S2-3-3; otherwise, return to S1-2. S2-3-3: Determine whether the real-time operation and maintenance data change trend of the operation and maintenance improvement dataset during the continuous period from the standard median time t to time t+1 is consistent with the auxiliary feature label change trend. If yes, execute S2-3-4; otherwise, return to S2-1-1. S2-3-4. Determine whether the trend of auxiliary feature labels in the continuous period of operation and maintenance improvement dataset from the median time t to t+1 is consistent with the trend of interference feature labels. If so, retain the current continuous period of operation and maintenance improvement dataset and the result of continuous fluctuation screening is normal. Otherwise, retain the current continuous period of operation and maintenance improvement dataset and the result of continuous fluctuation screening is abnormal.

7. The method for security assessment of rail transit depot operation and maintenance data as described in claim 1, characterized in that, The results of operation and maintenance data security monitoring generated by using continuous fluctuation screening results include: S3-1. Establish a correlation analysis model for real-time operation and maintenance data based on real-time operation and maintenance data; S3-2. The characteristic marker data of real-time operation and maintenance data is obtained by comparing the results of continuous fluctuation screening with the correlation analysis model. S3-3. Generate security monitoring results for operation and maintenance data using feature markers from real-time operation and maintenance data.

8. The method for security assessment of rail transit depot operation and maintenance data as described in claim 7, characterized in that, Establishing a correlation analysis model for real-time operation and maintenance data based on real-time operation and maintenance data includes: An initial correlation model is established based on a historical data repository using real-time operation and maintenance data and the standard median time t. Based on the initial association model, obtain the corresponding subsequent associated events to establish a set of derived events; Based on the derived event set, obtain the corresponding event generation time and establish a derived time set; The initial correlation model, the derived event set, and the derived time set are used as the correlation analysis model for real-time operation and maintenance data.

9. A method for security assessment of rail transit depot operation and maintenance data as described in claim 8, characterized in that, The characteristic marker data of real-time operation and maintenance data obtained by comparing the results with the continuous fluctuation screening results using the correlation analysis model include: S3-2-1. Determine whether the continuous fluctuation screening result is normal. If so, execute S3-2-2. Otherwise, use the derivative time set of the correlation analysis model to obtain the corresponding subset of the derivative event set at time t+1 corresponding to the continuous fluctuation screening result as the initial comparison label, and directly execute S3-2-3. S3-2-2 Determine whether the trend of the continuous fluctuation screening result corresponding to the continuous period operation and maintenance improvement dataset and the initial correlation model of the correlation analysis model are consistent. If so, use the continuous fluctuation screening result corresponding to the real-time operation and maintenance improvement dataset and the correlation analysis model as the feature label data of the real-time operation and maintenance data. Otherwise, use the initial correlation model with inconsistent trends as the feature label data of the real-time operation and maintenance data. S3-2-3. Determine whether the initial comparison label is consistent with the real-time operation and maintenance data at time t+1. If so, use the real-time operation and maintenance improvement dataset corresponding to the continuous fluctuation screening result and the correlation analysis model as the feature label data of the real-time operation and maintenance data. Otherwise, use the initial comparison label as the feature label data of the real-time operation and maintenance data. Among them, the consistent trend means that the changes in the data content of the continuous time period operation and maintenance improvement dataset and the initial correlation model correspond to each other with the time of data change.

10. The method for security assessment of rail transit depot operation and maintenance data as described in claim 9, characterized in that, The generation of operation and maintenance data security monitoring results using feature markers from real-time operation and maintenance data includes: S3-3-1. Determine whether the feature marker data of the real-time operation and maintenance data exists in the real-time operation and maintenance improvement dataset and correlation analysis model. If so, the operation and maintenance data security monitoring result is output normally, and the current real-time operation and maintenance improvement dataset and correlation analysis model are retained. Otherwise, execute S3-3-2. S3-3-2. Determine whether the feature marker data of the real-time operation and maintenance data corresponds to the initial association model with inconsistent trends. If so, the operation and maintenance data security monitoring result is an abnormal output, and the initial association model with inconsistent current trends is used as the abnormal label. Otherwise, the initial association model corresponding to the initial comparison label is used as the abnormal label.

Images