Artificial intelligence-based data monitoring platform security protection method and system

Abstract

This invention provides a security protection method and system for a data monitoring platform based on artificial intelligence. First, an initial monitoring data set containing original data units with node identifiers and timestamps within a continuous time period from different monitoring nodes is acquired. Next, time-series features and spatial correlation features are extracted from the initial monitoring data set to form a target security feature set. Then, a pre-trained security risk detection model is used to identify abnormal patterns and generate security risk detection results. Next, the anomaly type and propagation path characteristics are analyzed. Finally, a security protection command containing node location identifiers is generated and sent to the control module to trigger risk isolation operations. This comprehensively and accurately ensures the security of the carbon emission monitoring data platform, guaranteeing the accuracy and reliability of carbon emission data monitoring.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and more specifically, to a security protection method and system for a data monitoring platform based on artificial intelligence. Background Technology

[0002] In the current context of actively addressing climate change, carbon emission monitoring has become crucial. Businesses and environmental management departments need accurate and real-time knowledge of carbon emissions to develop effective emission reduction strategies and regulatory measures. Data monitoring platforms collect carbon emission-related data, such as energy consumption and emissions from production processes, through numerous monitoring nodes.

[0003] However, existing security measures for carbon emission monitoring data platforms primarily rely on manual experience and simple rule settings, making them ill-suited to the complex and ever-changing network environment and evolving attack methods. On one hand, traditional methods cannot effectively and promptly identify and prevent new types of cyberattacks, such as zero-day vulnerability attacks and advanced persistent threats (APTs), easily leading to data tampering or leakage. On the other hand, existing security detection methods often focus only on local characteristics of the data, neglecting the dynamic changes in the data over time and the spatial interactions between different monitoring nodes, thus failing to comprehensively and accurately detect potential security risks. Summary of the Invention

[0004] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a security protection method for a data monitoring platform based on artificial intelligence, the method comprising:

[0005] Obtain the initial monitoring data set of the data monitoring platform, which includes raw data units with node identifiers and timestamps collected by different monitoring nodes within a continuous time period;

[0006] Feature extraction is performed on the initial monitoring data set to obtain a target security feature set containing time series features and spatial correlation features. The time series features are used to characterize the change pattern of data from the same monitoring node in the time dimension, and the spatial correlation features are used to characterize the mutual influence relationship of data from different monitoring nodes in the spatial dimension.

[0007] The pre-trained security risk detection model is invoked to perform abnormal pattern recognition processing on the target security feature set, generating a security risk detection result containing the probability of abnormal occurrence and a description of abnormal features;

[0008] Based on the security risk detection results, analyze the types of anomalies present in the data monitoring platform and the characteristics of the propagation paths of the anomalies in the monitoring node network;

[0009] Based on the anomaly type and the propagation path feature information, a security protection command containing node location identifier is generated, and the security protection command is sent to the control module of the data monitoring platform to trigger risk isolation operation.

[0010] In another aspect, embodiments of the present invention also provide a data monitoring platform security protection system based on artificial intelligence, including a processor and a machine-readable storage medium connected to the processor. The machine-readable storage medium is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the machine-readable storage medium to implement the above-described method.

[0011] Based on the above, this embodiment of the invention acquires the initial monitoring data set of the data monitoring platform, extracts features from the initial monitoring data set to obtain a target security feature set containing time series features and spatial correlation features. This allows for in-depth mining of the inherent patterns in the data from both temporal and spatial dimensions, enabling a more accurate grasp of the dynamic changes in carbon emission data during the monitoring process and the interrelationships between nodes. A pre-trained security risk detection model is then invoked to perform anomaly pattern recognition processing on the target security feature set. Leveraging the powerful learning capabilities of artificial intelligence, potential security risks can be efficiently and accurately identified, generating security risk detection results containing anomaly occurrence probabilities and anomaly feature descriptions. Analyzing the anomaly types and propagation path characteristics of the anomalies in the monitoring node network based on the security risk detection results further clarifies the nature and scope of the security threats, helping to formulate more targeted protection strategies. Finally, based on the propagation path characteristic information, a security protection command containing node location identifiers is generated and a risk isolation operation is triggered. This achieves precise and intelligent processing of the security protection of the carbon emission monitoring data monitoring platform, effectively reducing the probability of carbon emission data errors and leaks caused by security risks, and ensuring the accuracy and reliability of carbon emission monitoring work. Attached Figure Description

[0012] Figure 1 This is a schematic diagram of the execution flow of the data monitoring platform security protection method based on artificial intelligence provided in the embodiments of the present invention.

[0013] Figure 2 This is a schematic diagram of exemplary hardware and software components of the data monitoring platform security protection system based on artificial intelligence provided in this embodiment of the invention. Detailed Implementation

[0014] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating a data monitoring platform security protection method based on artificial intelligence, provided in one embodiment of the present invention. The following is a detailed description of this data monitoring platform security protection method based on artificial intelligence.

[0015] Step S110: Obtain the initial monitoring data set of the data monitoring platform. The initial monitoring data set includes raw data units with node identifiers and timestamps collected by different monitoring nodes within a continuous time period.

[0016] Taking a smart building carbon emission monitoring scenario as an example, the data monitoring platform encompasses multiple monitoring nodes distributed across different locations within the building. Their function is to collect carbon emission-related data over a continuous time period. For instance, various sensors are installed as monitoring nodes on different floors and in different functional areas of the building, such as office areas, elevator lobbies, and air conditioning rooms. This allows for the collection of various carbon emission-related data, such as electricity consumption data, gas usage data, and personnel flow data. Each collected data point is marked with the identifier of the monitoring node that collected it and the specific timestamp of the collection.

[0017] An initial monitoring data set is formed by aggregating the raw data units with node identifiers and timestamps collected by all monitoring nodes within a continuous time period.

[0018] Step S120: Extract features from the initial monitoring data set to obtain a target security feature set containing time series features and spatial correlation features. The time series features are used to characterize the change pattern of the data of the same monitoring node in the time dimension, and the spatial correlation features are used to characterize the mutual influence relationship of the data of different monitoring nodes in the spatial dimension.

[0019] Step S121: Perform time-block processing on the initial monitoring data set according to a preset time interval to obtain multiple data block units with time continuity. Each data block unit contains raw data units collected by multiple monitoring nodes within the same time period.

[0020] In this embodiment, a time interval can be preset, for example, a relatively short period of time. The initial monitoring data set is divided according to this time interval to obtain multiple data block units. Each data block unit contains the raw data units collected by all monitoring nodes within this same time period. In the smart building carbon emission monitoring scenario, assuming the preset time interval is a relatively short period of time, then each data block unit contains the raw data such as electricity consumption and gas usage collected by each monitoring node in the building within that time period.

[0021] Step S122: Perform time series analysis on the data of a single monitoring node in each data block unit. Calculate the slope of the mean change curve, the cumulative value of variance fluctuation, and the main diagonal elements of the autocorrelation coefficient matrix of adjacent time points through a sliding window to generate time series features.

[0022] Step S1221: For the original data units of a single monitoring node within a data block unit, construct a time series data sequence in timestamp order.

[0023] When performing time series analysis on data from a single monitoring node, the original data units must first be sorted according to their timestamps to construct a time series data sequence. Taking a sensor monitoring electricity consumption in a building as an example, this sensor collects multiple electricity consumption data points within a single data block, each data point bearing a timestamp. Arranging the electricity consumption data in ascending order of timestamps generates a continuous time series data sequence.

[0024] Step S1222: The time series data sequence is subjected to forward and backward mean calculations using a sliding window with a preset window value to generate a mean change curve. The slope and curvature of the curve are extracted as mean change trend features using a curve fitting algorithm.

[0025] After constructing the time series data sequence, a sliding window of preset length is used to process it. The preset window size determines the size of the sliding window. The sliding window slides across the time series data sequence from beginning to end, calculating the mean of the data within each window position. As the window slides, a series of mean data points are obtained. Connecting these mean data points generates the mean change curve.

[0026] To further analyze this mean change curve, a curve fitting algorithm is used. The curve fitting algorithm finds a curve that best fits the data points of the mean change curve. By analyzing the fitted curve, parameters such as slope and curvature are extracted. The slope of the curve reflects the rate of change of the data over time; for example, a positive slope indicates an upward trend, and a negative slope indicates a downward trend. The absolute value of the slope indicates the speed of change. Curvature reflects the degree of curvature of the curve, which can help determine whether the data change is linear or non-linear. These slope and curvature parameters constitute the characteristic of the mean change trend.

[0027] Step S1223: Calculate the overall variance of the time series data sequence, and calculate the variance difference between adjacent time points point by point, and accumulate them to obtain the cumulative value of variance fluctuation amplitude.

[0028] After obtaining the time series data sequence, the overall variance of the sequence is calculated. Overall variance is an important indicator of data dispersion, reflecting how dispersed the data is relative to the mean. For a power consumption data sequence collected from a monitoring node in a building, a larger overall variance indicates more drastic fluctuations in power consumption data; a smaller overall variance indicates relatively stable power consumption data.

[0029] Next, the variance difference between adjacent time points is calculated point by point. This means calculating the difference between the variances of data at two adjacent time points. These variance differences between adjacent time points are then summed to obtain the cumulative variance fluctuation. This cumulative variance fluctuation comprehensively reflects the data's fluctuation over the entire time dimension. If the cumulative variance fluctuation is large, it indicates that the data fluctuates frequently and drastically over time, and the data is unstable; if the cumulative variance fluctuation is small, it indicates that the data is relatively stable over time, with less fluctuation. This cumulative variance fluctuation provides a direct way to judge the stability of the data over time.

[0030] Step S1224: Apply the autocorrelation function to calculate the autocorrelation coefficients at different time intervals, construct the correlation coefficient matrix, and extract the main diagonal elements and the largest off-diagonal element of the matrix as the correlation coefficient features of adjacent time points.

[0031] To analyze the correlation between data points at different time points in a time series data sequence, the autocorrelation function is applied. The autocorrelation function can calculate the autocorrelation coefficient of data at different time intervals. For example, for a power consumption data sequence collected by a monitoring node in a building, the autocorrelation coefficient of the sequence at different time intervals can be calculated. For instance, the autocorrelation coefficients of data at intervals of one time point, two time points, etc., can be calculated.

[0032] The calculated autocorrelation coefficients are used to construct a correlation coefficient matrix. The rows and columns of the correlation coefficient matrix correspond to different time points, and the elements in the matrix are the autocorrelation coefficients between those time points. In this correlation coefficient matrix, the main diagonal elements represent the autocorrelation coefficients of data at adjacent time points, reflecting the direct correlation between data at adjacent time points. The largest off-diagonal element represents the maximum correlation of data across different time intervals, revealing the dependency relationship of data at different time intervals. The main diagonal elements and the largest off-diagonal element of the matrix are extracted and used as the correlation coefficient features between adjacent time points.

[0033] Step S1225: By standardizing the dimensions and units of the mean change trend characteristics, cumulative variance fluctuation amplitude, and correlation coefficient characteristics, the time series characteristics of a single monitoring node within the data block unit are generated.

[0034] After obtaining the characteristics of the mean trend, the cumulative variance fluctuation, and the correlation coefficient, standardization is required because these characteristics may have different dimensions and units. The purpose of standardization is to unify these characteristics with different dimensions and units onto a common scale to facilitate subsequent comprehensive analysis and comparison.

[0035] For characteristics such as the trend of mean change, it can be expressed as a rate of change in units; the cumulative value of variance fluctuation may be a value related to variance; and the correlation coefficient is a dimensionless coefficient. Standardization transforms these characteristics to give them the same scale and range. For example, a standardization method can be used to map the values ​​of these characteristics to a defined interval.

[0036] After standardization, these features, with unified dimensions and units, are combined to generate the time series features of a single monitoring node within a data block unit. This time series feature integrates information from multiple aspects, including mean change trends, variance fluctuations, and correlations, and can comprehensively reflect the changing patterns of the monitoring node's data over time.

[0037] Step S123: Perform spatial correlation analysis on the data of different monitoring nodes in each data block unit, calculate the Euclidean distance based on the physical location coordinates of the nodes, calculate the mutual information value by combining the joint probability distribution matrix, generate the spatial distance attenuation coefficient through the distance attenuation function, and calculate the synchronization index of data changes between nodes through the Pearson correlation coefficient to generate spatial correlation characteristics.

[0038] Step S1231: Obtain the physical location coordinates of all monitoring nodes, construct a mapping table between node identifiers and coordinates, calculate the Euclidean distance between any two monitoring nodes, and generate a spatial location relationship matrix.

[0039] When conducting spatial correlation analysis, the first step is to obtain the physical coordinates of all monitoring nodes. In smart buildings, each monitoring node has a specific installation location. The physical coordinates of each monitoring node can be determined using the building's architectural drawings and sensor installation records. For example, in three-dimensional space, the position of each monitoring node is represented by coordinates (x, y, z).

[0040] A mapping table between node identifiers and corresponding physical location coordinates is constructed by associating the identifier of each monitoring node with its corresponding physical location coordinates. This mapping table allows for easy lookup of the physical location coordinates of a node based on its identifier, and vice versa.

[0041] Based on this mapping table, the Euclidean distance between any two monitoring nodes is calculated. Euclidean distance is a method for calculating the distance between two points in Euclidean space, which takes into account the positional relationship of the nodes in three-dimensional space. For any two monitoring nodes, the distance between them is calculated using the Euclidean distance formula based on their physical location coordinates.

[0042] The spatial location relation matrix is ​​constructed by constructing a matrix of Euclidean distances between any two monitoring nodes. Each row and column of the spatial location relation matrix corresponds to a different monitoring node, and the elements in the matrix are the Euclidean distances between the corresponding two monitoring nodes. The spatial location relation matrix can intuitively display the spatial relationships between all monitoring nodes.

[0043] Step S1232: For any two monitoring nodes' original data units within a data block unit, construct a two-dimensional joint probability distribution matrix, and calculate the mutual information value based on the information entropy formula. The mutual information value is used to quantify the degree of information sharing between nodes.

[0044] For any two monitoring nodes within a single data block, a two-dimensional joint probability distribution matrix needs to be constructed. Taking two power sensors on different floors of a building as an example, each sensor collects power consumption data within a single data block. The data collected by these two sensors is processed, and the frequency of different value combinations is statistically analyzed. For example, the number of times the power consumption collected by the first sensor is one value while the power consumption collected by the second sensor is another value is counted. This count is divided by the total number of data points to obtain the probability of different value combinations. These probabilities are then arranged into a two-dimensional joint probability distribution matrix according to a predetermined rule.

[0045] Based on the information entropy formula, the mutual information value is calculated using the two-dimensional joint probability distribution matrix. Information entropy is an indicator of the uncertainty of a random variable, while mutual information is an indicator of the degree of information sharing between two random variables. The mutual information value is obtained by calculating and processing the elements in the two-dimensional joint probability distribution matrix. This mutual information value quantifies the degree of information correlation between the data from the two monitoring nodes. A larger mutual information value indicates that there is more information shared between the data from the two monitoring nodes, and their data changes may be correlated; a smaller mutual information value indicates a weaker correlation between the data from the two monitoring nodes, and their data changes are relatively independent.

[0046] Step S1233: Construct a distance decay function with Euclidean distance as the independent variable and mutual information as the dependent variable. Calculate the slope parameter of the function through regression analysis to obtain the spatial distance decay coefficient, which reflects the degree of influence of spatial distance on the correlation of node data.

[0047] After obtaining the Euclidean distance and mutual information value between any two monitoring nodes, a distance decay function is constructed with the Euclidean distance as the independent variable and the mutual information value as the dependent variable. The form of the distance decay function can be chosen according to the actual situation, such as a linear function, an exponential function, etc.

[0048] Regression analysis was used to fit the distance decay function. Regression analysis is a method to find the best-fit curve using data points. The Euclidean distance and mutual information values ​​of all monitoring node pairs were used as data points and substituted into the distance decay function. By continuously adjusting the parameters of the function, it was made to fit the data points as closely as possible.

[0049] During the fitting process, the slope parameter of the function is calculated. This slope parameter is the spatial distance attenuation coefficient, which reflects the rate at which the mutual information value between two monitoring nodes decreases as the spatial distance between them increases. The larger the spatial distance attenuation coefficient, the more significant the impact of spatial distance on the correlation of node data; that is, as the spatial distance increases, the correlation between data between nodes weakens rapidly. Conversely, the smaller the spatial distance attenuation coefficient, the smaller the impact of spatial distance on the correlation of node data; even if the spatial distance increases, the correlation between data between nodes remains relatively strong.

[0050] Step S1234: Perform time alignment processing on the data change curves of the two monitoring nodes, calculate the degree of linear correlation between the curves using the Pearson correlation coefficient calculation formula, and generate a synchronization index to characterize the consistency of the data change trend of the nodes.

[0051] To accurately calculate the correlation between the data change curves of two monitoring nodes, time alignment is required. Since the two monitoring nodes may have different data acquisition times, directly calculating their correlation may yield inaccurate results. Therefore, the data change curves of these two monitoring nodes are adjusted to align them in time. For example, the starting time points of the two data change curves are found and aligned so that data at the same time point correspond.

[0052] After time alignment, the Pearson correlation coefficient formula is used to calculate the degree of linear correlation between the two curves. The Pearson correlation coefficient is an indicator that measures the strength of the linear relationship between two variables; its calculation is based on the covariance and standard deviation of the two variables. For the data change curves of these two monitoring nodes, the covariance and standard deviation are calculated by statistically analyzing their data values ​​at various time points, thus obtaining the Pearson correlation coefficient. The coefficient ranges from -1 to 1. When the coefficient is close to 1, it indicates a strong positive linear correlation between the two curves, meaning the data trends of the two monitoring nodes are highly consistent. This may be because they are affected by the same factors, such as the similar effects of equipment operation in the same area on the data from the two sensors in a building. When the coefficient is close to -1, it indicates a strong negative linear correlation between the two curves, meaning the data trends of the two monitoring nodes are completely opposite. When the coefficient is close to 0, it indicates almost no linear correlation between the two curves, suggesting that the data changes of the two monitoring nodes are relatively independent and may be affected by different factors. For example, one sensor monitors the power consumption of an elevator, while another monitors the power consumption of an air conditioner. Their operating mechanisms are different, and their data trends do not show a clear linear correlation. The Pearson correlation coefficient calculated in this way is the synchronicity index, which can intuitively characterize the consistency of the data trends of two monitoring nodes.

[0053] Step S1235: Organize mutual information values, spatial distance attenuation coefficients and synchronization indicators according to the form of monitoring node pairs to generate a feature set containing spatial correlation between nodes. Each feature item in the feature set is associated with a specific node identifier and timestamp.

[0054] After calculating the mutual information value, spatial distance attenuation coefficient, and synchronization index between any two monitoring nodes, this information needs to be organized to generate a feature set containing the spatial correlation between the nodes. This is organized according to monitoring node pairs; that is, for each pair of monitoring nodes, their corresponding mutual information value, spatial distance attenuation coefficient, and synchronization index are combined together. For example, for monitoring node A and monitoring node B, their mutual information value, spatial distance attenuation coefficient, and synchronization index are treated as a set of features and associated with the identifiers of node A and node B and their corresponding timestamps.

[0055] To record and manage this information more clearly, the feature information of all monitoring node pairs is aggregated into a feature set. Each feature is explicitly associated with a specific node identifier and a timestamp. The node identifier is used to uniquely identify each monitoring node, while the timestamp records the collection time corresponding to these feature information.

[0056] Step S124: Perform dimensional alignment processing on the time series features and spatial correlation features of the same data block unit to generate feature vector units containing timestamps, node identifiers, and feature dimensions.

[0057] After obtaining the time series features and spatial correlation features of the same data block unit, dimension alignment is required because the dimensions of these two features may be inconsistent. Taking the smart building carbon emission monitoring scenario as an example, the time series features are generated based on the data change patterns of a single monitoring node over time, and may include multiple dimensions such as mean change trend features, cumulative variance fluctuation amplitude, and correlation coefficient features; while the spatial correlation features are generated based on the spatial relationships between different monitoring nodes, and include dimensions such as mutual information value, spatial distance attenuation coefficient, and synchronization index.

[0058] Dimension alignment involves adjusting the dimensions of time-series features and spatial correlation features to match their quantity and type. For example, if a time-series feature has five dimensions and a spatial correlation feature has three dimensions, it may be necessary to expand the spatial correlation feature or compress the time-series feature to achieve dimensional consistency. In practice, dimensional alignment can be achieved through data processing methods such as feature selection, feature extraction, or feature combination.

[0059] After dimensional alignment, the time-series features and spatial correlation features are combined to generate a feature vector unit containing a timestamp, node identifier, and feature dimensions. The timestamp records the acquisition time corresponding to the feature vector unit, the node identifier is used to uniquely identify the corresponding monitoring node, and the feature dimensions contain all dimensional information of the time-series features and spatial correlation features after dimensional alignment.

[0060] Step S125: Concatenate the feature vector units of all data block units in chronological order to construct a target security feature set containing time series features and spatial correlation features.

[0061] After generating the feature vector units for each data block, these feature vector units are concatenated in chronological order. In the smart building carbon emission monitoring scenario, each data block corresponds to a specific time period, and its feature vector units contain the time-series features and spatial correlation features of the monitoring nodes within that time period. The feature vector units of the first data block, the second data block, and so on are concatenated sequentially in chronological order.

[0062] The splicing process combines individual feature vector units according to predefined rules to form a larger feature set. Since each feature vector unit contains information such as timestamps, node identifiers, and feature dimensions, the spliced ​​set retains the integrity of this information and is arranged chronologically to form a continuous feature sequence. The resulting target security feature set contains the temporal and spatial correlation features of all data block units, comprehensively reflecting the data changes of monitoring nodes over continuous time periods and the spatial relationships between different monitoring nodes.

[0063] Step S130: Call the pre-trained security risk detection model to perform abnormal pattern recognition processing on the target security feature set, and generate a security risk detection result containing the probability of abnormal occurrence and a description of abnormal features.

[0064] Step S131: Group the target security feature set according to the monitoring node identifier and timestamp to generate a feature input sequence with nodes as units and time as the sequence. Each feature input sequence contains the time series features and spatial correlation features of the corresponding node at different time points.

[0065] To facilitate the processing of the target safety feature set by the safety risk detection model, it is necessary to group it. The target safety feature set is grouped according to the monitoring node identifier and timestamp. In the smart building carbon emission monitoring scenario, each monitoring node has a unique identifier, and the timestamp records the data collection time. Through this grouping method, the data in the target safety feature set is divided according to the monitoring nodes, with each monitoring node corresponding to a set of data.

[0066] For each set of data, it is then arranged in chronological order according to timestamps to generate a feature input sequence with nodes as units and time as the sequence. For example, for a power sensor node in a building, the time series features and spatial correlation features corresponding to the data collected by the node at different time points are arranged together in chronological order to form a feature input sequence.

[0067] Each set of feature input sequences contains the time-series features and spatial correlation features of the corresponding node at different time points. The time-series features reflect the changing patterns of the node's own data over time, such as trends and fluctuations in power consumption; the spatial correlation features reflect the spatial relationships between the node and other nodes, such as mutual information values ​​and synchronization indicators. The feature input sequences generated in this way provide the safety risk detection model with more organized and easier-to-process input data, enabling the model to better analyze the safety risk situation of each monitoring node at different times.

[0068] Step S132: The feature input sequence is processed by the spatiotemporal feature extraction module of the security risk detection model. In the time dimension, the long-term dependency relationship of the time series features is captured by the gating mechanism of the recurrent neural network. In the spatial dimension, the propagation pattern of the spatial correlation feature between nodes is extracted by the adjacency matrix operation of the graph neural network, and a hidden state feature vector containing spatiotemporal correlation information is generated.

[0069] Step S1321: Input the time series features of a single monitoring node into the gated recurrent unit of the recurrent neural network in chronological order. Through the time-step propagation of the hidden layer state, extract the dependency relationship of features at different time points and generate the time hidden state vector of each time point. The time hidden state vector contains the temporal evolution information of the node data.

[0070] For the time-series features of a single monitoring node, they are input sequentially into a gated recurrent unit (GRU) of a recurrent neural network. A GRU is an improved recurrent neural network unit that controls the flow and retention of information through update and reset gates. At each time step, the GRU receives the input features of the current time point and the hidden layer state of the previous time step. The update gate determines how much information from the hidden layer state of the previous time step needs to be retained in the current time step, and the reset gate determines how much information from the hidden layer state of the previous time step needs to be reset.

[0071] As time progresses, the hidden layer state is passed step by step. During this process, the GRU learns the dependencies between features at different time points. For example, in smart building carbon emission monitoring, for a node monitoring power consumption, the GRU can learn the relationship between the current power consumption and the power consumption at previous time points. If the power consumption at previous time points has been continuously increasing, the GRU will predict the power consumption at the current time point based on this trend.

[0072] Through the aforementioned time-step propagation and learning, GRU generates a temporal hidden state vector for each time point. This temporal hidden state vector contains the temporal evolution information of the node data before that time point, integrating the feature information of previous time points and the dependencies between them, and can reflect the changing trends and patterns of the node data. For example, the temporal hidden state vector may reflect information such as whether power consumption is gradually increasing, decreasing, or remaining stable, as well as the rate and periodicity of these changes.

[0073] Step S1322: Construct a weighted undirected graph of the spatial association features of all monitoring nodes, where each node is a monitoring node and the edge weights are the mutual information value, spatial distance decay coefficient, and synchronization index in the spatial association features. Input the graph convolutional layer of the graph neural network, and extract the spatial propagation pattern between nodes through the convolution operation of the adjacency matrix and the feature matrix to generate the spatial hidden state vector of each node.

[0074] A weighted undirected graph is constructed from the spatial association features of all monitoring nodes. In this graph, each monitoring node is considered a node, and the edge weights between nodes are determined by the mutual information value, spatial distance attenuation coefficient, and synchronization index in the spatial association features. The mutual information value reflects the degree of data information sharing between two nodes, the spatial distance attenuation coefficient reflects the influence of spatial distance on the data association between nodes, and the synchronization index reflects the consistency of the data change trends between two nodes.

[0075] The weighted undirected graph is input into the graph convolutional layer of a graph neural network. The graph convolutional layer is one of the core layers of a graph neural network, utilizing an adjacency matrix and a feature matrix for convolution operations. The adjacency matrix describes the connections and edge weights between nodes, while the feature matrix contains the initial feature information of each node. Through the convolution operation between the adjacency matrix and the feature matrix, the graph convolutional layer can aggregate information from neighboring nodes and learn the propagation pattern of spatial association features between nodes.

[0076] During convolution operations, graph convolutional layers perform weighted summation of features from adjacent nodes based on edge weight information in the adjacency matrix. For example, if the mutual information value between two nodes is large, it indicates a strong data correlation between them, and the features of these two nodes will be assigned higher weights in the convolution operation. Through multiple convolution operations, graph convolutional layers can gradually learn the propagation patterns of spatial correlation features between nodes, such as how anomaly information from one node propagates to other nodes through spatial correlation.

[0077] Finally, the graph convolutional layer generates a spatial hidden state vector for each node. This vector contains information about the spatial propagation pattern between the node and other nodes, integrating information such as the node's position in the graph structure, its association with neighboring nodes, and the propagation of spatial association features. For example, the spatial hidden state vector might indicate whether a node is at the source, intermediate, or terminal point during anomaly propagation, as well as the intensity changes of the anomaly information during propagation.

[0078] Step S1323: Concatenate the temporal hidden state vector and spatial hidden state vector of each monitoring node at the same time point, and perform dimensional fusion through a fully connected layer to obtain a node fusion feature vector containing spatiotemporal information.

[0079] After obtaining the temporal and spatial hidden state vectors of each monitoring node at the same time point, they need to be concatenated. The concatenation operation combines the temporal and spatial hidden state vectors in a predetermined order to form a longer vector. This is because the temporal hidden state vector contains information about the evolution of node data over time, while the spatial hidden state vector contains information about the spatial propagation of node relationships; concatenating them integrates information from these two important dimensions.

[0080] After concatenation, the resulting vector is input into a fully connected layer for dimensionality fusion. A fully connected layer is a common layer in neural networks, where each neuron is connected to all neurons in the previous layer. In this scenario, the fully connected layer performs a series of linear transformations and non-linear activation operations on the concatenated vector. The linear transformation is achieved by multiplying the concatenated vector by the weight matrix of the fully connected layer and adding a bias term; this step allows for weighted combination of features from different dimensions. The non-linear activation operation uses a non-linear function, such as the ReLU function, to process the result of the linear transformation, introducing non-linearity and enabling the model to learn more complex feature relationships.

[0081] Through the processing of fully connected layers, temporal and spatial features that were originally pieced together but might have mismatched dimensions or insufficient feature fusion are further integrated to obtain a node fusion feature vector containing spatiotemporal information. This node fusion feature vector integrates information from both temporal and spatial dimensions, enabling a more comprehensive and accurate description of the state of each monitoring node at a specific point in time. For example, in a smart building carbon emission monitoring scenario, this node fusion feature vector can simultaneously reflect the temporal carbon emission change trend of a monitoring node and its spatial correlation with other nodes.

[0082] Step S1324: Arrange the node fusion feature vectors of all nodes in chronological order, input them into the spatiotemporal attention mechanism unit, calculate the attention weights between different time points and different nodes, and generate a hidden state feature vector containing global spatiotemporal correlation information by weighted summation. This hidden state feature vector integrates the mutual influence relationship of all nodes in the time and space dimensions.

[0083] After obtaining the node fusion feature vectors containing spatiotemporal information of all monitoring nodes, these vectors are arranged in chronological order. The purpose of this arrangement is to enable the spatiotemporal attention mechanism unit to clearly identify the characteristics of each node at different points in time, process the data in chronological order, and thus better capture the information changes and correlations in the time dimension.

[0084] The arranged node fusion feature vector is input into the spatiotemporal attention mechanism unit. The core function of the spatiotemporal attention mechanism unit is to calculate the attention weights between different time points and different nodes. Attention weight is an indicator that measures the importance of the features of a certain time point and node to the final result. When calculating attention weights, the spatiotemporal attention mechanism unit considers the spatiotemporal correlation between nodes. For example, in the scenario of smart building carbon emission monitoring, if the carbon emission data of a certain monitoring node shows abnormal fluctuations at a specific time point, and this node has a strong spatial correlation with other nodes, then the features of this time point and node may be assigned a higher attention weight in the calculation.

[0085] The specific calculation process involves the spatiotemporal attention mechanism unit performing a series of operations on the input node fusion feature vector. First, it transforms the input feature vector into a new feature space using a mapping function, making it easier to calculate the similarity between different features. Then, it calculates attention scores based on the similarity, reflecting the relative importance of nodes at different time points. Next, the attention scores are normalized and converted into attention weights, ensuring that the sum of all weights equals 1.

[0086] After obtaining the attention weights, a hidden state feature vector containing global spatiotemporal correlation information is generated through weighted summation. Weighted summation involves multiplying the fused feature vector of each node by its corresponding attention weight, and then summing all the results. This highlights the feature information of time points and nodes assigned higher attention weights, while weakening information with lower weights. The final generated hidden state feature vector integrates the mutual influence relationships of all nodes in the temporal and spatial dimensions. It comprehensively considers the state of each node at different times and the spatial correlations between nodes, and can comprehensively and accurately reflect the spatiotemporal characteristics of the entire monitoring system.

[0087] Step S133: Input the hidden state feature vector into the anomaly scoring module of the security risk detection model, calculate the difference between the current feature vector and the normal state baseline feature vector, and generate an anomaly score value by combining the preset scoring function.

[0088] The hidden state feature vector, containing global spatiotemporal correlation information, is input into the anomaly scoring module of the security risk detection model. The normal state baseline feature vector is obtained during the model training phase by learning and analyzing a large amount of monitoring data under normal conditions; it represents the characteristic pattern of the monitoring system during normal operation.

[0089] In the anomaly scoring module, the first step is to calculate the difference between the current input hidden state feature vector and the normal state baseline feature vector. This difference can be measured from multiple perspectives, such as the numerical differences across the various dimensions of the feature vector. In a smart building carbon emission monitoring scenario, multiple dimensions may be involved, including carbon emission data and electricity consumption data. For each dimension, the difference between the corresponding dimension values ​​of the current feature vector and the baseline feature vector is calculated, and then these differences are combined to obtain an overall measure of difference. For example, the difference between the two vectors can be measured by calculating Euclidean distance or Manhattan distance.

[0090] After obtaining the degree of difference, an anomaly score is generated by combining it with a preset scoring function. This preset scoring function is designed based on actual needs and historical data, mapping the degree of difference to a set scoring range. The scoring function may consider factors such as the magnitude of the degree of difference and the weight of differences in different dimensions. If the degree of difference is large, it indicates that the current feature vector deviates significantly from the normal pattern, and the scoring function will give a higher anomaly score; conversely, if the degree of difference is small, the anomaly score will be lower. This anomaly score is a quantitative representation of the degree of deviation of the current monitored data from the normal pattern.

[0091] Step S134: Based on the logistic regression model, map the anomaly score to the probability of anomaly occurrence, and establish a monotonically increasing functional relationship between the anomaly score and the probability of anomaly occurrence.

[0092] After obtaining the anomaly score, a logistic regression model is used to map it to the probability of an anomaly occurring. Logistic regression is a commonly used machine learning model suitable for handling binary classification problems; in this scenario, it determines whether an anomaly has occurred.

[0093] The core of a logistic regression model is a logistic function that transforms input anomaly scores into probability values ​​between 0 and 1. During model training, the parameters of the logistic regression model are adjusted and optimized using a large amount of historical data, including anomaly scores for both normal and abnormal data, as well as actual anomaly occurrences. The goal of training is to enable the model to accurately map anomaly scores to their corresponding anomaly probabilities.

[0094] The established monotonically increasing relationship between anomaly scores and the probability of anomalies means that as the anomaly score increases, the probability of anomalies also increases. For example, a low anomaly score indicates a smaller deviation from the normal pattern in the current monitoring data, and the logistic regression model will output a lower probability of anomalies. Conversely, a high anomaly score indicates a larger difference from the normal pattern, and the model will output a higher probability of anomalies. This monotonically increasing relationship aligns with reality, as a higher anomaly score represents a greater likelihood of anomalies. This mapping provides a more intuitive understanding of the probability of anomalies occurring in the current monitoring data.

[0095] Step S135: Through feature dimension difference analysis, identify the feature dimensions in the current hidden state feature vector that differ from the baseline feature vector by more than a preset threshold, record the dimension identifier and difference value, generate an abnormal feature description, and finally integrate them into the security risk detection result.

[0096] To gain a more detailed understanding of anomalies, feature dimension difference analysis is required. This involves comparing the current hidden state feature vector with the baseline feature vector of the normal state across each feature dimension. In a smart building carbon emission monitoring scenario, feature dimensions might include carbon emissions in different areas, electricity consumption over different time periods, etc.

[0097] For each feature dimension, the numerical difference between the current hidden state feature vector and the baseline feature vector in the corresponding dimension is calculated. These differences are then compared to a preset threshold. This preset threshold is determined based on experience and practical considerations during model training or real-world applications; it serves as a standard for judging whether a particular feature dimension exhibits anomalies. If the difference in a feature dimension exceeds the preset threshold, it indicates that that dimension has an anomaly.

[0098] Once a feature dimension with a difference exceeding a preset threshold is identified, its identifier and specific difference value are recorded. The dimension identifier can be the name or number of the feature dimension, used to identify which feature dimension is abnormal; the difference value specifically indicates the degree of deviation of the dimension from the normal pattern. For example, in the carbon emission feature dimension, if the value of the current hidden state feature vector is higher than the value of the baseline feature vector by a certain amount, the higher value is recorded.

[0099] The dimensional identifiers and variance values ​​of these records are organized and processed to generate anomaly feature descriptions. These descriptions detail which specific feature dimensions the anomalies occur in and the degree of abnormality in each dimension. Finally, the anomaly occurrence probabilities and anomaly feature descriptions are integrated to form a complete security risk detection result.

[0100] Step S140: Analyze the types of anomalies existing in the data monitoring platform and the characteristics of the propagation path of the anomalies in the monitoring node network based on the security risk detection results.

[0101] After obtaining the security risk detection results, it is necessary to analyze the types of anomalies existing in the data monitoring platform and the characteristics of the propagation path of the anomalies in the monitoring node network based on the security risk detection results.

[0102] Step S141: Analyze the abnormal feature descriptions in the security risk detection results, extract the feature dimensions involved in the anomaly and their corresponding difference values, and query the preset anomaly type mapping table. This anomaly type mapping table establishes a one-to-one correspondence between feature dimension combinations and anomaly types, thereby determining the specific type of the current anomaly.

[0103] The abnormal feature descriptions in the safety risk detection results are analyzed. The abnormal feature descriptions record in detail the feature dimensions involved in the anomaly and the corresponding difference values ​​of the dimensions. For example, in the scenario of carbon emission monitoring in smart buildings, the abnormal feature description may show that "the carbon emission feature dimensions of multiple areas fluctuate abnormally during non-working hours, and the power consumption of some areas does not match the equipment operating status."

[0104] The extracted anomaly features and their corresponding differences are compared with a pre-defined anomaly type mapping table. This pre-defined mapping table is derived from in-depth analysis and summarization of a large amount of historical anomaly data, establishing a one-to-one correspondence between different combinations of feature dimensions and specific anomaly types. For example, when multiple areas experience abnormal fluctuations in carbon emission features during non-working hours, and power consumption in some areas does not match equipment operating status, the mapping table might indicate an "energy distribution anomaly." If multiple monitoring indicators (such as temperature, humidity, and air quality) on a certain floor show anomalies simultaneously and are correlated, it might correspond to a "comprehensive environmental anomaly."

[0105] Through the above comparison and query, the specific type of the current anomaly can be accurately determined based on the combination of feature dimensions.

[0106] Step S142: Taking the monitoring node that detected the anomaly as the starting node, based on the spatial correlation characteristics of the monitoring node network, traverse all adjacent nodes that are spatially correlated with the starting node, calculate the synchronization index and mutual information value between nodes at the time of the anomaly occurrence, and use them as the basis for assessing the propagation probability.

[0107] The monitoring node that detects an anomaly is identified as the starting node. In a smart building carbon emission monitoring scenario, this starting node might be a node where a sensor detects anomalies in data such as carbon emissions or electricity consumption.

[0108] Based on the spatial association characteristics of the monitoring node network, the process begins by traversing all adjacent nodes spatially associated with the starting node. These spatial association characteristics include information such as the spatial location relationships between nodes, mutual information values, spatial distance attenuation coefficients, and synchronization indices. This information allows us to determine which nodes are adjacent to the starting node and spatially associated with it.

[0109] For each adjacent node, a synchronization index and mutual information value are calculated between the nodes at the time of the anomaly. The synchronization index reflects the consistency of the data change trends between the two nodes, while the mutual information value quantifies the degree of information sharing between the nodes. Calculating these indices at the time of the anomaly allows for an accurate assessment of the likelihood of anomaly information from the originating node propagating to adjacent nodes. For example, a high synchronization index indicates that the data change trends of adjacent nodes are similar to those of the originating node, making anomaly propagation more likely; a high mutual information value indicates a strong data correlation between the two nodes, making anomaly propagation more probable.

[0110] The calculated synchronization index and mutual information value are used as the basis for assessing the propagation probability. Through comprehensive analysis of these indicators, it is possible to preliminarily determine which neighboring nodes are more likely to be affected by the anomaly of the starting node.

[0111] Step S1421: Obtain the unique identifier of the monitoring node that detected the anomaly as the initial node, retrieve all adjacent nodes that are directly connected to the initial node from the spatial association feature set, and generate the first layer propagation node set.

[0112] Obtain the unique identifier of the monitoring node that detected the anomaly; this identifier serves as the node's unique identification information within the entire monitoring system. In the smart building carbon emission monitoring scenario, each sensor has a specific number as a unique identifier. The monitoring node exhibiting the anomaly is selected as the initial node.

[0113] The system retrieves all neighboring nodes directly connected to the initial node from the spatial association feature set. This set contains spatial association information between all monitored nodes, such as mutual information values, spatial distance attenuation coefficients, and synchronization indices. This information allows the system to determine which nodes have a direct spatial association with the initial node. For example, a large mutual information value between two nodes indicates a strong data association and a high probability of a direct connection.

[0114] All adjacent nodes that are directly connected to the initial node are grouped together to generate a first-level propagation node set. The nodes in this first-level propagation node set are those that are closest to the initial node and are most likely to be affected by the anomaly first. The anomaly propagation path will be further expanded based on this first-level propagation node set.

[0115] Step S1422: For each adjacent node, extract the original data within a preset time period before and after the time point of the anomaly occurrence, calculate the synchronization index and mutual information value between the adjacent node and the initial node within the preset time period before and after, and generate a propagation probability score through a linear combination formula. The parameters of the linear combination formula are determined based on training with historical data.

[0116] For each adjacent node in the first-layer propagation node set, extract raw data within a preset time period before and after the anomaly occurrence. The preset time period is determined based on actual conditions and experience; for example, it can be set as several data collection cycles before and after the anomaly occurrence. In a smart building carbon emission monitoring scenario, raw data such as power consumption and carbon emissions may be extracted within several hours before and after the anomaly occurrence.

[0117] Calculate the synchronicity index and mutual information value between the adjacent node and the initial node within a preset time period before and after the initial node. The synchronicity index can be obtained by aligning the data change curves of the two nodes over time and then using the Pearson correlation coefficient formula, which reflects the consistency of the data change trends of the two nodes; the mutual information value is obtained by constructing a two-dimensional joint probability distribution matrix and calculating it based on the information entropy formula, which quantifies the degree of information sharing between the two nodes.

[0118] A propagation probability score is generated by combining standardized values ​​of the synchronicity index and mutual information value using a linear combination formula. The linear combination formula may take the form: Propagation Probability Score = a * Synchronicity Index + b * Mutual Information Value, where a and b are parameters determined based on historical data training. During the training phase, a and b are optimized using machine learning algorithms based on a large amount of historical data, including known anomaly propagation scenarios and their corresponding synchronicity indices and mutual information values, ensuring that the linear combination formula accurately reflects the probability of anomaly propagation. This propagation probability score is a quantitative assessment of the likelihood that neighboring nodes are affected by the anomaly of the initial node.

[0119] Step S1423: Incorporate neighboring nodes whose propagation probability scores are higher than the set score threshold into the next layer of propagation node set to construct a hierarchical propagation path expansion structure.

[0120] After obtaining the propagation probability score for each neighboring node, it is compared with a set scoring threshold. The scoring threshold is determined based on actual needs and experience, and it serves as a standard for judging whether a neighboring node is more likely to be affected by abnormal propagation.

[0121] Neighboring nodes whose propagation probability scores are higher than a set score threshold are included in the next layer of propagation node set, thus forming a hierarchical propagation path expansion structure. Starting from the initial node, the first layer of propagation node set consists of nodes that are directly adjacent to the initial node and have a high propagation probability. The next layer of propagation node set consists of nodes that are more likely to propagate abnormally, further filtered based on the first layer of nodes.

[0122] Step S1424: Expand the propagation nodes layer by layer according to the above method. Each layer searches for the next layer's adjacent nodes based on the spatial association features of the current node until there are no nodes that meet the conditions or the preset maximum number of expansion layers is reached, generating a set of abnormal propagation candidate paths containing multi-level node sequences.

[0123] Following the method described above, the propagation nodes are continuously expanded layer by layer. Each layer is based on the nodes of the current layer, and based on the spatial association characteristics of the monitoring node network, neighboring nodes that are spatially associated with these nodes are retrieved.

[0124] For each node in the current layer, calculate the propagation probability score of its neighboring nodes. Neighboring nodes with scores higher than a set threshold are included in the next layer's propagation node set. This process is repeated until no node meets the criteria (i.e., all neighboring nodes' propagation probability scores are lower than the threshold) or the preset maximum expansion layer is reached. The preset maximum expansion layer is to control the extent of propagation path expansion and avoid infinite expansion.

[0125] Finally, a set of anomaly propagation candidate paths is generated, containing multi-level node sequences. Each path in this set represents a possible anomaly propagation path, including nodes starting from the initial node, passing through multiple levels, and the propagation relationships between each pair of adjacent nodes.

[0126] Step S1425: For each candidate path in the set of candidate paths for abnormal propagation, record the complete node identifier sequence, the precise timestamp of the abnormal occurrence of each node, the propagation time interval between adjacent nodes, and the synchronization index and mutual information value of each pair of adjacent nodes in the candidate path, as the basic feature data of the candidate path.

[0127] For each candidate path in the set of anomaly propagation candidate paths, detailed basic characteristic data needs to be recorded. First, a complete sequence of node identifiers is required, which clearly shows the specific nodes the anomaly passes through as it propagates within the monitoring node network. In the smart building carbon emission monitoring scenario, each monitoring node has a unique identifier; these identifiers are arranged in the propagation order to generate a complete sequence of node identifiers.

[0128] Next, the precise timestamps of each node's anomaly occurrence are recorded. These timestamps record the exact time an anomaly occurred at each node; accurate timestamp information helps analyze the timing patterns of anomaly propagation. For example, it can determine whether the anomaly propagates rapidly or slowly, and whether there is a time delay.

[0129] Simultaneously, the propagation time interval between adjacent nodes is calculated and recorded. The propagation time interval refers to the time it takes for an anomaly to propagate from one node to its neighboring nodes. Analyzing this time interval reveals the speed and efficiency of anomaly propagation. A shorter propagation time interval indicates rapid anomaly propagation, potentially requiring timely control measures; a longer propagation time interval allows more time to develop response strategies.

[0130] In addition, the synchronization index and mutual information value of each pair of adjacent nodes in the candidate path are recorded. The synchronization index reflects the consistency of the data change trends of adjacent nodes, while the mutual information value quantifies the degree of information sharing between adjacent nodes. These indicators can further illustrate the degree of correlation between adjacent nodes, as well as the possibility and strength of anomalies propagating between them. For example, if a pair of adjacent nodes has a high synchronization index and a large mutual information value, it indicates that the correlation between these two nodes is very strong, and anomalies can easily propagate between them.

[0131] These complete node identifier sequences, the precise timestamps of each node's anomaly occurrence, the propagation time intervals between adjacent nodes, and the synchronization indicators and mutual information values ​​of each pair of adjacent nodes are combined to form the basic feature data of the candidate path.

[0132] Step S143: For each candidate propagation path, analyze the time series of the probability of anomalies occurring at each node on the path, determine whether the time of anomaly occurrence conforms to the sequential propagation pattern from the starting node to the adjacent nodes, and whether there is a time delay in the peak probability of anomalies at adjacent nodes, thereby screening propagation paths with time consistency.

[0133] For each candidate propagation path in the set of candidate propagation paths for anomalies, an in-depth analysis of the time series of anomaly occurrence probabilities at each node along the path is required. In the scenario of smart building carbon emission monitoring, the anomaly occurrence probability of each monitoring node changes continuously over time. Arranging these probability values ​​in chronological order generates a time series of anomaly occurrence probabilities.

[0134] First, determine if the anomaly occurrence times conform to the propagation pattern from the starting node to adjacent nodes. Normally, an anomaly should originate at the starting node and gradually propagate to neighboring nodes. Therefore, the anomaly at the starting node should occur earliest, followed by anomalies at adjacent nodes in sequence. By comparing the timestamps of the anomalies at each node, we can determine if this propagation pattern is followed. If, in a candidate path, the anomaly occurrence time of an adjacent node is earlier than that of the starting node, then this path does not conform to the normal propagation pattern and needs to be eliminated.

[0135] Secondly, observe whether there is a time delay in the peak anomaly probability of adjacent nodes. When an anomaly propagates from one node to an adjacent node, the anomaly probability of the adjacent node usually gradually increases over time, reaches a peak, and then gradually decreases. Generally, the peak anomaly probability of adjacent nodes should appear after the peak anomaly probability of the starting node, with a certain time delay. This is because anomaly propagation takes time, and adjacent nodes are not immediately affected by the anomaly. By analyzing the timing of the peak anomaly probability of adjacent nodes, it can be determined whether the aforementioned time delay exists. If there is no significant time delay between the peak anomaly probability of adjacent nodes and the peak anomaly probability of the starting node, or if an unreasonable time sequence occurs, then the candidate path may not conform to the actual propagation situation and requires further evaluation or elimination.

[0136] By judging the time sequence of anomalies and the time delay of the peak anomaly probability of adjacent nodes, propagation paths with temporal consistency are selected.

[0137] Step S144: Extract the monitoring node identifier sequence, the propagation time interval between adjacent nodes, and the abnormal feature transmission intensity from the filtered propagation path to generate propagation path feature information.

[0138] After identifying propagation paths with temporal consistency, key information needs to be extracted from these paths to generate propagation path feature information. The first step is the monitoring node identifier sequence, which is a sequential arrangement of the node identifiers previously recorded during anomaly propagation. In the smart building carbon emission monitoring scenario, the monitoring node identifier sequence clearly shows the propagation trajectory of the anomaly between various monitoring nodes within the building. This sequence clearly identifies the specific route of anomaly propagation.

[0139] Next, the propagation time interval between adjacent nodes is extracted. The propagation time interval reflects the time it takes for an anomaly to spread from one node to its neighboring nodes, and it is an important indicator for analyzing the propagation speed of anomalies. By analyzing the propagation time interval between adjacent nodes, we can understand how quickly an anomaly propagates between different nodes, determine whether there are areas or links with relatively fast propagation speeds, and thus take timely control measures.

[0140] In addition, it is necessary to determine the intensity of anomaly propagation. Anomaly propagation intensity is an indicator that measures the degree of impact of an anomaly on adjacent nodes during its propagation. In the scenario of smart building carbon emission monitoring, anomalies may include abnormal increases in carbon emissions, abnormal fluctuations in power consumption, etc. The intensity of anomaly propagation intensity can be determined by comparing the characteristic differences between adjacent nodes before and after the anomaly propagation. For example, if an anomaly increases carbon emissions at one node, and adjacent nodes also show a significant increase in carbon emissions, and the magnitude of the increase is related to the correlation between that node and its adjacent nodes, then the intensity of anomaly propagation intensity can be determined based on the magnitude of these characteristic differences.

[0141] By combining the monitoring node identification sequence, the propagation time interval between adjacent nodes, and the intensity of abnormal feature transmission, propagation path feature information is generated.

[0142] Step S145: Associate the anomaly type with the corresponding propagation path feature information to generate an association analysis result that includes anomaly type, feature dimension, propagation node sequence, and propagation strength.

[0143] After determining the anomaly type and propagation path characteristics, they need to be correlated to generate more comprehensive correlation analysis results. The anomaly type is determined by parsing the anomaly feature descriptions in the security risk detection results and querying a pre-defined anomaly type mapping table, which clarifies the specific nature of the anomaly.

[0144] The propagation path characteristic information includes the monitoring node identification sequence, the propagation time interval between adjacent nodes, and the intensity of anomaly transmission, which describes in detail the propagation path and characteristics of the anomaly in the monitoring node network. Associating the anomaly type with the propagation path characteristic information means linking the nature of the anomaly with its propagation.

[0145] Step S150: Generate a security protection instruction containing node location identifier based on the anomaly type and the propagation path feature information, and send the security protection instruction to the control module of the data monitoring platform to trigger risk isolation operation.

[0146] Step S151: Query the preset protection strategy library, which stores the correspondence between exception types and protection measures, and extract the protection measure code and protection priority identifier associated with the current exception type.

[0147] The process of generating security protection commands begins by querying a pre-built protection strategy database. This database stores the correspondence between various possible anomaly types and their corresponding protection measures. These correspondences are derived through the analysis of extensive historical anomaly data and the summarization of expert experience.

[0148] In the scenario of smart building carbon emission monitoring, different anomaly types may correspond to different protective measures. For example, for "energy distribution anomalies," the protection strategy library may store protective measures such as readjusting the energy distribution plan and checking for faults in the energy transmission lines; for "comprehensive environmental anomalies," protective measures may correspond to activating environmental control equipment and conducting comprehensive testing of relevant areas.

[0149] Each protective measure has a corresponding protective measure code, which is a unique identifier used to refer to the protective measure when generating security protection instructions. At the same time, the protection policy library also stores protection priority identifiers, which indicate the importance and execution order of different protective measures. For example, for some urgent abnormal situations, the corresponding protective measures may have higher priority identifiers and need to be executed first.

[0150] Once the current anomaly type is determined, the associated protection measure code and protection priority identifier are extracted from the protection policy library. This information serves as a crucial basis for generating security protection instructions, ensuring that appropriate protection measures are taken for different anomaly types and executed according to the correct priority.

[0151] Step S152: Parse the monitoring node identifier sequence in the propagation path feature information, identify the initial node of the anomaly origin, the directly affected adjacent nodes, and the subsequent nodes that may be indirectly affected, and generate a node set containing all relevant node identifiers.

[0152] The monitoring node identifier sequence in the propagation path feature information is parsed. This sequence, recorded during the analysis of abnormal propagation paths, lists the identifiers of the monitoring nodes that passed through the abnormal propagation in the order they occurred. In the smart building carbon emission monitoring scenario, each monitoring node has a unique identifier, which allows for accurate location of the specific monitoring node.

[0153] The initial node from which the anomaly originates is identified from the monitoring node identifier sequence. The initial node is the first node where the anomaly is detected, and it is usually the source of the anomaly. For example, if a sensor on a certain floor of a building first detects an anomaly in carbon emissions or electricity consumption, then the node where that sensor is located is the initial node.

[0154] Next, the directly affected neighboring nodes are identified. Neighboring nodes are those spatially adjacent to the initial node and affected by the anomaly propagation. By analyzing information such as the propagation time interval and the intensity of anomaly transmission between neighboring nodes in the propagation path feature information, it is possible to determine which nodes are directly affected neighboring nodes.

[0155] In addition, it is necessary to identify subsequent nodes that may be indirectly affected. Subsequent nodes are those that may be indirectly affected by the anomaly through their neighboring nodes. Although their direct connection with the initial node is weak, they may still be affected by the anomaly.

[0156] The identifiers of the initial node from which the anomaly originated, the directly affected adjacent nodes, and the potentially indirectly affected subsequent nodes are combined to generate a node set containing all relevant node identifiers.

[0157] Step S153: For each node in the node set, based on the node's location in the corresponding propagation path and the intensity of abnormal feature transmission, a hierarchical strategy is adopted to assign a protection response level so that the protection level of each node matches its degree of impact.

[0158] For each node in the node set, a hierarchical strategy is needed to assign a protection response level based on its location in the corresponding propagation path and the intensity of anomaly transmission. In the scenario of smart building carbon emission monitoring, nodes in different locations may be affected by anomalies to varying degrees, and the intensity of anomaly transmission may also differ. Therefore, it is necessary to rationally allocate the protection response level based on these factors.

[0159] The initial node at the origin of the anomaly is typically assigned a higher protection response level because it is the source of the anomaly. For example, if the initial node is determined to be an "energy distribution anomaly," it may be assigned the first protection response level. The corresponding actions include immediately suspending the energy supply to the area to prevent the abnormal energy distribution from further expanding its impact; initiating a detailed energy audit procedure to conduct a comprehensive and in-depth review of the energy usage in the area; and performing an energy system status check every preset time period to ensure that all aspects of the energy system are operating normally.

[0160] For directly affected neighboring nodes, an appropriate protection response level may be assigned based on their distance from the initial node and the intensity of anomaly transmission. For example, if the initial anomaly type is "comprehensive environmental anomaly," and the initial node is assigned a second protection response level, the corresponding operations for neighboring nodes may include increasing the data acquisition frequency of environmental monitoring equipment to detect environmental changes more promptly; enabling real-time environmental anomaly diagnosis algorithms to analyze the node's environmental data in real time and promptly detect potential anomalies; and generating an environmental status report every preset time period.

[0161] For downstream nodes that may be indirectly affected, since they are relatively less affected by the anomaly, they may be assigned a lower protection response level. For example, if the anomaly involves energy, the corresponding actions may include activating an energy usage trend analysis mechanism to analyze whether there are abnormal trends in the energy usage of downstream nodes; and using a simple energy anomaly early warning algorithm for status monitoring to reduce system resource consumption while ensuring a certain level of detection capability.

[0162] The above-mentioned hierarchical strategy ensures that the protection level of each node matches the degree of impact, which can effectively deal with abnormal situations, make reasonable use of system resources, and avoid resource waste caused by over-protection.

[0163] Step S154: Associate the node identifier, protection response level, and corresponding specific operation to generate node protection information containing node location identifier and protection operation instructions.

[0164] After assigning a protection response level and determining the corresponding specific operation for each node in the node set, it is necessary to associate the node identifier, protection response level, and corresponding specific operation. The node identifier is a unique identifier for the monitoring node. In the scenario of smart building carbon emission monitoring, it can be the sensor number or a specific device identifier, which can accurately locate the specific monitoring node.

[0165] The protection response level clarifies the strength and priority of the protective measures that need to be taken for that node, with different protection response levels corresponding to different specific operations. For example, the first protection response level may correspond to immediately cutting off the data transmission channel and starting real-time full data monitoring; the second protection response level may correspond to increasing the data acquisition frequency and enabling real-time anomaly detection algorithms.

[0166] By combining the node identifier, protection response level, and corresponding specific operations, node protection information is generated, including node location identifiers and protection operation instructions. The node location identifier uniquely corresponds to the physical location coordinates and network communication address of the monitored node, ensuring that protection instructions are accurately sent to the corresponding node. The protection operation instructions detail the specific protection operations to be performed for that node, enabling the control module of the data monitoring platform to accurately implement protection measures based on these instructions.

[0167] For example, for a specific monitoring node, its node identifier is A, and its protection response level is the second protection response level. The corresponding specific operation is to increase the data acquisition frequency to a preset multiple of the normal frequency and enable the real-time anomaly detection algorithm. Linking this information together, the generated node protection information might be: Node identifier A, protection response level second, protection operation instruction: increase the data acquisition frequency to a preset multiple of the normal frequency, and enable the real-time anomaly detection algorithm. This node protection information is clear and concise, facilitating the subsequent generation of security protection instructions and the execution of protection operations.

[0168] Step S155: According to the predefined instruction format, integrate the protection measure code, protection priority identifier, node protection information and current timestamp to generate a structured security protection instruction. Each node positioning identifier in the structured security protection instruction can uniquely correspond to the physical location coordinates and network communication address of the monitoring node.

[0169] After obtaining the protection measure code, protection priority identifier, node protection information, and current timestamp, these elements need to be merged according to a predefined instruction format to generate a structured security protection instruction. The predefined instruction format ensures that the security protection instructions have a unified and standardized structure, facilitating recognition and processing by the control module of the data monitoring platform.

[0170] The protection measure code is extracted from a pre-defined protection strategy library and uniquely identifies the protection measure taken for the current exception type. The protection priority identifier indicates the importance and execution order of these protection measures, determining the order in which multiple protection measures need to be executed.

[0171] The node protection information includes the node location identifier, protection response level, and corresponding protection operation instructions for each monitoring node. The node location identifier uniquely corresponds to the physical location coordinates and network communication address of the monitoring node, ensuring that protection instructions can be accurately sent to the corresponding node.

[0172] The current timestamp records the specific time when the security protection command was generated, which helps the control module of the data monitoring platform to determine the timeliness of the command and ensure that the protection measures are executed at the appropriate time.

[0173] Following a predefined instruction format, the protective measure code is placed in a specific location. As the core part of the instruction, it clarifies the type of protective measure to be executed. The protection priority identifier is also placed according to the format requirements so that the control module executes protective measures in priority order.

[0174] For node protection information, arrange the relevant information of each node in the instruction according to the set rules. For example, the protection response level and protection operation instructions of each node can be listed in sequence according to the order of node identifiers. Thus, after receiving the instruction, the control module can clearly know which specific protection operations need to be performed for each node.

[0175] Finally, add the current timestamp to the specified position of the instruction to complete the integration of the entire instruction. The generated structured security protection instruction has a clear structure and definite content. Each node location identifier can accurately correspond to the physical location and network communication address of the monitoring node, ensuring that the protection instruction can be accurately sent to the target node.

[0176] For example, in the scenario of carbon emission monitoring in a smart building, assume that the protection measure code is "AB12", indicating a protection measure to reduce power consumption and carbon emissions in the relevant area; the protection priority identifier is "high"; the node protection information includes the relevant information of node A, node B, and node C. The protection response level of node A is the first protection response level, and the protection operation instructions are to cut off the data transmission channel, start real-time full-volume data monitoring, etc.; the protection response level of node B is the second protection response level, and the protection operation instructions are to increase the data collection frequency, enable real-time anomaly detection algorithms, etc.; the protection response level of node C is the third protection response level, and the protection operation instructions are to start a periodic data verification mechanism, use a lightweight anomaly detection algorithm for status monitoring, etc.; the current timestamp is "XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX​​​​​​​​​​​​​​​​​​​​​

[0184] The aforementioned structured security protection instructions can be accurately identified and processed by the control module of the data monitoring platform. The control module will quickly perform protection operations on the corresponding monitoring nodes based on the information in the instructions, thereby achieving effective isolation and handling of abnormal situations and ensuring the safe and stable operation of the entire data monitoring platform.

[0185] Step S156: Send the security protection command to the control module of the data monitoring platform to trigger the risk isolation operation.

[0186] After generating structured security protection commands, they need to be sent to the control module of the data monitoring platform. The control module of the data monitoring platform is the core control unit of the entire system. It is responsible for receiving and processing various commands and performing corresponding operations on the monitoring nodes according to the content of the commands.

[0187] In smart building carbon emission monitoring scenarios, safety protection commands include protective operation instructions for different monitoring nodes, such as cutting off data transmission channels, increasing data acquisition frequency, and activating anomaly detection algorithms. Upon receiving a safety protection command, the control module first parses it. During parsing, the control module extracts key information from the command, including protection measure codes, protection priority identifiers, node protection information, and timestamps.

[0188] Based on the protection priority identifier, the control module determines the order in which protection operations are performed. Nodes and protection measures with higher protection priorities are processed first. For example, if a node's protection response level is the first level, the corresponding protection operation includes immediately cutting off the data transmission channel. The control module will quickly send a cutoff command to that node to prevent the abnormal information from spreading further.

[0189] For each node in the node protection information, the control module sends specific operation instructions to the corresponding monitoring node based on its protection response level and protection operation instructions. For nodes that need to increase the data acquisition frequency, the control module sends an instruction to that node to adjust the data acquisition frequency; for nodes that need to activate the real-time anomaly detection algorithm, the control module triggers the corresponding algorithm program for that node.

[0190] During the execution of protective operations, the control module monitors the operation's progress in real time. If an operation fails, the control module records the error information and attempts to re-execute the operation or takes other backup measures. Simultaneously, the control module determines the timeliness of instructions based on timestamps. If an instruction has exceeded its preset validity period, the control module may refuse to execute the instruction and send a notification to the relevant management system.

[0191] By processing and executing security protection commands through the control module, risk isolation operations are achieved. Abnormal nodes are isolated from other normal nodes, allowing for timely detection and handling of anomalies, reducing their impact on the entire data monitoring platform, and ensuring the stable operation and data security of the smart building carbon emission monitoring system.

[0192] Figure 2 The diagram illustrates exemplary hardware and software components of an AI-based data monitoring platform security protection system 100, which implements the inventive concept, according to some embodiments of the present invention. For example, a processor 120 may be used in the AI-based data monitoring platform security protection system 100 and to perform the functions described in the present invention.

[0193] The AI-based data monitoring platform security protection system 100 can be a general-purpose server or a special-purpose server; both can be used to implement the AI-based data monitoring platform security protection method of this invention. Although only one server is shown in this invention, for convenience, the functions described in this invention can be implemented in a distributed manner on multiple similar platforms to balance the load.

[0194] For example, the AI-based data monitoring platform security protection system 100 may include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and various forms of storage media 140, such as a disk, ROM, or RAM, or any combination thereof. Exemplarily, the AI-based data monitoring platform security protection system 100 may also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The method of the present invention can be implemented according to these program instructions. The AI-based data monitoring platform security protection system 100 also includes an I / O interface 150 between the computer and other input / output devices.

[0195] For ease of explanation, only one processor is described in the AI-based data monitoring platform security protection system 100. However, it should be noted that the AI-based data monitoring platform security protection system 100 of this invention may also include multiple processors. Therefore, the steps executed by one processor described in this invention may also be executed jointly by multiple processors or individually. For example, if the processor of the AI-based data monitoring platform security protection system 100 executes steps A and B, it should be understood that steps A and B may also be executed jointly by two different processors or individually by one processor. For example, the first processor executes step A, the second processor executes step B, or the first processor and the second processor jointly execute steps A and B.

[0196] Furthermore, this embodiment of the invention also provides a readable storage medium, wherein computer-executable instructions are preset in the readable storage medium, and when the processor executes the computer-executable instructions, the above-mentioned data monitoring platform security protection method based on artificial intelligence is implemented.

[0197] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A security protection method for a data monitoring platform based on artificial intelligence, characterized in that, The method includes: Obtain the initial monitoring data set of the data monitoring platform. The initial monitoring data set contains raw data units with node identifiers and timestamps collected by different monitoring nodes within a continuous time period, specifically including electricity consumption data, gas usage data, and personnel flow data. Feature extraction is performed on the initial monitoring data set to obtain a target security feature set containing time series features and spatial correlation features. The time series features are used to characterize the change pattern of data from the same monitoring node in the time dimension, and the spatial correlation features are used to characterize the mutual influence relationship of data from different monitoring nodes in the spatial dimension. The pre-trained security risk detection model is invoked to perform abnormal pattern recognition processing on the target security feature set, generating a security risk detection result containing the probability of abnormal occurrence and a description of abnormal features; Based on the security risk detection results, analyze the types of anomalies present in the data monitoring platform and the characteristics of the propagation paths of the anomalies in the monitoring node network; Based on the anomaly type and the propagation path feature information, a security protection instruction containing node location identifier is generated, and the security protection instruction is sent to the control module of the data monitoring platform to trigger risk isolation operation; The feature extraction process on the initial monitoring data set yields a target security feature set containing time-series features and spatial correlation features, including: The initial monitoring data set is divided into time blocks according to a preset time interval to obtain multiple data block units with time continuity. Each data block unit contains raw data units collected by multiple monitoring nodes within the same time period. Time series analysis is performed on the data of a single monitoring node in each data block unit. The slope of the mean change curve, the cumulative value of variance fluctuation, and the main diagonal elements of the autocorrelation coefficient matrix of adjacent time points are calculated by using a sliding window to generate time series features. Spatial correlation analysis is performed on the data of different monitoring nodes in each data block unit. Euclidean distance is calculated based on the physical location coordinates of the nodes, mutual information value is calculated in combination with the joint probability distribution matrix, spatial distance attenuation coefficient is generated through distance attenuation function, and the synchronization index of data change between nodes is calculated through Pearson correlation coefficient to generate spatial correlation characteristics. The time series features and spatial correlation features of the same data block unit are dimensionally aligned to generate feature vector units containing timestamps, node identifiers, and feature dimensions. By concatenating the feature vector units of all data block units in chronological order, a target security feature set containing time series features and spatial correlation features is constructed.

2. The security protection method for an artificial intelligence-based data monitoring platform according to claim 1, characterized in that, The process involves performing time series analysis on the data from individual monitoring nodes within each data block unit. This is achieved by calculating the slope of the mean change curve, the cumulative variance fluctuation, and the main diagonal elements of the autocorrelation coefficient matrix for adjacent time points using a sliding window. This generates time series features, including: For the raw data units of a single monitoring node within a data block unit, a time series data sequence is constructed in timestamp order; The time series data sequence is subjected to forward and backward mean calculations using a sliding window with a preset window value to generate a mean change curve. The curve slope and curvature are then extracted as mean change trend features using a curve fitting algorithm. Calculate the overall variance of the time series data sequence, and calculate the variance difference between adjacent time points point by point, and sum them to obtain the cumulative value of variance fluctuation amplitude; The autocorrelation function is used to calculate the autocorrelation coefficients at different time intervals, a correlation coefficient matrix is ​​constructed, and the main diagonal elements and the largest off-diagonal element of the matrix are extracted as the correlation coefficient features of adjacent time points. By standardizing the processing to unify the dimensions and units of the mean change trend characteristics, cumulative variance fluctuation amplitude, and correlation coefficient characteristics, time series characteristics of a single monitoring node within a data block unit are generated.

3. The security protection method for an artificial intelligence-based data monitoring platform according to claim 1, characterized in that, The process involves spatial correlation analysis of data from different monitoring nodes within each data block unit. This includes calculating Euclidean distance based on the physical coordinates of the nodes, calculating mutual information values ​​using the joint probability distribution matrix, generating a spatial distance attenuation coefficient through a distance attenuation function, and calculating the synchronization index of data changes between nodes using the Pearson correlation coefficient. This generates spatial correlation characteristics, including: Obtain the physical location coordinates of all monitoring nodes, construct a mapping table between node identifiers and coordinates, calculate the Euclidean distance between any two monitoring nodes, and generate a spatial location relationship matrix; For any two monitoring nodes, a two-dimensional joint probability distribution matrix is ​​constructed within the data block unit. The mutual information value is calculated based on the information entropy formula. The mutual information value is used to quantify the degree of information sharing between nodes. A distance decay function is constructed with Euclidean distance as the independent variable and mutual information as the dependent variable. The slope parameter of the function is calculated through regression analysis to obtain the spatial distance decay coefficient, which reflects the degree of influence of spatial distance on the correlation of node data. The data change curves of the two monitoring nodes are time-aligned, and the linear correlation between the curves is calculated using the Pearson correlation coefficient formula to generate a synchronicity index, which is used to characterize the consistency of the data change trend of the nodes. The mutual information value, spatial distance attenuation coefficient and synchronization index are organized in the form of monitoring node pairs to generate a feature set containing the spatial relationship between nodes. Each feature item in the feature set is associated with a specific node identifier and timestamp.

4. The security protection method for an artificial intelligence-based data monitoring platform according to claim 1, characterized in that, The pre-trained security risk detection model is invoked to perform anomaly pattern recognition processing on the target security feature set, generating a security risk detection result containing the probability of anomaly occurrence and a description of anomaly features, including: The target security feature set is grouped according to the monitoring node identifier and timestamp to generate a feature input sequence with nodes as units and time as the sequence. Each feature input sequence contains the time sequence features and spatial correlation features of the corresponding node at different time points. The feature input sequence is processed by the spatiotemporal feature extraction module of the security risk detection model. In the time dimension, the long-term dependency relationship of the time series features is captured by the gating mechanism of the recurrent neural network. In the spatial dimension, the propagation mode of the spatial correlation feature between nodes is extracted by the adjacency matrix operation of the graph neural network, and a hidden state feature vector containing spatiotemporal correlation information is generated. The hidden state feature vector is input into the anomaly scoring module of the security risk detection model to calculate the difference between the current feature vector and the normal state baseline feature vector, and an anomaly score value is generated by combining the preset scoring function. Based on the logistic regression model, the anomaly score is mapped to the probability of anomaly occurrence, and a monotonically increasing functional relationship between the anomaly score and the probability of anomaly occurrence is established. By analyzing the differences in feature dimensions, we identify the feature dimensions in the current hidden state feature vector that differ from the baseline feature vector by more than a preset threshold, record the dimension identifier and the difference value, generate an abnormal feature description, and finally integrate them into the security risk detection result.

5. The security protection method for an artificial intelligence-based data monitoring platform according to claim 4, characterized in that, The spatiotemporal feature extraction module of the security risk detection model processes the feature input sequence. In the time dimension, it uses the gating mechanism of a recurrent neural network to capture long-term dependencies in the time series features. In the spatial dimension, it extracts the propagation pattern of spatial association features between nodes through adjacency matrix operations of a graph neural network, generating a hidden state feature vector containing spatiotemporal association information, including: The time-series features of a single monitoring node are input into the gated recurrent unit of the recurrent neural network in chronological order. By passing the hidden layer state step by step, the dependencies of features at different time points are extracted, and a time hidden state vector is generated for each time point. This time hidden state vector contains the temporal evolution information of the node data. The spatial association features of all monitoring nodes are constructed into a weighted undirected graph, where the nodes are monitoring nodes and the edge weights are the mutual information value, spatial distance decay coefficient and synchronization index in the spatial association features. The graph is input into the graph convolutional layer of the graph neural network, and the spatial propagation pattern between nodes is extracted through the convolution operation of the adjacency matrix and the feature matrix, generating the spatial hidden state vector of each node. The temporal and spatial hidden state vectors of each monitoring node at the same time point are concatenated and then dimensionally fused through a fully connected layer to obtain a node fusion feature vector containing spatiotemporal information. The node fusion feature vectors of all nodes are arranged in chronological order and input into the spatiotemporal attention mechanism unit. The attention weights between different time points and different nodes are calculated. The hidden state feature vector containing global spatiotemporal correlation information is generated by weighted summation. This hidden state feature vector integrates the mutual influence relationship of all nodes in the time and space dimensions.

6. The security protection method for an artificial intelligence-based data monitoring platform according to claim 1, characterized in that, The analysis of the anomaly types and propagation path characteristics of the anomalies in the monitoring node network based on the security risk detection results includes: The abnormal feature descriptions in the security risk detection results are analyzed, the feature dimensions involved in the anomaly and the corresponding difference values ​​are extracted, and the preset anomaly type mapping table is queried. This anomaly type mapping table establishes a one-to-one correspondence between feature dimension combinations and anomaly types, thereby determining the specific type of the current anomaly. Starting with the monitoring node that detected the anomaly, based on the spatial correlation characteristics of the monitoring node network, all adjacent nodes that are spatially related to the starting node are traversed, and the synchronization index and mutual information value between nodes at the time of the anomaly are calculated as the basis for assessing the propagation possibility. For each candidate propagation path, analyze the time series of the probability of anomalies occurring at each node on the path, determine whether the time of anomaly occurrence conforms to the sequential propagation pattern from the starting node to the adjacent nodes, and whether there is a time delay in the peak probability of anomalies at adjacent nodes, thereby screening propagation paths with time consistency. Extract the monitoring node identifier sequence, the propagation time interval between adjacent nodes, and the abnormal feature transmission intensity from the filtered propagation path to generate propagation path feature information; The anomaly type is associated with the corresponding propagation path feature information to generate association analysis results that include anomaly type, feature dimension, propagation node sequence, and propagation intensity.

7. The security protection method for an artificial intelligence-based data monitoring platform according to claim 6, characterized in that, The process begins with the monitoring node that detected the anomaly as the starting node. Based on the spatial correlation characteristics of the monitoring node network, it traverses all neighboring nodes spatially correlated with the starting node, calculates the synchronization index and mutual information value between nodes at the time of the anomaly occurrence, and uses this as a basis for assessing the propagation probability. This includes: Obtain the unique identifier of the monitoring node that detected the anomaly as the initial node, retrieve all adjacent nodes that are directly connected to the initial node from the spatial association feature set, and generate the first layer of propagation node set; For each adjacent node, the original data within a preset time period before and after the time point of the anomaly occurrence is extracted, and the synchronization index and mutual information value between the adjacent node and the initial node within the preset time period before and after are calculated. A propagation probability score is generated by a linear combination formula, the parameters of which are determined based on training with historical data. Neighboring nodes whose propagation probability scores are higher than a set score threshold are included in the next layer of propagation node set to construct a hierarchical propagation path expansion structure. The propagation nodes are expanded layer by layer according to the above method. Each layer searches for the next layer's adjacent nodes based on the spatial association features of the current node until there are no nodes that meet the conditions or the preset maximum number of expansion layers is reached, generating a set of abnormal propagation candidate paths containing multi-level node sequences. For each candidate path in the set of candidate paths for abnormal propagation, record the complete node identification sequence, the precise timestamp of the abnormal occurrence of each node, the propagation time interval between adjacent nodes, and the synchronization index and mutual information value of each pair of adjacent nodes in the candidate path, as the basic feature data of the candidate path.

8. The security protection method for an artificial intelligence-based data monitoring platform according to claim 1, characterized in that, The generation of security protection instructions containing node location identifiers based on the anomaly type and the propagation path feature information includes: Query the preset protection strategy library, which stores the correspondence between anomaly types and protection measures, and extract the protection measure code and protection priority identifier associated with the current anomaly type; The monitoring node identifier sequence in the propagation path feature information is analyzed to identify the initial node of the anomaly origin, the directly affected adjacent nodes, and the subsequent nodes that may be indirectly affected, and a node set containing all relevant node identifiers is generated. For each node in the node set, a hierarchical strategy is adopted to assign a protection response level based on the node's position in the corresponding propagation path and the intensity of abnormal feature transmission, so that the protection level of each node matches the degree of impact. The node identifier, protection response level, and corresponding specific operation are associated to generate node protection information that includes node location identifier and protection operation instructions; According to a predefined instruction format, a structured security protection instruction is generated by integrating protection measure codes, protection priority identifiers, node protection information, and the current timestamp. Each node location identifier in this structured security protection instruction can uniquely correspond to the physical location coordinates and network communication address of the monitoring node.

9. A data monitoring platform security protection system based on artificial intelligence, characterized in that, The system includes a processor and a memory, the memory and the processor being connected. The memory is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the memory to implement the data monitoring platform security protection method based on artificial intelligence as described in any one of claims 1-8.

Images