A method and system for multi-dimensional data flow monitoring and anomaly interception and protection

Abstract

This application relates to a method and system for monitoring and intercepting anomalies based on multi-dimensional data flow. The method includes: real-time access to multi-source data streams; standardization processing of the multi-source data to generate a standardized dataset; extraction of static statistical features based on the standardized dataset, calculation of dynamic cumulative probability fluctuation values, and output of a basic feature set; construction of a correlation graph model with feature dimensions as nodes and feature mutual information as edge weights based on the basic feature set; introduction of a multi-head attention mechanism to calculate the dynamic dependency strength matrix between features under different time windows; identification of abnormal correlation patterns by comparing the KL divergence between the normal sample dependency distribution and the real-time dependency distribution; appending abnormal correlation strength values ​​as new features to the basic feature set to generate a correlation enhancement feature set; dimensionality reduction and compression of the correlation enhancement feature set, optimization of clustering parameters to obtain abnormal data results; and execution of hierarchical alarms and dynamic interception strategies based on the abnormal results.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method and system for multi-dimensional data flow monitoring and anomaly interception protection. Background Technology

[0002] With the deepening of digital transformation, multi-source data flows in fields such as financial transactions, industrial IoT, and cybersecurity are experiencing explosive growth. Abnormal behaviors during the real-time data flow process (such as data leakage, malicious injection, and abnormal access) pose a serious threat to system stability and security.

[0003] Current mainstream solutions can be divided into three categories: rule-based methods, which judge anomalies by preset thresholds or expert rules, such as port filtering in network firewalls; methods based on single feature statistics, such as detecting outliers of numerical features through Z-score and IQR; and methods based on traditional machine learning, such as using clustering algorithms (K-means) or classification models (logistic regression) to identify abnormal patterns.

[0004] Regarding the aforementioned technologies, the inventors believe that existing technologies mostly rely on single numerical features or fixed combinations of features, ignoring the dynamic dependencies between features, making it difficult to identify complex correlation anomalies and inconvenient to use.

[0005] Based on this, this application provides a method and system for multi-dimensional data flow monitoring and anomaly interception and protection. Summary of the Invention

[0006] To address the shortcomings of existing technologies that rely heavily on single numerical features or fixed combinations of features, neglect dynamic dependencies between features, struggle to identify complex correlations and anomalies, and are inconvenient to use, this application provides a method and system for multi-dimensional data flow monitoring and anomaly interception and protection.

[0007] Firstly, this application provides a method for multi-dimensional data flow monitoring and anomaly interception and protection, which adopts the following technical solution: including:

[0008] Real-time access to multi-source data streams, cleaning and standardizing the multi-source data to generate standardized datasets;

[0009] Based on the standardized dataset, static statistical features are extracted, and dynamic cumulative probability fluctuation values ​​are calculated using the empirical cumulative distribution function. A basic feature set that integrates static features and dynamic fluctuation values ​​is then output.

[0010] Based on the basic feature set, a correlation graph model is constructed with feature dimensions as nodes and feature mutual information as edge weights. A multi-head attention mechanism is introduced to calculate the dynamic dependency strength matrix between features under different time windows. By comparing the KL divergence of the normal sample dependency distribution and the real-time dependency distribution, abnormal correlation patterns are identified. Abnormal correlation strength values ​​are added as new features to the basic feature set to generate a correlation enhancement feature set.

[0011] After dimensionality reduction and compression of the association enhancement feature set, the clustering parameters are optimized, and anomaly scores are generated by combining the clustering results, feature fluctuation values, and the abnormal association patterns to obtain the abnormal results of the data.

[0012] Based on the abnormal results, a tiered alerting and dynamic blocking strategy is implemented, and the parameters of the abnormal detection model and the associated dependency weights are adaptively updated.

[0013] Preferably, the real-time access to multi-source data streams, the cleaning and standardization of the multi-source data, and the generation of a standardized dataset include:

[0014] Multiple types of data streams are collected in parallel through a distributed data access interface to generate raw data streams with data source identifiers;

[0015] The original data stream is cleaned in real time using a sliding time window. Missing values ​​are filled with linear interpolation based on the features of nearby time points. Outliers exceeding the 3σ range are truncated and corrected. Data format errors are corrected by timestamp reordering and format validation. The cleaned structured dataset is output.

[0016] For the structured dataset, the Z-score standardization formula is used to map numerical features to the [-1,1] interval, and categorical features are converted into binary vectors using one-hot encoding. The collection times of multi-source data are aligned with unified timestamps to generate the standardized dataset containing feature names, timestamps and standardized values.

[0017] Preferably, the real-time access to multi-source data streams, the cleaning and standardization of the multi-source data, and the generation of a standardized dataset include:

[0018] The standardized dataset is divided into blocks according to a preset time window. Four types of statistical indicators are calculated for each feature dimension: central tendency feature, dispersion feature, distribution pattern feature and quantile feature, and integrated into a static feature tensor with a dimension of number of windows × number of features × 12.

[0019] For each feature dimension, an empirical cumulative distribution function with a sliding time window is constructed. By statistically analyzing the proportion of samples within the window that are not greater than the current feature value to the total number of samples, a distribution curve reflecting the data distribution pattern is formed.

[0020] An adaptive perturbation based on the moving average absolute deviation is applied, and dynamically adjusted small fluctuations are added to the eigenvalues. The difference in the area enclosed by the two cumulative distribution curves before and after the perturbation is compared.

[0021] The area difference is normalized to the 0-1 interval as the dynamic cumulative probability fluctuation value, forming a fluctuation value matrix with the dimension of window number × feature number;

[0022] The static feature tensor and the fluctuation value matrix are concatenated along the time window dimension. Principal component analysis is used to retain some information variance to compress the feature dimension, generating the basic feature set in which each feature contains multiple static indicators and one dynamic fluctuation value.

[0023] Preferably, the step involves constructing a correlation graph model based on the basic feature set, with feature dimensions as nodes and feature mutual information as edge weights. A multi-head attention mechanism is introduced to calculate the dynamic dependency strength matrix between features under different time windows. Abnormal correlation patterns are identified by comparing the KL divergence between the normal sample dependency distribution and the real-time dependency distribution. Abnormal correlation strength values ​​are added as new features to the basic feature set to generate a correlation enhancement feature set, including:

[0024] Based on the feature dimensions in the aforementioned basic feature set as nodes, an undirected weighted association graph model is constructed by calculating the mutual information value between any two features as edge weights, wherein the mutual information value is calculated through the KL divergence between the joint probability distribution and the marginal probability distribution.

[0025] Based on the topology of the aforementioned association graph model, a multi-head attention mechanism is introduced, taking the basic feature sets of different time windows as input, generating a QKV matrix through linear transformation, and calculating the attention weight distribution among features.

[0026] Based on the attention weight distribution, the dependency strength matrices output by each attention head are concatenated and linearly mapped to generate the dynamic dependency strength matrix that integrates multi-scale feature dependencies.

[0027] A normal dependency distribution model is constructed based on the dynamic dependency strength matrix of historical normal samples, and the distribution parameters are fitted using kernel density estimation.

[0028] The KL divergence between the dependency strength matrix of the current time window and the normal dependency distribution is calculated in real time. When the divergence value exceeds a preset threshold, it is marked as the abnormal association pattern.

[0029] Extract the preset number of feature pairs with the highest weight deviation from the abnormal association patterns, and calculate the corresponding abnormal values ​​of the association strength.

[0030] The correlation strength anomalies are added as new feature dimensions to the basic feature set. Through time window alignment and feature dimension expansion, the correlation enhancement feature set containing the original static features, the dynamic fluctuation values, and the correlation anomalies is generated.

[0031] Preferably, the topology structure based on the association graph model introduces a multi-head attention mechanism, taking the basic feature sets from different time windows as input, generating a QKV matrix through linear transformation, and calculating the attention weight distribution among features, including:

[0032] Based on the topology of the association graph model, the number of attention heads is set, and each attention head independently learns feature dependencies at different scales.

[0033] A linear transformation is performed on the basic feature sets for different time windows to generate the QKV matrix. The QKV matrix includes three sets of matrices: a query matrix, which represents the association requirements of each feature dimension in the current time window; a key matrix, which represents the attribute identifiers of each feature dimension and is used to match with the query matrix to calculate the association strength; and a value matrix, which represents the specific numerical information of each feature dimension, i.e. the feature content to be extracted after association matching.

[0034] Each attention head is controlled to calculate similarity by transposing the query matrix and the key matrix, and the numerical range is adjusted by a scaling factor;

[0035] Applying the Softmax function to the similarity results yields the attention weight distribution among each feature dimension. Higher weight values ​​indicate stronger dynamic dependencies between features.

[0036] The dependency strength matrices output by all attention heads are horizontally concatenated to form a fusion matrix containing multi-scale feature dependencies;

[0037] The fusion matrix is ​​reduced in dimensionality and information is integrated by a linear mapping layer to generate a dynamic dependency strength matrix with a unified dimension.

[0038] Preferably, after dimensionality reduction and compression of the association enhancement feature set, the clustering parameters are optimized, and anomaly scores are generated by combining the clustering results, feature fluctuation values, and the abnormal association patterns to obtain the data anomaly results, including:

[0039] Principal component analysis is used to reduce the dimensionality of the association enhancement feature set, retaining principal components whose cumulative variance contribution rate exceeds the threshold, and mapping high-dimensional features to low-dimensional space to reduce redundant information. The number of principal components is determined by the eigenvalue scree plot.

[0040] Based on the dimensionality-reduced feature data, the sum of squared clustering errors under different numbers of clusters is calculated, and the K value corresponding to the point of sudden change in error rate is selected as the optimal number of clusters. At the same time, the clustering quality is verified by the silhouette coefficient to ensure that the mean of the silhouette coefficient is greater than 0.6 to guarantee intra-cluster compactness and inter-cluster separation.

[0041] For each dimension of the original feature set, calculate the fluctuation value within the sliding window, and use the Z-score standardization method to quantify the degree of fluctuation. The formula is Z = (x - μ) / σ, where μ is the feature mean and σ is the standard deviation. Features with fluctuation values ​​exceeding 3 times the standard deviation are marked as significant fluctuation features.

[0042] The anomaly score is generated by weighted fusion of the clustering distance term, fluctuation contribution term, and association anomaly term. The clustering distance term is calculated by normalizing the Euclidean distance from each data point to the center of its cluster. The fluctuation contribution term is calculated by weighted summation of the absolute Z-score values ​​of the significant fluctuation features, with the weights dynamically allocated by the importance of the features. The association anomaly term is calculated by introducing the KL divergence value of the anomaly association pattern and amplifying the anomaly contribution by a factor of the deviation threshold.

[0043] An adaptive thresholding method is used to truncate the outlier scores. Data points exceeding the threshold are marked as outlier results, and the ranking of outlier feature contributions and the interpretation of association patterns are output.

[0044] Preferably, the step of executing a tiered alerting and dynamic blocking strategy based on the anomaly result, and adaptively updating the anomaly detection model parameters and correlation dependency weights, includes:

[0045] Based on the anomaly scores and the contribution ranking of the anomaly features, a three-level alarm threshold is set according to the standard deviation between the anomaly scores and the normal distribution, and the hierarchical alarm and dynamic interception strategy are executed.

[0046] An incremental learning framework is used to include abnormal samples within a preset time window into the training set;

[0047] The kernel function bandwidth parameter of the normal dependency distribution model is optimized using gradient descent.

[0048] Based on the deviation of feature pairs in the aforementioned abnormal association pattern, the initial weight matrix of the multi-head attention mechanism is dynamically adjusted.

[0049] Increase the weight ratio of the attention head allocation for high-frequency abnormal feature pairs, and decrease the weight for low-frequency normal feature pairs, while keeping the update cycle consistent with the time window.

[0050] Secondly, this application discloses a multi-dimensional data flow monitoring and anomaly interception and protection device, which adopts the following technical solution, including:

[0051] The data processing module is used to access multi-source data streams in real time, clean and standardize the multi-source data, and generate standardized datasets.

[0052] The basic feature module is used to extract static statistical features based on the standardized dataset, calculate dynamic cumulative probability fluctuation values ​​through the empirical cumulative distribution function, and output a basic feature set that integrates static features and dynamic fluctuation values.

[0053] The association enhancement module is used to construct an association graph model with feature dimensions as nodes and feature mutual information as edge weights based on the basic feature set. It introduces a multi-head attention mechanism to calculate the dynamic dependency strength matrix between features under different time windows. By comparing the KL divergence between the dependency distribution of normal samples and the real-time dependency distribution, it identifies abnormal association patterns and adds the abnormal values ​​of association strength as new features to the basic feature set to generate an association enhancement feature set.

[0054] The anomaly detection module is used to reduce and compress the association enhancement feature set, optimize the clustering parameters, and generate anomaly scores by combining the clustering results, feature fluctuation values, and the abnormal association patterns to obtain the abnormal results of the data.

[0055] The dynamic alarm module is used to execute hierarchical alarm and dynamic interception strategies based on the abnormal results, and adaptively update the abnormal detection model parameters and related dependency weights.

[0056] Thirdly, this application also provides a control device, the device comprising:

[0057] It includes a memory and a processor, wherein the memory stores a computer program that can be loaded and executed by the processor, such as the above-described method for monitoring and intercepting anomalies based on multi-dimensional data flow.

[0058] Fourthly, this application also provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed as described above regarding the multi-dimensional data flow monitoring and anomaly interception and protection method.

[0059] In summary, this application achieves real-time security protection for multi-source data through a systematic process. First, it accesses multi-source data streams in real time and performs cleaning and standardization processing to provide a high-quality data foundation for subsequent analysis. Next, it extracts static statistical features and dynamic cumulative probability fluctuation values, fusing them to form a basic feature set, achieving complementarity between static and dynamic features. Then, it constructs a correlation graph model with feature mutual information as weights, introduces a multi-head attention mechanism to calculate the dynamic dependency strength matrix, identifies abnormal correlation patterns through KL divergence comparison, and generates a correlation-enhancing feature set to strengthen the quantification of dependencies between features. Subsequently, it reduces and compresses the correlation-enhancing features, optimizes clustering parameters, and generates anomaly scores by combining clustering distance, feature fluctuation values, and abnormal correlation patterns. An adaptive threshold is used to obtain accurate anomaly results. Finally, a three-level hierarchical alarm and dynamic interception strategy is executed based on the anomaly results. The overall solution, through the collaborative design of the data layer, feature layer, model layer, and application layer, achieves real-time monitoring, dynamic anomaly identification, and adaptive protection of multi-source data. It is suitable for data stream security protection scenarios in fields such as finance and industry, improving the accuracy and response efficiency for identifying complex anomaly patterns. At the same time, by combining associated features, the dynamic dependencies between features are increased, which makes it easier to identify complex association anomalies. Attached Figure Description

[0060] Figure 1 This is a flowchart illustrating a method for monitoring and preventing anomalies based on multi-dimensional data flow.

[0061] Figure 2 This is a structural block diagram of a multi-dimensional data flow monitoring and anomaly interception and protection device. Detailed Implementation

[0062] The following combination Figure 1 - Figure 2 This application will be described in further detail.

[0063] With the acceleration of digital transformation, the interaction of multi-source data flows in fields such as finance and industrial IoT is becoming increasingly frequent. Abnormal behaviors during data flow (such as malicious injection, privilege escalation, and data leakage) pose a serious challenge to system security. Existing technologies mostly rely on static rule matching or single feature monitoring, which are difficult to adapt to the complex correlation characteristics of high-dimensional dynamic data flows, resulting in problems such as delayed anomaly identification, high false alarm rates, and insufficient model adaptability.

[0064] This application proposes a multi-dimensional data flow monitoring and anomaly interception and protection method. It constructs a basic feature set by fusing static statistical features and dynamic probability fluctuation values, introduces a multi-head attention mechanism to quantify the dynamic dependencies between features, and combines cluster analysis and association pattern recognition to generate accurate anomaly scores, thereby achieving hierarchical alarms and dynamic interception. Furthermore, it continuously optimizes model parameters through incremental learning, effectively improving the real-time detection accuracy and adaptive protection capabilities of data anomalies in complex scenarios.

[0065] Reference Figure 1 The embodiments of this application include at least steps S10 to S50.

[0066] S10 can access multi-source data streams in real time, clean and standardize the multi-source data, and generate standardized datasets.

[0067] S20 extracts static statistical features based on a standardized dataset, calculates dynamic cumulative probability fluctuation values ​​through an empirical cumulative distribution function, and outputs a basic feature set that integrates static features and dynamic fluctuation values.

[0068] S30. Based on the basic feature set, construct an association graph model with feature dimensions as nodes and feature mutual information as edge weights. Introduce a multi-head attention mechanism to calculate the dynamic dependency strength matrix between features under different time windows. By comparing the KL divergence between the normal sample dependency distribution and the real-time dependency distribution, identify abnormal association patterns. Add the abnormal values ​​of association strength as new features to the basic feature set to generate an association enhancement feature set.

[0069] S40: After dimensionality reduction and compression of the association enhancement feature set, the clustering parameters are optimized, and anomaly scores are generated by combining the clustering results, feature fluctuation values ​​and abnormal association patterns to obtain the abnormal results of the data.

[0070] S50 executes tiered alerting and dynamic blocking strategies based on abnormal results, and adaptively updates the parameters of the abnormal detection model and the associated dependency weights.

[0071] Specifically, the process begins by accessing and cleaning multi-source data to lay the foundation for subsequent analysis. Next, static statistical features and dynamic probability fluctuation values ​​are extracted and fused into a basic feature set. Then, a feature mutual information association graph model is constructed, and a multi-head attention mechanism is used to calculate dynamic dependency strength. Abnormal association patterns are identified through KL divergence, generating association enhancement features. After dimensionality reduction and clustering, anomaly scores are generated by combining feature fluctuation values ​​and association patterns. Finally, tiered alerts and dynamic interception are implemented to improve anomaly detection accuracy and response efficiency in complex scenarios.

[0072] In some embodiments, step S10 specifically includes the following steps: collecting multiple types of data streams in parallel through a distributed data access interface to generate an original data stream with a data source identifier;

[0073] The original data stream is cleaned in real time using a sliding time window. Missing values ​​are filled with linear interpolation based on the features of nearby time points. Outliers exceeding the 3σ range are truncated and corrected. Data format errors are corrected by timestamp reordering and format validation. The cleaned structured dataset is output.

[0074] For structured datasets, the Z-score standardization formula is used to map numerical features to the [-1,1] interval, and categorical features are converted into binary vectors using one-hot encoding. By aligning the collection times of multi-source data with unified timestamps, a standardized dataset containing feature names, timestamps, and standardized values ​​is generated.

[0075] Specifically, multiple types of data streams are collected in parallel through a distributed interface and source identifiers are added to ensure data traceability and integrity. A sliding time window is used for real-time cleaning, filling missing values ​​with linear interpolation of features from nearby times, correcting outliers with 3σ truncation, and fixing errors with timestamp reordering and format verification to generate structured data. Furthermore, numerical features are standardized to the [-1,1] interval using Z-score, and categorical features are converted into binary vectors through one-hot encoding. Combined with unified timestamps to align the collection times of multi-source data, a dataset containing feature names, timestamps, and standardized values ​​is finally formed. This provides high-quality, time-aligned basic data support for subsequent feature extraction and association modeling, effectively solving the compatibility and noise interference problems of multi-source heterogeneous data.

[0076] In some embodiments, step S20 specifically includes the following steps: dividing the standardized dataset into blocks according to a preset time window, calculating four types of statistical indicators for each feature dimension: central tendency feature, dispersion feature, distribution pattern feature, and quantile feature, and integrating them into a static feature tensor with a dimension of window number × feature number × 12; constructing an empirical cumulative distribution function for each feature dimension using a sliding time window, and forming a distribution curve reflecting the data distribution pattern by the proportion of samples within the statistical window that are not greater than the current feature value to the total number of samples; applying an adaptive perturbation based on the absolute deviation of the moving average, adding dynamically adjusted small fluctuations to the feature values, and comparing the area difference enclosed by the two cumulative distribution curves before and after the perturbation; normalizing the area difference to the 0-1 interval as the dynamic cumulative probability fluctuation value, forming a fluctuation value matrix with a dimension of window number × feature number; concatenating the static feature tensor and the fluctuation value matrix according to the time window dimension, and using principal component analysis to retain some information variance to compress the feature dimension, generating a basic feature set for each feature containing multiple static indicators and one dynamic fluctuation value.

[0077] Specifically, standardized data is processed by dividing it into blocks using time windows, and four types of static statistical features (central tendency, dispersion, distribution pattern, and quantiles) are extracted to construct a multidimensional feature tensor, comprehensively capturing the data distribution characteristics. At the same time, a sliding window empirical cumulative distribution function is constructed for each feature dimension, and dynamic fluctuation values ​​are generated by adaptive perturbation through moving average absolute deviation to quantify the minute changes in the data distribution pattern. After concatenating the static feature tensor and the dynamic fluctuation matrix along the time dimension, principal component analysis is used to compress the dimensions while retaining key information, ultimately forming a basic feature set that integrates statistical attributes and dynamic fluctuation characteristics. This not only preserves the inherent statistical regularity of the data but also enhances the sensitivity to capturing time-series distribution anomalies, providing high-dimensional and strongly representative feature inputs for subsequent correlation modeling.

[0078] In some embodiments, step S30 specifically includes the following steps: Based on the feature dimensions in the basic feature set as nodes, an undirected weighted association graph model is constructed by calculating the mutual information value between any two features as edge weights, wherein the mutual information value is calculated using the KL divergence between the joint probability distribution and the marginal probability distribution; based on the topology of the association graph model, a multi-head attention mechanism is introduced, taking the basic feature sets of different time windows as input, generating a QKV matrix through linear transformation, and calculating the attention weight distribution between features; based on the attention weight distribution, the dependency strength matrix output by each attention head is concatenated and linearly mapped to generate a fused multi-scale feature dependency matrix. The dynamic dependency strength matrix of the dependency relationship is obtained; a normal dependency distribution model is constructed based on the dynamic dependency strength matrix of historical normal samples, and the distribution parameters are fitted using kernel density estimation; the KL divergence between the dependency strength matrix and the normal dependency distribution in the current time window is calculated in real time, and when the divergence value exceeds a preset threshold, it is marked as an abnormal association pattern; the preset number of feature pairs with the highest weight deviation in the abnormal association pattern are extracted, and the corresponding abnormal association strength values ​​are calculated; the abnormal association strength values ​​are added to the basic feature set as new feature dimensions, and through time window alignment and feature dimension expansion, an association enhancement feature set containing the original static features, dynamic fluctuation values, and abnormal association features is generated.

[0079] The raw data stream consists of multi-source heterogeneous data collected through a distributed interface. After cleaning and standardization, a standardized dataset is generated, which serves as the original input for feature extraction. Static statistical features are four types of statistical indicators (central tendency, dispersion, etc.) calculated from the standardized data according to time windows. These are integrated into a static feature tensor (dimension: number of windows × number of features × 12), which is a structured statistical description of the raw data. The original static features are a component of the basic feature set. They refer to the static indicators retained after the static feature tensor is reduced in dimensionality by principal component analysis. These are concatenated with the dynamic fluctuation value matrix to form the basic feature set. The relationship between the three is: raw data stream → standardization processing → static statistical feature extraction → dimensionality reduction and integration into original static features.

[0080] Outliers in association strength are quantified values ​​of deviation from key feature pairs extracted from abnormal association patterns. They are obtained by calculating the degree of abnormality of the Top-N feature pairs with the highest weight deviation. Association anomaly features are feature types that are added to the basic feature set as new dimensions. Together with the original static features and dynamic fluctuation values, they form the association enhancement feature set. The relationship between the two is that outliers in association strength are specific numerical indicators, while association anomaly features are the dimensional representation of the indicator in the feature set. That is, the association anomaly features are expanded by adding outliers in association strength.

[0081] Specifically, abnormal pattern recognition is achieved by constructing a feature association graph and dynamic dependency modeling: Using basic feature dimensions as nodes, an undirected weighted association graph is constructed using mutual information values ​​(calculated based on the KL divergence of joint / marginal probability distributions) to quantify the nonlinear dependency strength between features; a multi-head attention mechanism is introduced to process features across multiple time windows, generating a QKV matrix from the basic features through linear transformation, and fusing multi-scale dependencies through attention weight distribution to output a dynamic dependency strength matrix; based on the dependency strength matrix of historical normal samples, a normal dependency distribution model is constructed using kernel density estimation, and the KL divergence between the current window and the normal distribution is calculated in real time, marking abnormal association patterns if it exceeds a threshold; the Top-N feature pairs with the highest weight deviation are extracted, and the abnormal association strength values ​​are calculated and appended as new feature dimensions, ultimately generating an enhanced set that integrates static features, dynamic fluctuation values, and abnormal association features. This process captures time-varying dependencies between features through graph structure modeling and attention mechanisms, and identifies latent association anomalies by combining statistical distribution differences, significantly improving the feature set's ability to represent complex attack patterns and providing high-order association feature support for subsequent anomaly scoring.

[0082] Furthermore, step S30 also includes the following steps: based on the topology of the association graph model, setting the number of attention heads, with each attention head independently learning feature dependencies at different scales; performing linear transformation on the basic feature sets for different time windows to generate a QKV matrix, which includes three sets of matrices: a query matrix representing the association requirements of each feature dimension in the current time window; a key matrix representing the attribute identifiers of each feature dimension, used to match with the query matrix to calculate the association strength; and a value matrix representing the specific numerical information of each feature dimension, i.e., the feature content to be extracted after association matching; controlling each attention head to perform similarity calculation through the transpose of the query matrix and the key matrix, and adjusting the numerical range through a scaling factor; applying the Softmax function to the similarity results to obtain the attention weight distribution between each feature dimension, with higher weight values ​​indicating stronger dynamic dependencies between features; horizontally concatenating the dependency strength matrices output by all attention heads to form a fusion matrix containing multi-scale feature dependencies; and performing dimensionality reduction and information integration on the fusion matrix through a linear mapping layer to generate a dynamic dependency strength matrix of a unified dimension.

[0083] Specifically, the generation mechanism of the dynamic dependency strength matrix is ​​further optimized: multiple attention heads are configured based on the association graph topology, and each group independently learns dependency patterns between features at different scales (such as local / global, short-term / long-term), improving the model's ability to capture complex associations; linear transformations are performed on the basic features of multiple time windows to generate three matrices: query (representing the current feature association requirement), key (feature attribute identifier, used to match the query to calculate the association strength), and value (specific numerical information of the feature); the similarity of each attention head is calculated by the inner product of the query and key matrix transposes, and after adjustment by a scaling factor (to avoid gradient vanishing), the Softmax function is applied to output the attention weight distribution between features (higher weights indicate stronger dynamic dependencies); the dependency strength matrices of all attention heads are horizontally concatenated to form a high-dimensional matrix that integrates multi-scale dependency information, and then dimensionality is reduced and integrated through a linear mapping layer to finally generate a dynamic dependency strength matrix with unified dimensions. This process effectively captures the spatiotemporal heterogeneity of feature dependencies through parallel learning of multiple attention heads and interactive modeling of features, so that the dynamic dependency strength matrix simultaneously contains micro-local associations and macro-global dependencies, providing more refined time-varying dependency features for subsequent abnormal association pattern recognition.

[0084] In some embodiments, step S40 specifically includes the following steps: Principal component analysis is used to reduce the dimensionality of the association enhancement feature set, retaining principal components whose cumulative variance contribution rate exceeds a threshold, and mapping high-dimensional features to a low-dimensional space to reduce redundant information, wherein the number of principal components is determined by the eigenvalue scree plot; based on the dimensionality-reduced feature data, the sum of squared clustering errors under different numbers of clusters is calculated, and the K value corresponding to the point of abrupt change in the error rate is selected as the optimal number of clusters; simultaneously, the clustering quality is verified by the silhouette coefficient, ensuring that the mean of the silhouette coefficient is greater than 0.6 to guarantee intra-cluster compactness and inter-cluster separation; the fluctuation value within the sliding window is calculated for each dimension of the original feature set, and the degree of fluctuation is quantified by the Z-score normalization method, the formula being Z = (x - μ) / σ, where μ is the feature mean and σ is the standard deviation. Features with fluctuation values ​​exceeding 3 times the standard deviation are marked as significant fluctuation features. The clustering distance term, fluctuation contribution term, and association anomaly term are weighted and fused to generate anomaly scores. Clustering distance term: The Euclidean distance from each data point to its cluster center is calculated and normalized to serve as the basic anomaly score. Fluctuation contribution term: The absolute Z-score values ​​of significant fluctuation features are weighted and summed, with weights dynamically allocated based on feature importance. Association anomaly term: The KL divergence value of the anomaly association pattern is introduced, and the anomaly contribution is amplified by a multiple of the deviation threshold. An adaptive threshold method is used to truncate the anomaly scores. Data points exceeding the threshold are marked as anomaly results, and the ranking of anomaly feature contributions and the interpretation of association patterns are output.

[0085] Specifically, PCA is used to reduce the dimensionality of association enhancement features. The number of principal components is determined by the scree plot of eigenvalues, and components with cumulative variance contribution rates exceeding the threshold are retained to compress dimensionality and remove redundancy. Based on the dimensionality-reduced data, the optimal K value is selected by the sum of squared errors (SSE) inflection point method, and the clustering quality is verified by the silhouette coefficient to ensure intra-cluster compactness and inter-cluster separation. The sliding window fluctuation value is calculated for each feature dimension, and significant fluctuation features outside 3σ are marked by Z-score standardization (Z=(x-μ) / σ). Three types of indicators are fused to generate anomaly scores: the clustering distance term is the normalized Euclidean distance from the data point to the cluster center, the fluctuation contribution term is the weighted sum of the absolute values ​​of the Z-scores of significant fluctuation features, and the association anomaly term introduces the KL divergence value and amplifies it according to the threshold deviation factor. An adaptive threshold is used to truncate the anomaly scores, mark the anomaly results, and output the feature contribution ranking and association pattern interpretation, realizing end-to-end detection from feature dimensionality reduction, clustering division to multi-source anomaly indicator fusion, taking into account both detection accuracy and result interpretability.

[0086] In some embodiments, step S50 specifically includes the following steps: ranking based on anomaly scores and contributions of anomaly features; setting a three-level alarm threshold based on the standard deviation between the anomaly scores and the normal distribution; and implementing a tiered alarm and dynamic interception strategy; using an incremental learning framework to include anomaly samples within a preset time window into the training set; optimizing the kernel function bandwidth parameters of the normal dependency distribution model using gradient descent; dynamically adjusting the initial weight matrix of the multi-head attention mechanism based on the deviation of feature pairs in the anomaly association pattern; increasing the weight ratio of the corresponding attention heads for high-frequency anomaly feature pairs and decreasing the weight for low-frequency normal feature pairs, with the update cycle consistent with the time window.

[0087] Specifically, a three-tiered alarm threshold is set based on the standard deviation of the abnormal score from the normal distribution to trigger tiered alarms and dynamic interception strategies. An incremental learning framework is used to include abnormal samples within a preset time period into the training set, and the kernel function bandwidth parameter of the normal dependency distribution model is optimized through gradient descent to improve the adaptability to new abnormal patterns. According to the deviation of feature pairs in the abnormal association pattern, the initial weight matrix of the multi-head attention mechanism is dynamically adjusted—increasing the weight ratio of the corresponding attention heads for high-frequency abnormal feature pairs and decreasing the weight for low-frequency normal feature pairs, thereby enhancing the model's sensitivity to capturing key abnormal associations. The update cycle is kept consistent with the time window to ensure that the model parameters adapt to changes in data distribution in real time, forming an adaptive closed loop of "detection-alarm-learning-optimization," which effectively improves the accuracy and generalization ability of abnormal identification in long-term monitoring.

[0088] The implementation principle of a multi-dimensional data flow monitoring and anomaly interception protection method in this application is as follows: Real-time security protection of multi-source data is achieved through a systematic process. First, multi-source data streams are accessed in real time and cleaned and standardized to provide a high-quality data foundation for subsequent analysis. Next, static statistical features and dynamic cumulative probability fluctuation values ​​are extracted and fused to form a basic feature set, achieving complementarity between static and dynamic features. Then, a correlation graph model with feature mutual information as weights is constructed, a multi-head attention mechanism is introduced to calculate the dynamic dependency strength matrix, and abnormal correlation patterns are identified through KL divergence comparison, generating a correlation enhancement feature set to strengthen the quantification of dependencies between features. Afterwards, the correlation enhancement features are dimensionality-reduced and compressed, clustering parameters are optimized, and anomaly scores are generated by combining clustering distance, feature fluctuation values, and abnormal correlation patterns. Accurate anomaly results are obtained through adaptive thresholds. Finally, a three-level hierarchical alarm and dynamic interception strategy are executed based on the anomaly results. The overall solution, through the collaborative design of the data layer, feature layer, model layer, and application layer, achieves real-time monitoring, dynamic anomaly identification, and adaptive protection of multi-source data. It is suitable for data flow security protection scenarios in fields such as finance and industry, improving the accuracy and response efficiency for identifying complex anomaly patterns. At the same time, by combining associated features, the dynamic dependencies between features are increased, which makes it easier to identify complex association anomalies.

[0089] Figure 1 This is a flowchart illustrating a method for multi-dimensional data flow monitoring and anomaly interception and protection in one embodiment. It should be understood that, although... Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows; unless explicitly stated otherwise, there is no strict order requirement for the execution of these steps, and they can be executed in other orders; and Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0090] Based on the same technical concept, referring to Figure 2 This application also provides a device for multi-dimensional data flow monitoring and anomaly interception protection, which adopts the following technical solution: The device includes:

[0091] The data processing module is used to access multi-source data streams in real time, clean and standardize the multi-source data, and generate standardized datasets.

[0092] The basic feature module is used to extract static statistical features based on a standardized dataset, calculate dynamic cumulative probability fluctuation values ​​through an empirical cumulative distribution function, and output a basic feature set that integrates static features and dynamic fluctuation values.

[0093] The association enhancement module is used to construct an association graph model with feature dimensions as nodes and feature mutual information as edge weights based on the basic feature set. It introduces a multi-head attention mechanism to calculate the dynamic dependency strength matrix between features under different time windows. By comparing the KL divergence between the dependency distribution of normal samples and the real-time dependency distribution, it identifies abnormal association patterns and adds the abnormal values ​​of association strength as new features to the basic feature set to generate an association enhancement feature set.

[0094] The anomaly detection module is used to reduce the dimensionality of the association enhancement feature set, optimize the clustering parameters, and generate anomaly scores by combining the clustering results, feature fluctuation values, and abnormal association patterns to obtain the abnormal results of the data.

[0095] The dynamic alarm module is used to execute tiered alarms and dynamic interception strategies based on abnormal results, and adaptively update the parameters of the anomaly detection model and the associated dependency weights.

[0096] In some embodiments, the data processing module is specifically used to collect multiple types of data streams in parallel through a distributed data access interface and generate a raw data stream with a data source identifier;

[0097] The original data stream is cleaned in real time using a sliding time window. Missing values ​​are filled with linear interpolation based on the features of nearby time points. Outliers exceeding the 3σ range are truncated and corrected. Data format errors are corrected by timestamp reordering and format validation. The cleaned structured dataset is output.

[0098] For structured datasets, the Z-score standardization formula is used to map numerical features to the [-1,1] interval, and categorical features are converted into binary vectors using one-hot encoding. By aligning the collection times of multi-source data with unified timestamps, a standardized dataset containing feature names, timestamps, and standardized values ​​is generated.

[0099] In some embodiments, the basic feature module is specifically used to divide the standardized dataset into blocks according to a preset time window, calculate four types of statistical indicators for each feature dimension: central tendency feature, dispersion feature, distribution pattern feature and quantile feature, and integrate them into a static feature tensor with a dimension of number of windows × number of features × 12.

[0100] For each feature dimension, an empirical cumulative distribution function with a sliding time window is constructed. By statistically analyzing the proportion of samples within the window that are not greater than the current feature value to the total number of samples, a distribution curve reflecting the data distribution pattern is formed.

[0101] An adaptive perturbation based on the moving average absolute deviation is applied, and dynamically adjusted small fluctuations are added to the eigenvalues. The difference in the area enclosed by the two cumulative distribution curves before and after the perturbation is compared.

[0102] The area difference is normalized to the 0-1 interval as the dynamic cumulative probability fluctuation value, forming a fluctuation value matrix with the dimension of window number × feature number;

[0103] The static feature tensor and the fluctuation value matrix are concatenated along the time window dimension. Principal component analysis is used to retain some information variance to compress the feature dimension, generating a basic feature set in which each feature contains multiple static indicators and one dynamic fluctuation value.

[0104] In some embodiments, the association enhancement module is specifically used to construct an undirected weighted association graph model based on the feature dimensions in the basic feature set as nodes and by calculating the mutual information value between any two features as edge weights, wherein the mutual information value is calculated by the KL divergence between the joint probability distribution and the marginal probability distribution.

[0105] Based on the topology structure of the association graph model, a multi-head attention mechanism is introduced to take the basic feature sets of different time windows as input, generate a QKV matrix through linear transformation, and calculate the attention weight distribution between features.

[0106] Based on the attention weight distribution, the dependency strength matrices output by each attention head are concatenated and linearly mapped to generate a dynamic dependency strength matrix that integrates multi-scale feature dependencies.

[0107] A normal dependency distribution model is constructed based on the dynamic dependency strength matrix of historical normal samples, and the distribution parameters are fitted using kernel density estimation.

[0108] Calculate the KL divergence between the dependency strength matrix of the current time window and the normal dependency distribution in real time. When the divergence value exceeds a preset threshold, it is marked as an abnormal association pattern.

[0109] Extract the preset number of feature pairs with the highest weight deviation from the abnormal association patterns, and calculate the corresponding association strength anomaly values;

[0110] Outliers in the correlation strength are added as new feature dimensions to the basic feature set. By aligning the time window and expanding the feature dimensions, a correlation enhancement feature set is generated that includes the original static features, dynamic fluctuation values, and correlation anomaly features.

[0111] In some embodiments, the association enhancement module is specifically used to set the number of attention heads based on the topology of the association graph model, with each attention head independently learning feature dependencies at different scales.

[0112] A linear transformation is performed on the basic feature sets of different time windows to generate a QKV matrix. The QKV matrix consists of three matrices: a query matrix, which represents the association requirements of each feature dimension in the current time window; a key matrix, which represents the attribute identifiers of each feature dimension and is used to match with the query matrix to calculate the association strength; and a value matrix, which represents the specific numerical information of each feature dimension, i.e. the feature content to be extracted after association matching.

[0113] Each attention head is controlled to calculate similarity by transposing the query matrix and the key matrix, and the numerical range is adjusted by a scaling factor;

[0114] Applying the Softmax function to the similarity results yields the attention weight distribution among each feature dimension. Higher weight values ​​indicate stronger dynamic dependencies between features.

[0115] The dependency strength matrices of all attention head outputs are horizontally concatenated to form a fusion matrix containing multi-scale feature dependencies;

[0116] The fusion matrix is ​​reduced in dimensionality and information is integrated through a linear mapping layer to generate a dynamic dependency strength matrix with a unified dimension.

[0117] In some embodiments, the anomaly detection module is specifically used to perform dimensionality reduction processing on the association enhancement feature set using principal component analysis, retaining principal components whose cumulative variance contribution rate exceeds a threshold, and mapping high-dimensional features to a low-dimensional space to reduce redundant information, wherein the number of principal components is determined by the eigenvalue scree map.

[0118] Based on the dimensionality-reduced feature data, the sum of squared clustering errors under different numbers of clusters is calculated, and the K value corresponding to the point of sudden change in error rate is selected as the optimal number of clusters. At the same time, the clustering quality is verified by the silhouette coefficient to ensure that the mean of the silhouette coefficient is greater than 0.6 to guarantee intra-cluster compactness and inter-cluster separation.

[0119] For each dimension of the original feature set, calculate the fluctuation value within the sliding window, and use the Z-score standardization method to quantify the degree of fluctuation. The formula is Z = (x - μ) / σ, where μ is the feature mean and σ is the standard deviation. Features with fluctuation values ​​exceeding 3 times the standard deviation are marked as significant fluctuation features.

[0120] The clustering distance term, fluctuation contribution term, and association anomaly term are weighted and fused to generate an anomaly score. The clustering distance term calculates the Euclidean distance from each data point to the center of its cluster and normalizes it to serve as the basic anomaly score. The fluctuation contribution term is the weighted sum of the absolute values ​​of the Z-scores of significant fluctuation features, with the weights dynamically allocated by the importance of the features. The association anomaly term introduces the KL divergence value of the anomaly association pattern and amplifies the anomaly contribution by the deviation threshold.

[0121] An adaptive thresholding method is used to truncate outlier scores. Data points exceeding the threshold are marked as outlier results, and the ranking of outlier feature contributions and the interpretation of association patterns are output.

[0122] In some embodiments, the dynamic alarm module is specifically used to sort anomaly scores and anomaly feature contributions, set three-level alarm thresholds based on the standard deviation between the anomaly scores and the normal distribution, and execute tiered alarm and dynamic interception strategies.

[0123] An incremental learning framework is used to include abnormal samples within a preset time window into the training set;

[0124] The kernel function bandwidth parameter of the normal dependency distribution model is optimized using gradient descent.

[0125] The initial weight matrix of the multi-head attention mechanism is dynamically adjusted based on the deviation of feature pairs in the abnormal association pattern.

[0126] Increase the weight ratio of the attention head allocation for high-frequency abnormal feature pairs, and decrease the weight for low-frequency normal feature pairs, while keeping the update cycle consistent with the time window.

[0127] This application also discloses a control device.

[0128] Specifically, the control device includes a memory and a processor. The memory stores a computer program that can be loaded and executed by the processor, which is based on the multi-dimensional data flow monitoring and anomaly interception and protection method described above.

[0129] This application also discloses a computer-readable storage medium.

[0130] Specifically, the computer-readable storage medium stores a computer program that can be loaded and executed by a processor, such as the aforementioned multi-dimensional data flow monitoring and anomaly interception protection method. The computer-readable storage medium includes, for example, various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0131] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A method for monitoring and intercepting abnormality based on multi-dimensional data flow, characterized in that, The method comprises the following steps: real-time access to multi-source data streams, cleaning and standardizing multi-source data to generate a standardized data set; based on the standardized data set, extract static statistical features, and calculate dynamic cumulative probability fluctuation values through the empirical cumulative distribution function, output the basic feature set fused with static features and dynamic fluctuation values; according to the basic feature set, construct a correlation graph model with feature dimensions as nodes and feature mutual information as edge weights, introduce a multi-head attention mechanism to calculate the dynamic dependence strength matrix between features in different time windows, identify abnormal correlation patterns by comparing the KL divergence of normal sample dependence distribution and real-time dependence distribution, add the correlation strength abnormal value to the basic feature set as a new feature to generate the correlation enhanced feature set; after dimensionality reduction compression of the correlation enhanced feature set, optimize the clustering parameters, combine the clustering results, feature fluctuation values and the abnormal correlation pattern to generate an anomaly score, and obtain the anomaly result of the data; according to the anomaly result, execute hierarchical alarm and dynamic interception strategy, and adaptively update the anomaly detection model parameters and correlation dependence weights; wherein the real-time access to multi-source data streams, cleaning and standardizing multi-source data to generate a standardized data set comprises: parallel collection of multi-type data streams through a distributed data access interface to generate an original data stream with data source identification; real-time cleaning of the original data stream using a sliding time window, linear interpolation filling of missing values based on adjacent time feature, outlier correction of outliers exceeding 3σ range, and correction of data format errors through timestamp reordering and format verification, to output a cleaned structured data set; for the structured data set, use the Z-score standardization formula to map numerical features to the [-1, 1] interval, use one-hot encoding to convert categorical features into binary vectors, and align the collection time of multi-source data through a unified timestamp to generate the standardized data set containing feature names, timestamps and standardized values.

2. The method of claim 1, wherein the method further comprises: The method comprises the following steps: block processing of the standardized data set according to a preset time window, calculating four types of statistical indicators for each feature dimension: central tendency features, dispersion degree features, distribution shape features and quantile features, and integrating them into a static feature tensor with dimensions of window number x feature number x 12; constructing an empirical cumulative distribution function for each feature dimension with a sliding time window, calculating the proportion of the number of samples not greater than the current feature value in the total number of samples within the window to form a distribution curve reflecting the data distribution shape; applying an adaptive perturbation based on the moving average absolute deviation to add a dynamically adjusted small fluctuation to the feature value, and comparing the area difference enclosed by the two cumulative distribution curves before and after the perturbation; normalize the area difference to the 0-1 interval as the dynamic cumulative probability fluctuation value to form a fluctuation value matrix with dimensions of window number x feature number; The static feature tensor is spliced with the wave value matrix in the time window dimension, principal component analysis is used to retain part of the information variance to compress the feature dimension, and the basic feature set containing multiple static indexes and a dynamic wave value is generated.

3. The method of claim 2, wherein the method further comprises: According to the basic feature set, a correlation graph model is constructed with feature dimensions as nodes and feature mutual information as edge weights, a multi-head attention mechanism is introduced to calculate the dynamic dependence strength matrix between features in different time windows, the KL divergence of the normal sample dependence distribution and the real-time dependence distribution is compared to identify abnormal correlation patterns, the correlation strength abnormal value is added to the basic feature set as a new feature, and an enhanced correlation feature set is generated, including: According to the feature dimensions in the basic feature set, a non-directional weighted correlation graph model is constructed by calculating the mutual information value between any two features as the edge weight, wherein the mutual information value is calculated by the KL divergence of the joint probability distribution and the marginal probability distribution; Based on the step structure of the correlation graph model, a multi-head attention mechanism is introduced to input the basic feature set in different time windows, a QKV matrix is generated through linear transformation, and the attention weight distribution between features is calculated; Based on the attention weight distribution, the dependence strength matrix output by each attention head is spliced and linearly mapped to generate the dynamic dependence strength matrix that fuses multi-scale feature dependence relationships; Based on the dynamic dependence strength matrix of the historical normal samples, a normal dependence distribution model is constructed, and the distribution parameters are fitted by kernel density estimation; The KL divergence of the current time window dependence strength matrix and the normal dependence distribution is calculated in real time, and when the divergence value exceeds the preset threshold, it is marked as the abnormal correlation pattern; The preset number of feature pairs with the highest weight deviation degree in the abnormal correlation pattern are extracted, and the corresponding correlation strength abnormal value is calculated; The correlation strength abnormal value is added to the basic feature set as a new feature dimension, and the enhanced correlation feature set containing the original static features, the dynamic wave value and the correlation abnormal features is generated through time window alignment and feature dimension expansion, wherein the original static features and the correlation abnormal features are extracted from the basic feature set.

4. The method of claim 3, wherein the method further comprises: Based on the step structure of the correlation graph model, a multi-head attention mechanism is introduced to input the basic feature set in different time windows, a QKV matrix is generated through linear transformation, and the attention weight distribution between features is calculated, including: Based on the topology structure of the correlation graph model, the number of attention heads is set, and each attention head independently learns the feature dependence relationship of different scales; The basic feature set in different time windows is linearly transformed, and the QKV matrix is generated through linear transformation, including three groups of matrices: query matrix: representing the correlation demand of each feature dimension in the current time window; key matrix: representing the attribute identifier of each feature dimension, used to match the query matrix to calculate the correlation strength; value matrix: representing the specific numerical information of each feature dimension, i.e. the feature content to be extracted after correlation matching; The control of each attention head is performed by similarity calculation with the query matrix and the transpose of the key matrix, and the numerical range is adjusted by a scaling factor; The similarity results are applied to the Softmax function to obtain the attention weight distribution between feature dimensions, and the higher the weight value, the stronger the dynamic dependence relationship between features; The dependence strength matrix output by all attention heads is horizontally spliced to form a fusion matrix containing multi-scale feature dependence relationships; The fusion matrix is reduced in dimension and integrated by a linear mapping layer to generate a unified dimension dynamic dependence strength matrix.

5. The method of claim 4, wherein the method further comprises: After dimensionality reduction and compression of the correlation enhanced feature set, the clustering parameters are optimized, the abnormal score is generated by combining the clustering results, feature fluctuation value and abnormal correlation pattern, and the abnormal result of the data is obtained, including: The principal component analysis is adopted to reduce the dimensionality of the correlation enhanced feature set, the principal components with cumulative variance contribution rate exceeding the threshold are retained, and the high-dimensional features are mapped to a low-dimensional space to reduce redundant information, wherein the number of principal components is determined by the eigenvalue stone chart; Based on the feature data after dimensionality reduction, the clustering error sum of squares under different clustering numbers is calculated, and the K value corresponding to the sudden change point of error change rate is selected as the optimal clustering number; at the same time, the clustering quality is verified by the silhouette coefficient to ensure that the average value of the silhouette coefficient is greater than 0.6 to ensure the compactness within the cluster and the separation degree between the clusters; The fluctuation value in the sliding window is calculated for each dimension feature in the original feature set, and the Z-score standardization method is used to quantify the fluctuation degree, and the formula is Z = (x - μ) / σ, wherein μ is the feature mean value, and σ is the standard deviation. The features with fluctuation value exceeding 3 times the standard deviation are marked as significant fluctuation features; The clustering distance term, the fluctuation contribution term and the correlation anomaly term are fused by weighting to generate the abnormal score, the clustering distance term: the Euclidean distance of each data point to the center of the cluster to which it belongs is calculated, and the normalized value is taken as the basic abnormal score; the fluctuation contribution term: the absolute value of the Z-score of the significant fluctuation feature is weighted and summed, and the weight is dynamically allocated according to the feature importance; the correlation anomaly term: the KL divergence value of the abnormal correlation pattern is introduced, and the abnormal contribution is amplified according to the deviation threshold multiple; The adaptive threshold method is adopted to cut off the abnormal score, and the data points exceeding the threshold are marked as the abnormal result, and the abnormal feature contribution ranking and the correlation pattern explanation are output.

6. The method of claim 5, wherein the method further comprises: According to the abnormal result, the hierarchical alarm and dynamic interception strategy are executed, and the abnormal detection model parameters and correlation dependence weights are adaptively updated, including: Based on the abnormal score and the abnormal feature contribution ranking, three-level alarm thresholds are set according to the standard deviation between the abnormal score and the normal distribution, and the hierarchical alarm and the dynamic interception strategy are executed An incremental learning framework is adopted to include the abnormal samples in the time window within a preset time period into the training set; The kernel function bandwidth parameter of the normal dependence distribution model is optimized by the gradient descent method; Based on the deviation degree of the feature pairs in the abnormal correlation pattern, the initial weight matrix of the multi-head attention mechanism is dynamically adjusted. The corresponding attention head distribution of the high-frequency abnormal feature pair is increased in weight proportion, and the weight of the low-frequency normal feature pair is reduced, and the update period is consistent with the time window.

7. A multi-dimensional data flow based monitoring and anomaly interception protection device, characterized in that, The device comprises: A data processing module is configured to access multiple source data streams in real time, clean and standardize the multiple source data, and generate a standardized data set; A basic feature module is configured to extract static statistical features based on the standardized data set, calculate dynamic cumulative probability fluctuation values through an empirical cumulative distribution function, and output a basic feature set that fuses the static features and the dynamic fluctuation values; An association enhancement module is configured to construct an association graph model with feature dimensions as nodes and feature mutual information as edge weights based on the basic feature set, introduce a multi-head attention mechanism to calculate a dynamic dependence strength matrix between features under different time windows, identify abnormal association patterns by comparing the KL divergence between normal sample dependence distribution and real-time dependence distribution, add abnormal association strength values as new features to the basic feature set, and generate an association enhanced feature set; An anomaly detection module is configured to reduce and compress the association enhanced feature set, optimize clustering parameters, combine clustering results, feature fluctuation values, and abnormal association patterns to generate an anomaly score, and obtain an anomaly result of the data; A dynamic alarm module is configured to execute hierarchical alarm and dynamic interception strategies according to the anomaly result, and adaptively update anomaly detection model parameters and association dependence weights; The data processing module is specifically configured to collect multiple types of data streams in parallel through a distributed data access interface, and generate original data streams with data source identifiers; The original data streams are cleaned in real time using a sliding time window, missing values are filled using linear interpolation based on adjacent time features, outliers beyond the 3σ range are corrected using truncation, and data format errors are corrected through timestamp reordering and format verification, and a structured data set after cleaning is output; For the structured data set, the Z-score standardization formula is used to map numerical features to the [-1, 1] interval, the category features are converted into binary vectors using one-hot encoding, the collection time of the multi-source data is aligned through a unified timestamp, and the standardized data set containing feature names, timestamps, and standardized values is generated.

8. A control device characterized by comprising: The device comprises: A memory and a processor, the memory storing a computer program capable of being loaded and executed by the processor to perform the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A memory storing a computer program capable of being loaded and executed by the processor to perform the method of any one of claims 1 to 6.

Images