Environment supervision method and system based on edge cloud architecture

Abstract

The invention provides an environment supervision method and system based on an edge cloud architecture. The method comprises an edge end device and a cloud platform, wherein the edge end device is arranged on an environment supervision site; the execution steps of the side end device comprise: collecting a pollution source multi-modal data stream; according to the pollution source multi-mode data flow, triggering an alarm through a grading abnormity identification model; in response to the alarm, generating an evidence chain with a timestamp; extracting a monitoring deviation feature D, a behavior anomaly feature B and a semantic feature S according to the evidence chain; compressing the monitoring deviation feature D, the behavior anomaly feature B and the semantic feature S to generate a feature packet Z; and uploading the feature packet Z to a cloud platform. The cloud data matching performance can be effectively improved, and the false alarm rate is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of environmental supervision, and in particular, to an environmental supervision method and system based on an edge-cloud architecture. BACKGROUND

[0002] Pollution source non-site supervision technology gradually develops from single data monitoring to multi-source heterogeneous data fusion. The current mainstream supervision system collects monitoring data by deploying edge devices at polluting enterprises, and analyzes data based on a cloud platform.

[0003] In this supervision method, since edge devices are limited by storage capacity and computing resources, they are generally only responsible for collecting various data, and then transmitting the data to the cloud, where the data is analyzed and processed. Therefore, edge devices need to transmit a large amount of multi-modal raw data (especially video streams) to the cloud platform. However, the proportion of key features of abnormal events in raw data is extremely low, and the full amount of data needs to be uploaded to the cloud, resulting in a flood of invalid data that occupies bandwidth and network, and differences in format, protocol, etc. between data from different sources, forming "data islands", which leads to poor cloud data matching and high false alarm rates. SUMMARY

[0004] Therefore, the purpose of the present application is to provide an environmental supervision method and system based on an edge-cloud architecture to improve the technical problem of poor cloud data matching and high false alarm rates caused by edge devices transmitting raw data to the cloud platform.

[0005] To achieve the above purpose, the technical solutions adopted by the embodiments of the present application are as follows: In a first aspect, the present application provides an environmental supervision method based on an edge-cloud architecture, including an edge device and a cloud platform, wherein the edge device is located at an environmental supervision site. The execution steps of the edge device include: Collecting pollution source multi-modal data streams; Triggering an alarm through a hierarchical abnormality recognition model according to the pollution source multi-modal data streams; Generating a time-stamped evidence chain in response to the alarm; Extracting monitoring deviation features D, behavior abnormality features B, and semantic features S according to the evidence chain; Compressing the monitoring deviation features D, the behavior abnormality features B, and the semantic features S to generate a feature package Z; Uploading the feature package Z to the cloud platform.

[0006] Optionally, the step of triggering an alarm through a hierarchical abnormality recognition model according to the pollution source multi-modal data streams includes: Acquiring monitoring data, device state parameter time series data, access control records, real-time video streams; Performing change feature determination on the monitoring data and selecting whether to generate a monitoring data anomaly identifier according to a determination result; Performing threshold determination on the device state parameters and selecting whether to generate a device anomaly identifier according to a determination result; Performing period verification on the access control records and selecting whether to generate an access control anomaly identifier according to a verification result; Performing behavior analysis on the video streams and selecting whether to generate a video anomaly identifier according to a behavior analysis result; When at least any two of the monitoring data anomaly identifier, the device anomaly identifier, the access control anomaly identifier, and the video anomaly identifier are generated, triggering an alarm.

[0007] Optionally, the step of generating a timestamped evidence chain in response to the alarm comprises: Taking an alarm triggering time as a reference point, dynamically determining a starting point of a backtracking period according to an alarm type and setting an ending point; In the backtracking period, acquiring: a monitoring data sequence segment, a parameter snapshot of a device state change time, and a video key frame time marker related to an abnormal event; Formatting the acquired monitoring data sequence segment to generate a data class triple, formatting the acquired parameter snapshot to generate a state class triple, and formatting the video key frame time marker to generate a video class triple; According to the three types of triples, respectively adding timestamps to generate timestamped evidence items; The evidence items are sorted according to the order of the timestamps; According to the event correlation rules of the hierarchical anomaly recognition model, adding causal correlation markers between events; The sorted and marked evidence items are integrated into the evidence chain.

[0008] Optionally, the step of compressing the monitoring deviation feature D, the behavior anomaly feature B, and the semantic feature S to generate a feature package Z comprises: According to the monitoring deviation feature D, applying an attention mechanism to extract a key trend segment to generate a monitoring feature vector; According to the behavior anomaly feature B, processing an associated video segment through a space-time compression model to generate a behavior semantic feature vector; According to the semantic feature S, fusing an industry risk label associated with industry information to generate a semantic enhancement vector; Through a pre-training encoding matrix, the monitoring feature vector, the behavior semantic feature vector, and the semantic enhancement vector are unified to the same dimension to generate a low-dimensional feature tensor as the feature package Z.

[0009] Optionally, the execution step of the cloud platform comprises: After receiving the feature package Z, the feature package Z is matched and mapped with the environmental protection knowledge framework; According to the matching mapping result, multi-dimensional matching calculation is performed to generate a knowledge label set; According to the knowledge label set, a thinking chain prompt template is constructed; An analysis report is generated by driving a language model through the thinking chain prompt template and fed back to the edge device.

[0010] Optionally, the environmental protection knowledge framework comprises a basic layer, a mode layer and a strategy layer; and the step of receiving the feature package Z and matching and mapping the feature package Z with the environmental protection knowledge framework comprises: The regulatory provisions and pollutant standard limits in the basic layer are obtained; The behavior-data association rules of historical abnormal cases in the mode layer are obtained; The law enforcement process templates associated with laws and / or historical law enforcement cases in the strategy layer are loaded.

[0011] Optionally, the knowledge label set comprises an over-standard confidence K1, a behavior pattern similarity K2 and a semantic correlation degree K3; and the step of performing multi-dimensional matching calculation according to the matching mapping result to generate a knowledge label set comprises: The over-standard confidence K1 is calculated according to the feature package Z and the pollutant standard limits in the basic layer; The behavior pattern similarity K2 is calculated according to the feature package Z and the behavior-data association rules in the mode layer; The semantic correlation degree K3 is calculated according to the feature package Z and the law enforcement process templates in the strategy layer.

[0012] Optionally, the step of calculating the behavior pattern similarity K2 according to the feature package Z and the behavior-data association rules in the mode layer comprises: The monitoring data time sequence is parsed from the monitoring deviation feature D in the feature package Z; The historical abnormal template matching the behavior abnormal feature B is retrieved from the mode layer; The process cycle weight function corresponding to the enterprise industry type is loaded; The behavior pattern similarity K2 is generated according to the monitoring data time sequence, the historical abnormal template and the process cycle weight function.

[0013] Optionally, the step of calculating the semantic correlation degree K3 according to the feature package Z and the law enforcement process templates in the strategy layer comprises: Resolving a text description feature from the semantic feature S in the feature package Z; Extracting a correlation relationship chain from a law enforcement process template in the policy layer; According to the text description feature and the correlation relationship chain, language model coding is performed; According to the language model coding, the semantic correlation degree K3 is calculated.

[0014] Optionally, the step of constructing a thinking chain prompt template according to the knowledge label set comprises: According to the super-label confidence K1, matching legal provisions in the basic layer; According to the behavior pattern similarity K2, generating a cause-effect chain of abnormal events and related behaviors; According to the semantic correlation degree K3, outputting evidence priority and law enforcement steps.

[0015] Optionally, the step of generating an analysis report by driving a language model through the thinking chain prompt template and feeding back to the edge device comprises: Resolving data class triples, state class triples and video class triples in the evidence chain; Converting the video class triples into natural language behavior descriptions through a cross-modal semantic alignment model; Fusing the data class triples, the state class triples and the natural language behavior descriptions to generate enhanced input text; According to the thinking chain prompt template and the enhanced input text, calling a language model to generate an analysis report; Feeding back the analysis report to the edge device.

[0016] In a second aspect, embodiments of the present application provide an environment supervision system based on an edge-cloud architecture, comprising an edge device and a cloud platform, the edge device being signal connected with the cloud platform to implement the method of the first aspect.

[0017] In a third aspect, embodiments of the present application provide a storage medium, the storage medium storing a computer program, the computer program being executed by a processor to implement the method of the first aspect.

[0018] In a fourth aspect, embodiments of the present application provide a computer program product, comprising computer instructions, when the computer instructions run on an environment supervision system based on an edge-cloud architecture, the system executes the method of the first aspect.

[0019] In the method of the first aspect, the content can be understood as follows: The environment supervision method based on the edge cloud architecture provided in the application first dynamically filters pollution correlation characteristics based on an event-driven mechanism of a hierarchical anomaly identification model, accurately separates behavior anomaly characteristics B, monitoring deviation characteristics D and semantic characteristics S from original data streams, and eliminates most non-key data redundancy; secondly, time and space alignment fusion of multi-source heterogeneous data is realized through a timestamped evidence chain architecture, protocol normalization is completed locally at the edge, and data island barriers are completely broken; finally, multi-dimensional features are compressed into an entropy-optimized lightweight feature package Z by means of cross-modal feature distillation technology, so that the lightweight feature package Z becomes high-value density decision input that can be directly processed in the cloud, thereby completing the reconstruction of the edge cloud collaboration paradigm from 'data quagmire' to 'value path'.

[0020] In order to make the above-mentioned purposes, features and advantages of the application more obvious and easy to understand, the following will specifically describe the embodiments of the application, and the accompanying drawings will be described in detail as follows. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments of the application. It should be understood that the following drawings only show some embodiments of the application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0022] Figure 1 A structural schematic diagram of an environment supervision system based on an edge cloud architecture provided by the embodiments of the application; Figure 2 A flowchart of an environment supervision method based on an edge cloud architecture provided by the embodiments of the application; Figure 3 A flowchart of an environment supervision method based on an edge cloud architecture provided by the embodiments of the application; Figure 4 A flowchart of triggering alarm and generating evidence chain in an environment supervision method based on an edge cloud architecture provided by the embodiments of the application; Figure 5 A workflow diagram of a cloud platform in an environment supervision method based on an edge cloud architecture provided by the embodiments of the application. DETAILED DESCRIPTION

[0023] In order to make the purposes, technical solutions and advantages of the embodiments of the application more clear, the technical solutions in the embodiments of the application will be described clearly and completely in the following by combining the drawings in the embodiments of the application. Obviously, the described embodiments are some of the embodiments of the application, not all the embodiments. The components of the embodiments of the application described and shown in the drawings here can be arranged and designed in various different configurations.

[0024] The following detailed description of embodiments of the application in the drawings provided is not intended to limit the scope of the application claimed, but merely represents selected embodiments of the application. Based upon the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work are within the scope of protection of the present application.

[0025] It should be noted that similar reference numbers and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0026] It should be noted that the features in the embodiments of the present application can be combined with each other without conflict.

[0027] The embodiments of the present application provide a technical solution, which includes an environment supervision method and system based on edge cloud architecture. The technical solution provided by the present application will be described below in conjunction with the drawings.

[0028] First, a kind of environment supervision system based on edge cloud architecture provided by the embodiments of the present application is introduced, including edge device and cloud platform, edge device and cloud platform signal connection, constitute edge cloud collaborative structure. Edge device and cloud platform realize bidirectional communication by encrypted MQTT (Message Queuing Telemetry Transport, message queue telemetry transport) protocol. Wherein, edge device includes data acquisition module, data analysis module, data display module, edge cloud interaction module and edge system management module. Cloud platform includes data access module, knowledge management module, feature-knowledge matching module, model reasoning module, intelligent interaction module, data visualization module, law enforcement information push module and cloud system management module.

[0029] Among them, the edge device collects monitoring data, device status, access control records and video stream multi-modal data in real time through a multi-protocol communication interface (compatible with Modbus / OPC-UA / ISAPI / FPI, etc.), its built-in data analysis module uses a hierarchical processing mechanism (LSTM data anomaly detection + YOLOv8 behavior recognition model) to trigger abnormal alarm, and generates a timestamped structured evidence chain through logical backtracking, which is compressed into a lightweight feature package through feature distillation technology. At the same time, the data display module is equipped with digital station, operation atlas, alarm matrix and other multi-dimensional dashboards to present data and events in real time, while the edge-cloud interaction module uses a bidirectional message queue (based on MQTT protocol) to realize feature package uploading and cloud instruction receiving (including evidence supplementing instructions and Bluetooth unlocking control), and finally the edge system management module completes terminal configuration monitoring. The cloud platform receives edge data through the data access module and performs protocol conversion, the knowledge management module constructs a three-level knowledge framework (basic layer - national standard limit value / mode layer - case rule / strategy layer - law enforcement template) and dynamically updates the knowledge graph with the help of graph neural network, the feature-knowledge matching module uses attention mechanism, improved DTW algorithm and Sentence-BERT model to realize multi-dimensional matching (numerical anchoring / time sequence alignment / semantic association) of feature package and knowledge nodes and evidence chain integrity verification, the large model reasoning module generates structured reports containing causal analysis, article index (such as Article XX of the Environmental Protection Law) and law enforcement guidance based on the thinking chain prompt template, the intelligent interaction module provides natural language question and answer interface to realize semantic analysis and answer tracing, the data visualization module displays "one enterprise one file" and other supervision dashboards through PC and mobile phone, and the environmental supervision and law enforcement module automatically generates illegal warning list and tracks the disposal process, finally the system management module realizes the upgrade of all platform devices and permission control.

[0030] In addition to the fact that the edge device is limited by storage capacity and computing power resources, traditional environmental supervision methods can only perform shallow feature extraction and analysis on monitoring data, which cannot support the deep computing needs of complex models. A large amount of raw data (especially video streams) needs to be transmitted to the cloud platform, which is restricted by network delay, bandwidth, format and protocol differences of data from different sources, forming a "data island", resulting in poor cloud data matching, and further causing high false alarm rate. In addition to the above problems, the traditional environmental supervision method also has the following problems: First, the alarm events output by the traditional environmental supervision method are isolated alarm events (such as COD exceeding the standard, camera obstruction, etc.), law enforcement personnel need to manually associate scattered multi-dimensional alarm clues to construct evidence chain, lack of standardized causal reasoning framework, difficult to quickly lock down pollution responsibility subject, resulting in increased supervision department law enforcement cost and prolonged response cycle.

[0031] Secondly, in the scene of non-site supervision of pollution sources, the industry adaptability of general large models has significant bottlenecks: the lack of industry knowledge depth leads to the difficulty of accurately matching the actual supervision needs of the generated conclusions, which is manifested in the generalization of the cognition of industry-specific processes and pollutant risks; at the same time, limited by the narrow context window and insufficient text processing capability, it is difficult to effectively analyze the complex correlation of multi-modal field data (such as video behavior clips, device time sequence logs, and monitoring mutation components), which causes the abnormal evaluation to deviate from the supervision focus (such as misjudging device calibration drift as malicious tampering), and finally outputs decision suggestions with inaccurate analysis dimensions and weak operability, which is difficult to support high-precision law enforcement actions.

[0032] For the environmental supervision system based on the edge cloud architecture, it can implement an environmental supervision method based on the edge cloud architecture to solve the above problems, as follows: The edge device is arranged at the environmental supervision site, and the execution steps of the edge device include: S1, collecting pollution source multi-modal data stream.

[0033] The edge device collects four types of pollution source field data through industrial bus and network protocol: monitoring data stream, such as time sequence of COD, ammonia nitrogen and other parameters; device running state, such as analyzer temperature, pump current, and some device on-off state, device fault code, etc.; access control operation record, such as personnel access timestamp; video monitoring stream, which can be collected at 1080P resolution and 15fps frame rate. Of course, in other embodiments, the resolution and frame rate can be freely set according to actual conditions, without limitation. For example, the edge device of a sewage treatment plant collects COD value every 5 minutes, synchronously records the on-off state of the dosing pump and the video clip of the pump house area.

[0034] S2, triggering an alarm according to the pollution source multi-modal data stream through a hierarchical abnormality recognition model.

[0035] The multi-modal data is input into the pre-installed hierarchical abnormality recognition model. The hierarchical abnormality recognition model can include four categories of behavior abnormality, data abnormality, device abnormality, and operation and maintenance abnormality, which can be further divided into 13 dimensions and 40 small category model libraries of specific alarm scenes, to build a comprehensive abnormality perception framework. For example, the 13 dimensions can be classified as follows: Behavior abnormality can include three dimensions: environmental interference, monitoring point shielding, and illegal device operation; Data abnormality can include four dimensions: data instantaneous over-standard, data continuous over-standard, data mutation, and data stationarity destruction; Device abnormality can include four dimensions: parameter tampering, sensor failure, communication interruption, and power anomaly; Operation and maintenance abnormality can include two dimensions: calibration absence and maintenance record falsification.

[0036] 40Small categories can be classified as follows: Behavioral anomaly class: hanging bottle interference (hanging dilution water bottle on sampling tube), bypassing and discharging (enabling hidden drainage pipeline), camera blocking, probe wrapping (wrapping water quality probe with sponge, etc.), illegal entry into station house (unauthorized personnel entering monitoring station house), reagent replacement (changing standard reagent of analyzer), sampling tube insertion and removal, electromagnetic interference (such as using strong magnet to interfere with flow meter), abnormal activity at night (such as operating equipment during non-working hours), and fake sampling environment (such as injecting clean water into sampling point).

[0037] Data anomaly class: COD instantaneous over-standard, ammonia nitrogen continuous over-standard, pH value sudden change, flow zero value anomaly, total phosphorus periodic fluctuation, dissolved oxygen saturation, turbidity negative value, data freezing, noise over-standard, smoke concentration sudden drop, COD inversion, residual chlorine absence.

[0038] Equipment anomaly class: digestion temperature tampering, range modification, sensor displacement, light source attenuation, communication timeout, power fluctuation, memory overflow, clock anomaly, standard sample verification failure, back flushing failure.

[0039] Operation and maintenance anomaly class: over-calibration, false maintenance, expired reagent, waste liquid not disposed, missing inspection, log tampering, spare parts not replaced, and permission violation.

[0040] For example, for data over-standard events, COD can be set to trigger an alarm when it is greater than 100 mg / L (national standard limit 50 mg / L) for three consecutive times. For behavioral anomaly events, non-working hours access record can be set to trigger an alarm.

[0041] S3, in response to the alarm, a timestamped evidence chain is generated.

[0042] Data in a preset time period is intercepted, and then a timestamped triple evidence item is generated, and finally an evidence chain is generated in chronological order.

[0043] S4, according to the evidence chain, monitoring deviation features D, behavioral anomaly features B and semantic features S are extracted.

[0044] The monitoring deviation feature D is the core index for quantifying the degree of pollution, which is generated by mathematical modeling of the abnormal trend of the monitoring data sequence, representing the deviation degree of the pollutant concentration relative to the legal standard limit or process benchmark. The behavioral anomaly feature B is a spatiotemporal encoding of personnel violation operation, which is generated by collaborative analysis of access records and video streams, representing the structure vector of unauthorized behavior. The semantic feature S is the industry semantic label of the pollution scene, which is generated by fusing industry information such as enterprise basic information and pollution discharge permit data, representing the risk-weighted semantic encoding.

[0045] S5, compressing the monitoring deviation feature D, the behavior anomaly feature B, and the semantic feature S to generate a feature package Z.

[0046] The monitoring deviation feature D, the behavior anomaly feature B, and the semantic feature S are extracted from the evidence chain, and then compressed to generate a feature package Z, that is, the pollution degree is quantified by using the monitoring deviation feature D, the human factor is locked by using the behavior anomaly feature B, and the industry semantics is injected by using the semantic feature, and the three are fused into a lightweight feature package Z in feature distillation. Illustratively, the monitoring deviation feature D can include the deviation of the COD value relative to the average value of the previous 1 hour. The behavior anomaly feature B can include the interval time between the access control event and the data anomaly. The semantic feature S can include an enterprise industry type code.

[0047] S6, uploading the feature package Z to a cloud platform.

[0048] Illustratively, the feature package Z is uploaded to the cloud platform through the MQTT protocol.

[0049] The execution steps of the cloud platform include: S7, after receiving the feature package Z, matching and mapping the feature package Z with an environmental protection knowledge framework.

[0050] After receiving the feature package Z, the feature package Z is matched with a pre-stored environmental protection knowledge framework. Illustratively, the environmental protection knowledge framework can include a basic layer, a mode layer, and a strategy layer. The basic layer can compare the COD standard limit value, the mode layer can retrieve historical cases of regional invasion leading to COD exceeding the standard, and the strategy layer can associate the on-site inspection process of the Water Pollution Prevention and Control Law. For example: the matching result is 2.4 times exceeding the standard, which conforms to the “serious over-standard” mode, and is associated with Article 74 of the law (note that this is only an example, and it may not be associated with this article, and it may not be 2.4 times exceeding the standard, which is only used as a virtual example for easy understanding).

[0051] S8, according to the matching and mapping result, performing multi-dimensional matching calculation to generate a knowledge label set.

[0052] The label set can include: over-standard confidence K1, behavior mode similarity K2, and semantic correlation degree K3.

[0053] S9, constructing a thinking chain prompt template according to the knowledge label set.

[0054] By constructing the thinking chain prompt template according to the knowledge label set, a report is generated in three steps of “regulation matching-behavior explanation-evidence suggestion”. Compared with the traditional AI report which directly gives a conclusion without basis, the thinking chain prompt template of the embodiment can improve the completeness of the report causal chain, which is conducive to reducing the probability of legal reference errors.

[0055] S10, generating an analysis report by the thinking chain prompt template driven language model and feeding back to the edge device.

[0056] The thinking chain prompt template is constructed, for example, based on the confidence K1 exceeding the standard to match the legal provisions, combined with the behavior pattern similarity K2 to explain the cause and effect relationship, and the language model is driven to generate a report, such as: COD exceeds the standard due to illegal operation of the pump room, and needs to be checked according to the 74th clause. Finally, the cloud platform feeds back the report text to the edge device.

[0057] The technical solution provided in the present application first dynamically filters pollution correlation characteristics based on the event-driven mechanism of the hierarchical abnormality recognition model, accurately separates the behavior abnormality characteristics B, the monitoring deviation characteristics D and the semantic characteristics S from the original data stream, and eliminates most of the non-key data redundancy; secondly, the spatio-temporal alignment fusion of multi-source heterogeneous data is realized through the evidence chain architecture with time stamp, and the protocol normalization is completed locally at the edge, completely breaking down the data island barrier; finally, the multi-dimensional features are compressed into an entropy-optimized lightweight feature package Z by means of the cross-modal feature distillation technology, so that it becomes a high-value density decision input that can be directly processed by the cloud, thereby completing the reconstruction of the edge-cloud collaboration paradigm from “data quagmire” to “value path”.

[0058] In detail, based on the edge-generated evidence chain with time stamp, the traditional isolated alarm event is upgraded to a spatio-temporal correlated data chain (monitoring data + device status + video behavior), realizing complete process encapsulation of illegal behavior. Combined with the cloud, the report generation is driven by the thinking chain prompt template, and the minute-level automatic output of illegal behavior correlation analysis is realized. Compared with the traditional manual restoration of illegal behavior, the abnormal event backtracking period is greatly shortened. In addition, the lightweight transmission mechanism of the feature package (compression and upload of monitoring deviation characteristics D, behavior abnormality characteristics B and semantic characteristics S) and the cloud knowledge framework matching mapping form a two-way optimization, the edge only needs to transmit the core features, saving bandwidth, and the cloud does not need to compress the data collected by the edge, but can directly realize cross-scene correlation analysis based on the received feature package and the preset environmental protection knowledge framework, reducing the fragmented data checking work of law enforcement personnel, and directly outputting the complete decision basis.

[0059] In some embodiments, the environmental protection knowledge framework includes a basic layer, a pattern layer and a strategy layer; after receiving the feature package Z, the step of matching the feature package Z with the environmental protection knowledge framework includes: S71, acquiring the legal provisions and the standard limit value of the pollutant in the basic layer.

[0060] The pollutant standard limit value is imported from the national ecological environment standard database and stored as a key-value mapping table. The key-value pair is a basic data structure composed of a unique identifier and associated data. The unique identifier is used as an index for fast retrieval, and the associated data is used to store specific information. The mapping table is a collection of multiple key-value pairs, forming a structured query table. For example, in the scenario of matching COD exceeding standard data on the cloud platform: input the monitoring deviation feature D in the feature package Z, then perform key-value query, output the standard limit value, and calculate the exceeding standard according to the standard limit value, and finally according to the exceeding standard result, such as whether it exceeds the standard and the exceeding standard multiple, automatically query the legal basis.

[0061] S72, acquire the behavior-data correlation rule of the historical abnormal case in the mode layer.

[0062] The historical punishment case library is parsed to extract the behavior-data correlation rule. For example, entering the pump room during non-working hours and COD decreasing by more than 40% within 30 minutes, according to the behavior-data correlation rule, the current behavior suspicion level is determined to be level one, suspected of evading supervision.

[0063] S73, load the law enforcement process template associated with the legal and / or historical law enforcement case in the strategy layer.

[0064] The legal provisions are associated to generate the law enforcement process template. For example, the COD exceeding standard law enforcement process can be: on-site confirmation of sampling port location, retrieval of the last 3 calibration records of the analyzer, collection of parallel water samples for testing. Of course, it can also be associated with previous historical law enforcement cases or combine historical law enforcement cases and legal provisions to load the corresponding law enforcement process template.

[0065] It should be noted that matching and mapping the feature package Z with the environmental protection knowledge framework can include basic layer matching, mode layer matching, and strategy layer matching. Basic layer matching: extracting the monitoring deviation feature D from the feature package Z and querying the basic layer to obtain the corresponding limit value. Mode layer matching: analyzing the behavior abnormality feature B from the feature package Z and retrieving similar case rules in the mode library. Strategy layer matching: loading the corresponding law enforcement template according to the matching result.

[0066] In some embodiments, the knowledge tag set includes an exceeding standard confidence K1, a behavior pattern similarity K2, and a semantic correlation degree K3. The step of performing multi-dimensional matching calculation to generate a knowledge tag set according to the matching mapping result includes: S81, calculate the exceeding standard confidence K1 according to the feature package Z and the pollutant standard limit value in the basic layer.

[0067] The numerical value of the monitoring deviation feature D is extracted from the feature package Z, the corresponding limit value is queried from the basic layer, and the exceeding multiple is calculated. Illustratively, the measured COD is 65 mg / L, the limit value is 50 mg / L, and the exceeding multiple is equal to the measured value minus the limit value, and then divided by the limit value, that is, (65-50) / 50=0.3, which is 30% exceeding, that is, K1=30%. By upgrading the exceeding degree from qualitative description to quantitative index, the law enforcement personnel can quickly judge the priority of disposal, such as upgrading the serious exceeding to K1=0.3.

[0068] S82, calculating behavior pattern similarity K2 according to the behavior-data correlation rule in the pattern layer and the feature package Z.

[0069] The behavior anomaly feature B is analyzed from the feature package Z, such as the access control abnormal timestamp set. Then, the matching historical case is retrieved from the pattern layer, such as the matching rule of non-working period access control and COD sudden drop, and finally, the behavior sequence similarity, that is, the behavior pattern similarity K2, is calculated. K2=number of matching cases / total number of related cases. By using the similarity score to intuitively reflect the degree of coincidence between the current behavior and the historical illegal discharge pattern, the traditional experience guess is replaced.

[0070] S83, calculating semantic correlation degree K3 according to the law enforcement process template in the strategy layer and the feature package Z.

[0071] The semantic feature S is extracted from the feature package Z, the law enforcement template in the strategy layer is loaded, and the semantic correlation between the semantic feature S and the law enforcement template is calculated. Illustratively, the semantic feature S can include enterprise industry code, and the law enforcement template can include the illegal discharge process of wastewater in chemical enterprises. By using the correlation degree score to directly indicate the degree of fit between the law enforcement module and the current enterprise, the wrong application of the process is avoided.

[0072] Further, the step of calculating the exceeding confidence K1 according to the feature package Z and the pollutant standard limit value in the basic layer comprises: S811, extracting the monitoring feature vector value V of the monitoring deviation feature D from the feature package Z.

[0073] Illustratively, after the cloud platform receives the feature package Z uploaded by the edge device, the monitoring deviation feature D therein is analyzed, and three core numerical values are extracted: the current pollutant concentration value, the concentration change rate, and the reference deviation degree. For example: the COD exceeding event of a certain wastewater treatment plant is that the pollutant concentration value is 65, the concentration change rate is 0.32, and the reference deviation degree is 45.7.

[0074] S812, querying the pollutant standard limit value L corresponding to the monitoring deviation feature D from the basic layer.

[0075] According to the pollutant identification in the feature package Z, such as COD, the cloud pre-stored basic layer knowledge base is queried. Querying the cloud pre-stored basic layer knowledge base can include retrieving the national standard limit value of the pollutant and obtaining the associated regulatory provision index.

[0076] S813, calculate the Euclidean distance according to the monitoring feature vector value V and the pollutant standard limit value L.

[0077] First, the reference vector is constructed: taking the standard limit value L as the core, supplementing two ideal values (such as the change rate being 0 and the deviation degree being 0), and generating the reference vector [L, 0, 0]. Then, the weighted distance is calculated. The calculation formula of the weighted distance is: e =√∑ 3 i=1 w i (V i -L i ) 2 .

[0078] Corresponding to the specific parameters in this embodiment, the calculation formula of the weighted distance can be corresponded to: e =√[w1×(v1-L1) 2 +w2×(v2-L2) 2 +w3×(v3-L3) 2 .

[0079] Wherein, d e is the weighted Euclidean distance, w1 is the pollutant concentration weight, w2 is the concentration change rate weight, w3 is the reference deviation degree weight, v1 is the current pollutant concentration value, v2 is the concentration change rate, v3 is the reference deviation degree, L1 is the pollutant standard limit value, L2 is the change rate, and in this example, L2=0, L3 is the deviation degree, and in this example, L3=0.

[0080] S814, generate the over-limit confidence K1 according to the Euclidean distance.

[0081] Scaling mapping: the Euclidean distance is divided by the scaling factor α, and the over-limit confidence K1 is obtained, the result of K1 is limited between 0 and 1, if the result is greater than 1, K1 takes 1. Specifically, the calculation formula of the over-limit confidence K1 is: K1=min(d e / α,1).

[0082] From the calculation formula of the over-limit confidence K1, it can be known that the distance value d e of any dimension is converted into the dimensionless confidence score. α is related to the sensitivity of the over-limit confidence K1, the smaller α is, the greater K1 calculated by the same d e is, the over-limit confidence K1 is more sensitive; the greater α is, the smaller K1 calculated by the same d eThe smaller the calculated K1 is, the more relaxed the over-standard confidence K1 is.

[0083] For example, when the COD is slightly over-standard d e = 8, a = 20, K1 = min(8 / 20, 1) = min(0.4, 1) = 0.4. Based on K1 = 0.4, it can be judged that the current risk is medium risk, and the law enforcement response can be set to check within 24 hours. When the COD is seriously over-standard, d e = 25, a = 20, K1 = min(25 / 20, 1) = min(1, 1.25) = 1. Based on K1 = 1, it can be judged that the current risk is high risk, and the law enforcement response can be set to immediately start the emergency plan. When a false alarm occurs (such as rain interference), d e = 15 (actually diluted by rain), a = 30 (temporarily increase the threshold), K1 = min(15 / 30, 1) = min(0.5, 1) = 0.5. Based on K1 = 0.5, it can be judged that the current risk is medium risk, and the law enforcement response can be set to prioritize checking the equipment status to avoid false alarms.

[0084] In some embodiments, the step of calculating the behavior pattern similarity K2 according to the feature package Z and the behavior-data correlation rule in the pattern layer comprises: S821, resolving the monitoring data time sequence from the monitoring deviation feature D in the feature package Z.

[0085] After receiving the feature package Z in the cloud platform, first, the monitoring data time sequence in it is resolved. For example, the pollutant concentration sequence (such as COD value sequence) sorted by timestamp is obtained from the monitoring deviation feature D, and then key feature identification is performed, such as locating concentration mutation points and marking periodic fluctuations. The concentration mutation point can be set to a change rate of more than 10% / minute, and the periodic fluctuation can be identified by fast Fourier transform to identify the main fluctuation frequency. Finally, the timestamp is converted into relative time, taking the alarm triggering time as the reference point.

[0086] S822, retrieving a historical abnormal template matching the behavior abnormal feature B from the pattern layer.

[0087] Based on the encoding of the behavior abnormal feature B, a matching template is retrieved in the pattern layer. The retrieval layer can be set to a three-level retrieval mechanism, such as the first level: behavior code matching (such as code 105 corresponding to "regional intrusion"); the second level: pollutant type matching (such as COD / ammonia nitrogen); the third level: enterprise scale screening (day discharge volume ± 20% interval). Then template loading is performed, including obtaining the typical concentration curve of the historical case according to the results of the three-level retrieval, and then extracting key time parameters (such as mutation duration) according to the typical concentration curve.

[0088] Exemplarily, when the behavior code 105 is retrieved, the "certain sewage plant illegal discharge case" template is matched, and then template loading is performed to obtain the typical concentration curve of the historical case and extract the key time parameters.

[0089] S823, load the process cycle weight function corresponding to the enterprise industry type.

[0090] According to the enterprise registration information, the process cycle weight function specific to the industry is dynamically loaded. If it is a continuous production industry, such as a petrochemical plant, a 24-hour sinusoidal weight is used. Exemplarily, the process cycle weight function is η(t) = sin²(πt / 24) + 0.5 (24-hour period). If it is an intermittent production industry, such as an electroplating plant, a 6-hour exponential decay weight is used. Exemplarily, the process cycle weight function is η(t) = 1.5 (working period) / 0.5 (shutdown period) (step function).

[0091] In addition, dynamic parameter adaptation can also be performed, such as adjustment according to work shifts: the night shift weight of a three-shift enterprise is 1.2; seasonal factor compensation: the winter pollution prevention period weight is 1.3. For example: The electroplating plant produces at night, which is intermittent production, and the current time period is 22:10, which is the night shift working period. The function η(t) = 1.5 is loaded, the seasonal compensation is the winter pollution prevention period, and the maximum weight = 1.5 x 1.3 = 1.95.

[0092] S824, generate the behavior pattern similarity K2 according to the monitoring data time sequence, the historical abnormal template, and the process cycle weight function.

[0093] The behavior pattern similarity K2 is generated by the improved DTW algorithm. The specific calculation process is as follows: First, establish the time mapping of the current sequence and the template, with the constraint condition that the maximum time shift is less than 3 minutes (industrial scene threshold); Second, weighted distance calculation: single point distance = process weight η(t) x (current value - template value) 2 ; The total path distance is equal to the sum of multiple single point distances along the optimal path.

[0094] Third, similarity normalization, the similarity normalization formula is as follows: K2 = 1 / (1 + √total path distance).

[0095] In some embodiments, the step of calculating the semantic association degree K3 according to the feature package Z and the law enforcement process template in the policy layer comprises: S831, parse the text description feature from the semantic feature S in the feature package Z; S832, extract the association relationship chain from the law enforcement process template in the policy layer; S833, encode the language model according to the text description features and the association relationship chain; S834, calculate the semantic association degree K3 according to the language model encoding.

[0096] For example, the calculation process of the semantic association degree K3 is as follows: First, extract the text description field from the semantic features S of the feature package Z: the original text (such as the abnormal opening of the pump room at night), the associated entity (such as "pump room" and "night"). Perform text standardization: remove stop words ("of", "in", etc.), and normalize entities ("pump room" to "sewage pumping station"). For example: input text "COD analyzer cover is opened", standardized output "analyzer cover is opened illegally".

[0097] Second, retrieve the knowledge graph according to the core entity in the text (such as "analyzer cover"), and then extract the association relationship chain, such as tracing up: the analyzer cover is opened, associated with data tampering suspicion; trace down: data tampering, associated with violation of Article 42 of the Environmental Protection Law.

[0098] Third, use the Sentence-BERT model fine-tuned in the environmental protection field to perform text encoding and relationship chain encoding, generating text vectors and relationship chain vectors.

[0099] Fourth, calculate the semantic distance and association strength: The formula for calculating the semantic distance is: d sem =|vec feature -v KG |; The formula for calculating the association strength is: K3=1 / (1+d sem )。

[0100] Where vec feature is the text vector, specifically the mathematical representation of the text extracted from the semantic features S of the feature package Z after encoding by the Sentence-BERT model; v KG is the relationship chain vector, specifically the result of encoding the relationship chain stored in the cloud knowledge graph (KG) by the same Sentence-BERT model; d sem is the semantic distance, specifically the semantic difference between the text description and the knowledge relationship, the smaller the value, the more similar; K3 is the semantic association strength, specifically the matching degree of the text description and the knowledge relationship, the larger the value, the stronger the association.

[0101] In some embodiments, after receiving the feature package Z, the step of matching the feature package Z with the environmental protection knowledge framework mapping further comprises: evidence chain integrity verification. By verifying the integrity of the evidence chain, if a key evidence type is missing, a rule engine is triggered to generate a supplementary evidence instruction feedback to the edge device. Specifically, the evidence chain integrity verification comprises: Presetting a structured evidence chain standard rule library in the policy layer of the cloud platform; Parsing the event identifier in the evidence chain, and querying the evidence chain standard rule of the event type from the policy layer; Comparing the event identifier with the evidence chain standard rule, and evaluating the evidence integrity risk level according to the comparison result. For example, if all required evidence is complete, it can be determined as low risk; if one required evidence is missing, it can be determined as medium risk; if two or more required evidence is missing, it can be determined as high risk; Generating a verification report, which can list the provided evidence items, mark the missing evidence type, and give an integrity score; According to the missing evidence type, a rule in the preset structured evidence chain standard rule library is called, such as: if the key evidence type is operation log, an instruction of “retrieve operation records 30 minutes before and after the alarm time” is generated; if the key evidence type is video evidence, an instruction of “retrieve monitoring video 5 minutes before and after the alarm time” is generated; The called rule is structured and encapsulated, which includes: the instruction type is clearly indicated as “evidence supplement”, the specific missing evidence item is pointed out, the accurate time window is specified, the specific device to be operated is specified, and the relevant regulation clause is noted; The instruction is pushed to the edge device through an encrypted message queue; The edge device automatically performs the collection task. The specific content of the collection task is determined according to the missing evidence item. For example, if the video is missing, the collection task is to activate the specified camera playback; if the log is missing, the collection task is to connect the PLC to read the historical record; if the parameter is missing, the collection task is to remotely read the device configuration snapshot.

[0102] In some embodiments, the step of constructing a thinking chain prompt template according to the knowledge tag set comprises: S911, according to the super-standard confidence K1, match the legal provisions in the basic layer.

[0103] The over-limit confidence K1 is extracted from the knowledge tag set, and K1 is calculated from the feature bag Z and the basic layer pollutant limit value. For example, when K1≥0.8, the “serious violation” type clause is matched; when 0.5≤K1<0.8, the “general violation” type clause is matched; and when K1<0.5, the “administrative warning” type clause is matched. A fixed format sentence is generated in the rethinking chain template: According to the over-limit confidence K1, the {legal name} No. {clause number} is associated. For example, in the COD over-limit event, K1=0.93, the Water Pollution Prevention and Control Law No. 83 is matched.

[0104] S912, generating a causal chain of abnormal events and associated behaviors according to the behavior pattern similarity K2.

[0105] The behavior pattern similarity K2 is extracted from the knowledge tag set, representing the matching degree of the current behavior and the historical illegal pattern. For example: when K2≥0.7, a strong causal chain is generated: the specific behavior directly leads to {pollutant} over-limit; when 0.4≤K2<0.7, a medium causal chain is generated: the specific behavior may be related to {pollutant} over-limit; and when K2<0.4, a weak causal chain is generated: the specific behavior has low relevance to {pollutant} over-limit. Then the behavior occurrence time and data anomaly time are automatically inserted, such as 22:05 time intrusion in the pump room area, 22:08 time COD drop, and K2=0.88 at this time, then the pump room area intrusion at 22:05 directly leads to the COD drop at 22:08.

[0106] S913, outputting evidence priority and law enforcement steps according to semantic association degree K3.

[0107] In this embodiment, when K3≥0.8, the evidence level can be defined as key evidence, and the processing mode is to be processed immediately; when 0.5≤K3<0.8, the evidence level can be defined as important evidence, and the processing mode is to be processed within 24 hours; and when K3<0.5, the evidence level can be defined as reference evidence, and the processing mode is to be processed temporarily. It can be understood that the above setting relationship between K3 and the evidence level and the processing mode can also be changed according to the actual situation, such as changing K3≥0.8 to K3≥0.9, etc. For the execution step, corresponding operations can be performed according to the type of evidence, and the execution order of the execution step is executed according to the evidence priority.

[0108] Exemplarily, it is assumed that the cyanide of the electroplating plant exceeds the standard: the input parameters K1 = 0.95, that is, the cyanide exceeds the standard confidence is 0.95, K2 = 0.91, that is, the behavior pattern similarity is 0.91, and K3 = 0.86, that is, the video evidence correlation degree is 0.86. K1 = 0.95 matches the 58th article of the Regulations on the Management of Hazardous Wastes, and the output is associated with the 58th article of the Regulations on the Management of Hazardous Wastes according to K1 = 0.95, and the matching of the legal provisions is completed; K2 = 0.91 generates a strong causal chain, and the output is that the electroplating tank illegally discharges at the time point of 22:03, which directly leads to the total cyanide exceeding the standard at the time point of 22:06, and the generation of the causal chain is completed; K3 = 0.86 matches the video evidence as the key evidence, and the output is that the evidence priority is that the monitoring video priority is greater than the bath solution detection record, and the execution step is: immediately block the electroplating workshop, and then collect the water sample of the hidden pipe discharge port. It should be noted that the above execution steps and specific regulation files and specific provisions are all fictional examples and are not real regulations and provisions, and the execution steps can also be adjusted according to the actual situation.

[0109] In some embodiments, the step of driving the language model to generate an analysis report and feeding back to the edge device through the thought chain prompt template includes: S101, analyzing data class triples, state class triples and video class triples in the evidence chain; S102, converting the video class triples into natural language behavior descriptions through a cross-modal semantic alignment model; S103, fusing the data class triples, the state class triples and the natural language behavior descriptions to generate an enhanced input text; S104, calling a language model to generate an analysis report according to the thought chain prompt template and the enhanced input text; S105, feeding back the analysis report to the edge device.

[0110] It should be noted that the data class triples are generated by formatting the obtained monitoring data sequence fragments; the state class triples are generated by formatting the obtained parameter snapshots; and the video stream triples are generated by formatting the video key frame time markers. The monitoring data sequence fragments, the parameter snapshots and the video key frame time markers will be described in detail in the subsequent processing process of the edge device, and will not be described here.

[0111] In detail, the embodiment effectively solves the problem that traditional text reports cannot carry video information, and manual viewing of the video and manual input of text are required by decoding the video vector in the video triple into enhanced input text, i.e., a natural language description. Illustratively, a video feature vector (such as a 256-dimensional tensor) is extracted from the video triple, and a pre-trained cross-modal semantic alignment model (such as a CLIP-ViT model) is input. The model analyzes the vector through a spatial-temporal attention mechanism: high activation dimensions are mapped to behavior subjects (such as "personnel" and "vehicle"), spatial distribution features are decoded into location information (such as "pump room area"), and temporal change features are converted into dynamic descriptions (such as "gather" and "open valve"). Finally, a natural language description with a fixed syntax structure is generated: "time + location + subject + behavior", for example, the input vector [0.88, -0.18, 0.42] outputs "22:05 pump room area two people open the drain valve". Then, by using the thinking chain prompt template to constrain the language model, the output is standardized, and irrelevant content generated by traditional language models is avoided.

[0112] For fusion data triple, state triple and natural language behavior description, the enhanced input text is generated as follows: The natural language behavior description generated by the cross-modal model (such as "22:05 pump room area two people open the valve") is deeply integrated with the evidence chain: first, the structured data in the evidence chain (such as the monitoring data "22:08 time point COD = 200 mg / L" and the equipment state "22:05 time point water pump frequency increased by 50%") is analyzed, the association between behavior and data is established through a spatio-temporal alignment algorithm - the time difference Δt is used to quantify the sequence of behavior and result (such as the valve being opened for 3 minutes before the COD exceeds the standard), and the causal marker "→" is inserted to explicitly express the logical link; then, the semantic features S (such as the enterprise description "equipment maintenance") are fused, and the conflict points between objective behavior and subjective statements are automatically labeled by a contradiction detection module (such as "claiming maintenance but behavior matches illegal discharge"); finally, a structured enhanced text is generated.

[0113] In this embodiment, the causal relationship between behavior and data is established by Δt calculation and "→" symbol, which makes the traditional separate storage of video, data and text evidence form a unified evidence chain; the semantic difference between enterprise description and video behavior is compared, which improves the detection rate of deceptive statements that are difficult for humans to detect, such as a factory claiming "equipment failure" but the video showing "man-made short circuit of sensor"; structured input improves the accuracy of large model report generation, especially in complex scenarios (such as dilution of illegal discharge during heavy rain), it can still accurately output the complete chain of "behavior → data → legal consequences".

[0114] In some embodiments, the analysis report comprises: abnormality determination conclusion and confidence, causal tree construction, evidence chain integrity evaluation and supplementary evidence suggestion, law enforcement process guidance, and associated regulatory clause index.

[0115] In some embodiments, the step of causal tree construction comprises: Determine the pollution source according to the type of the initial abnormal event in the evidence chain: analyze the first abnormal event in the evidence chain (such as event code 201 representing "COD abnormality sudden drop"), match the pollution source mapping table (such as "COD sudden drop → dilution illegal discharge"), and dynamically correct the source to the initial behavior when the evidence chain contains earlier behavior events (such as "regional intrusion").

[0116] Fill in the behavior node details according to the causal description of the behavior pattern similarity K2: extract the causal description of the behavior pattern similarity K2 (such as K2=0.88 corresponding to "valve operation → COD exceeds standard"), inject the space-time details (timestamp extracted from the evidence chain, location decoded by video features), and generate the node: "${time} ${location} ${K2 behavior description}" (such as "22:05 pump house area valve operation").

[0117] Mark the pollution performance using the exceeding standard value corresponding to the exceeding standard confidence K1: calculate the exceeding standard amplitude according to the monitoring value corresponding to the exceeding standard confidence K1 (such as COD=200mg / L): (measured value-limit value) / limit value × 100% (such as limit value 50mg / L → exceeding standard 300%), and bind K1 value to mark as "${pollutant} exceeds standard ${amplitude}% (confidence ${K1})" (such as "COD exceeds standard 300% (K1=0.95)").

[0118] In some embodiments, the step of collecting pollution source multi-modal data stream comprises: S11, determine the collection protocol according to the environmental regulation scene; S12, configure the collection source according to the four-dimensional abnormality system to collect the pollution source multi-modal data stream; Wherein, the four-dimensional abnormality system comprises behavior abnormality, data abnormality, device abnormality and operation and maintenance abnormality.

[0119] When deploying edge devices on the scene of pollution sources, first, dynamically select the collection protocol (such as HJ 212-2017 environmental protection protocol or Modbus industrial protocol) according to the characteristics of the regulation scene (such as sewage treatment plant needs to monitor COD / ammonia nitrogen, chemical plant needs to monitor VOCs); then configure the collection source according to the four-dimensional abnormality system: Behavior abnormality: capture behaviors such as regional intrusion and illegal operation through AI cameras (such as personnel entering the pump house during non-working hours); Data anomaly: Connect to online analyzer to get pollutant concentration in real time (e.g. COD value mutation >10% / min); Equipment anomaly: Read equipment state parameters (e.g. analyzer temperature anomaly, pump machine current sudden drop); Operation and maintenance anomaly: Analyze access control log and maintenance record (e.g. overdue calibration, false maintenance work order).

[0120] In some embodiments, the step of triggering an alarm according to the multi-modal data stream of the pollution source through the hierarchical anomaly identification model comprises: S21, obtaining monitoring data, equipment state parameter time series data, access control record, and real-time video stream.

[0121] S22, performing change feature determination on the monitoring data and selecting whether to generate a monitoring data anomaly identifier according to the determination result.

[0122] The change feature determination at least includes whether the specific value of the monitoring data exceeds the standard, whether the monitoring data suddenly changes, whether the monitoring data smoothly fluctuates, etc. Illustratively, an exceeding threshold value can be set, the monitoring data is compared with the exceeding threshold value to obtain the change feature of whether exceeding; a change rate threshold value can be set, the monitoring data is compared with the time period to obtain the actual change rate, and whether the actual change rate exceeds the change rate threshold value is compared to obtain the change feature of whether suddenly changing; a fluctuation threshold value can be set, the actual fluctuation value is calculated, and the actual fluctuation value is compared with the fluctuation threshold value to obtain the change feature of whether smoothly fluctuating.

[0123] S23, performing threshold value determination on the equipment state parameter and selecting whether to generate an equipment anomaly identifier according to the determination result.

[0124] The edge device collects equipment state parameters in real time, such as analyzer parameters, states, and pump machine currents. The analyzer parameters can further include the working range, digestion temperature, and digestion time of the analyzer, and the states can further include working states (calibration, measurement, idle, etc.) and alarm states. Dynamic determination is performed through a pre-set threshold value rule library: when the parameter continuously exceeds the threshold value range (e.g. temperature >165℃ or current fluctuation >15%), an equipment anomaly identifier is generated, triggering an equipment anomaly alarm event (event code 501). For example, if the pump machine current of a certain sewage plant suddenly drops by 30% (threshold value ±10%), the system immediately marks the anomaly and alarms.

[0125] S24, performing period verification on the access control record, and selecting whether to generate an access control anomaly identifier according to the verification result.

[0126] Parse the access time stamp and authorization information of the access control record, compare with the preloaded enterprise work and rest period rule library (such as setting 8:00-18:00 as the work period for a production enterprise): if non-work period unauthorized access (such as unauthorized personnel entering at 22:05) is detected, a door access abnormality identifier is generated and an abnormal behavior alarm is triggered (event code 101). In the case of a certain chemical plant, the system accurately identifies the 22:03 unauthorized entry into the dangerous goods warehouse event.

[0127] S25, performing behavior analysis on the video stream, and selecting whether to generate a video abnormality identifier according to the behavior analysis result.

[0128] Real-time analysis of video stream through lightweight YOLOv8 model, identification of pre-defined 20 types of violation behaviors (such as regional intrusion, illegal operation of equipment): when the behavior recognition confidence is > 90%, a video abnormality identifier is generated, triggering an abnormal behavior alarm (event code 105). For example, the camera captures "22:10 pump room personnel shorting sensor", the model triggers an alarm with 92% confidence.

[0129] S26, when at least any two of the monitoring data abnormality identifier, the equipment abnormality identifier, the door access abnormality identifier, and the video abnormality identifier are generated, an alarm is triggered.

[0130] By setting at least two abnormality identifiers in linkage, the alarm can be triggered, which can effectively reduce the number of false alarms. Of course, in other embodiments, three abnormality identifiers can also be set in linkage, that is, when the equipment abnormality identifier, the door access abnormality identifier, and the video abnormality identifier are all generated, the specific matters of the equipment abnormality, the specific matters of the door access abnormality, and the specific matters of the video abnormality are all input into the pre-set rule model for comprehensive logical research and judgment, and an alarm is triggered according to the research and judgment result, further reducing the number of false alarms. The comprehensive logical research and judgment here means that in addition to the appearance of at least two abnormality identifiers, the appearance of two or more abnormality identifiers needs to be comprehensively judged to determine whether the two or more abnormality identifiers can be associated to obtain a research and judgment result of whether to trigger an alarm. Compared with the way of triggering an alarm only when the number of abnormality identifiers appearing is greater than or equal to two, the comprehensive research and judgment way of the present embodiment can further reduce the probability of false alarm. The comprehensive logical research and judgment is as follows: In a similar time period, the door access abnormality identifier, the equipment abnormality identifier, and the monitoring data abnormality identifier appear, specifically the door access is abnormally started to open, then a part of the equipment related to the monitoring data abnormally operates or stops operating, and then the monitoring data suddenly rises, at this time it can be comprehensively judged that the three abnormality identifiers have a correlation, and an alarm is triggered.

[0131] In some embodiments, the step of generating a time-stamped evidence chain in response to the alarm comprises: S31, taking the alarm trigger time as the reference point, dynamically determining the starting point of the backtracking period according to the alarm type and setting the ending point.

[0132] Exemplarily, taking the alarm trigger time (such as the time point 22:08, COD exceeds the standard) as the reference point, the backtracking period is automatically determined according to the alarm type: Behavior alarm: backtracking starting point = alarm time - 5 minutes (such as 22:08→22:03), capturing pre-incident behavior; Device alarm: backtracking starting point = alarm time - 30 minutes, analyzing device gradual failure; Uniform ending point: alarm time + 2 minutes, to cover the subsequent impact.

[0133] By using dynamic window, the resource waste of fixed backtracking is solved, such as accurately locking the key operation 4 minutes before the alarm in a certain illegal discharge case, which is helpful to improve the backtracking efficiency.

[0134] S32, in the backtracking period, acquire: associated monitoring data sequence segment, parameter snapshot of device state change time, and video key frame time mark related to abnormal event.

[0135] Exemplarily, in the backtracking period (such as 22:03-22:10), automatically collect: Monitoring data sequence: intercepting pollutant concentration time sequence segment (such as COD value rising from 80mg / L to 200mg / L from 22:05 to 22:08); Device parameter snapshot: recording device state at abnormal time (such as 22:05, water pump frequency suddenly drops to 30%); Video key frame: marking behavior event timestamp (such as 22:05, pump room personnel intrusion).

[0136] Through multi-protocol compatibility (HJ 212 / Modbus / ONVIF), it is helpful to improve the data acquisition completeness, such as synchronously acquiring two related key evidences of "current drop" and "valve opening" in a certain case.

[0137] S33, format the acquired monitoring data sequence segment to generate data class triplets, format the acquired parameter snapshot to generate state class triplets, and format the video key frame time mark to generate video class triplets.

[0138] Exemplarily, convert the original data to structured triplets: Data class: {“monitoring data”, “COD: 80mg / L→200mg / L”, “22:05-22:08”}; State class: {“device state”, “water pump frequency: 40Hz→15Hz”, “22:05”}; Video type: {“behavior event”, “area intrusion”, “22:05:03”}.

[0139] By using the triple structure, the evidence storage volume is reduced, and the storage cost is saved.

[0140] S34, according to the three types of triplets, respectively add timestamps to generate timestamped evidence items.

[0141] Exemplarily, a standard timestamp is added to each triplet: the data type adds the associated sampling time, the state type adds the binding change time, and the video type adds the synchronous frame accurate time.

[0142] S35, sort the evidence items according to the chronological order of the timestamps.

[0143] Exemplarily, the evidence items are rearranged in ascending order of timestamps, which is conducive to automatically restoring the illegal process. For example: at 22:05:03, a video event occurs: area intrusion; at 22:05:17, a device state change occurs: water pump frequency drops sharply; at 22:08:00, a monitoring data change occurs: COD rises to 200 mg / L.

[0144] S36, according to the event correlation rules of the hierarchical anomaly recognition model, add causal correlation labels between events.

[0145] Based on the event correlation rules, logical labels are added, exemplarily: Rule: If “area intrusion” is accompanied by “device anomaly” within 5 minutes, mark the area intrusion as causing device parameter tampering. Through the automatic generation of causal chain, compared with human experience judgment, it is conducive to improving the effectiveness of evidence.

[0146] S37, integrate the sorted and labeled evidence items into evidence chains.

[0147] In some embodiments, the step of compressing the monitoring deviation features D, behavior anomaly features B and semantic features S to generate feature packages Z includes: S51, according to the monitoring deviation features D, apply attention mechanism to extract key trend segments and generate monitoring feature vectors.

[0148] Exemplarily, for monitoring the deviation feature D (such as COD time series data), the attention mechanism is applied to focus on the excessive amplitude (such as a sudden increase of 80% within 10 minutes) and the statistical marker, and the deviation degree feature is calculated by a time series pattern matching algorithm (Fourier transform to extract the fundamental frequency); the normal data in a dynamic time window (such as a sampling frequency of 5 minutes, backtracking for 20 minutes) before the abnormal period is selected as a reference to generate a 128-dimensional feature vector to represent the key trends (such as “22:05-22:15 COD continues to exceed the standard”). The technical solution provided in this step can improve the key fragment retention rate while effectively compressing the data and reducing the data volume.

[0149] The statistical marker refers to counting the marker corresponding to each data. The marker represents the running condition of the equipment when the corresponding data is monitored. The marker generally includes normal (N), calibration (C), maintenance (M), and shutdown (P).

[0150] S52, according to the behavior abnormal feature B, the associated video segment is processed by a space-time compression model to generate a behavior semantic feature vector.

[0151] Based on the behavior abnormal feature B (such as access control log and video stream), a behavior recognition model (such as light 3DCNN or light weight space-time graph network) is used for behavior pattern analysis: identifying the frequency of unauthorized period entering the key area (such as 22:03 pump room intrusion), then performing time correlation calculation: matching the monitoring event timestamp (such as 5 minutes before the COD sudden drop), and finally outputting a 256-dimensional behavior semantic vector (such as [0.82, -0.3] representing “short circuit sensor operation”). This step can effectively improve the analysis speed, the video segment processing speed, and the correlation accuracy between behavior and event.

[0152] S53, according to the semantic feature S, the industry risk label associated with the industry information is fused to generate a semantic enhanced vector.

[0153] Exemplarily, instrument parameter fusion is performed: basic monitoring, device operation, and calibration quality control. A three-layer feature pyramid is constructed and fused into a comprehensive risk value. The pollution discharge permit graph in the industry information (such as matching cyanide high-risk process in electroplating plant) is matched, and a 128-dimensional semantic enhanced vector is generated by a BERT model.

[0154] S54, the monitoring feature vector, the behavior semantic feature vector, and the semantic enhanced vector are unified to the same dimension by a pre-trained encoding matrix to generate a low-dimensional feature tensor as a feature package Z.

[0155] Exemplarily, dimension unification and tensor generation are performed by pre-training a cross-modal encoding matrix. Dimension unification: the monitoring vector is mapped to 64 dimensions, the behavior vector is compressed to 64 dimensions, and the semantic vector is aligned to 64 dimensions. Tensor generation: the three vectors (monitoring vector, behavior vector, and semantic vector) are spliced and compressed into a 128-dimensional feature package Z through an autoencoder.

[0156] In summary, the application provides an environment supervision method based on an edge cloud collaborative architecture. Through the bidirectional optimization mechanism of edge intelligent perception and cloud knowledge driving, the three core problems of traditional pollution source supervision, i.e., long time for illegal restoration, low efficiency of evidence correlation, and weak decision support, are completely solved. In detail, the collection source is dynamically configured according to a four-dimensional abnormal system (behavior / data / equipment / operation and maintenance), multiple protocols are compatible, and full-factor coverage of pollution sources is achieved. Through four-level parallel processing of monitoring data judgment (data anomaly), equipment state judgment (equipment anomaly), time period verification (access control anomaly), and AI behavior analysis (video anomaly), a precise alarm event is triggered. It should be noted that time period verification and AI behavior analysis can be integrated into one category because some access control anomalies are obtained through video monitoring. In this embodiment, the triple evidence item is the fusion of video anomaly and access control anomaly into the video category. Based on the alarm time, a timestamped triple evidence item (data category / state category / video category) is generated and integrated into a structured evidence chain in chronological order. A three-level knowledge architecture (basic layer-regulatory limits / pattern layer-historical cases / strategy layer-enforcement templates) realizes intelligent mapping of the feature package Z. The over-limit confidence K1 (quantifying the degree of pollution), the behavior pattern similarity K2 (spatiotemporal causal correlation), and the semantic correlation K3 (evidence priority) are calculated. Through the three-step prompt template of "regulation matching→behavior explanation→evidence suggestion", the large model outputs an executable report containing a causal tree and a law index. The monitoring feature vector, the behavior semantic vector, and the semantic enhanced vector are combined and compressed into a 128-dimensional feature package Z. The cloud report is automatically pushed to the edge device, forming a closed loop of perception, decision, and execution.

[0157] Based on the above method embodiments, the application embodiments further provide a storage medium, which is a computer-readable storage medium. The storage medium stores a computer program, which is run by a processor to execute the above method embodiments. Specifically, the storage medium can be a general storage medium, such as a mobile disk, a hard disk, etc. When the computer program on the storage medium is run, the method in the above embodiments can be executed.

[0158] Based on the above method embodiments, the application further provides a computer program product, which includes computer instructions that, when run on an environment supervision system based on an edge cloud architecture, can enable the system to execute the above method embodiments.

[0159] The above merely provides an example of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for environmental supervision based on an edge cloud architecture, characterized in that, The system comprises edge devices and a cloud platform, and the edge devices are arranged at an environmental supervision site; The execution steps of the edge device include: Collecting multi-modal data streams of pollution sources; Triggering an alarm through a hierarchical abnormality recognition model according to the multi-modal data streams of pollution sources; Generating a time-stamped evidence chain in response to the alarm; Extracting monitoring deviation features D, behavior abnormality features B, and semantic features S according to the evidence chain; Compressing the monitoring deviation features D, the behavior abnormality features B, and the semantic features S to generate a feature package Z; Uploading the feature package Z to the cloud platform.

2. The edge cloud architecture based environment supervision method of claim 1, wherein, The step of triggering an alarm through a hierarchical abnormality recognition model according to the multi-modal data streams of pollution sources includes: Obtaining monitoring data, device state parameter time series data, access control records, and real-time video streams; Performing change feature determination on the monitoring data and selecting whether to generate monitoring data abnormality identification according to the determination result; Performing threshold determination on the device state parameters and selecting whether to generate device abnormality identification according to the determination result; Performing time period verification on the access control records and selecting whether to generate access control abnormality identification according to the verification result; Performing behavior analysis on the video stream and selecting whether to generate video abnormality identification according to the behavior analysis result; When at least any two of the monitoring data abnormality identification, the device abnormality identification, the access control abnormality identification, and the video abnormality identification are generated, an alarm is triggered.

3. The edge cloud architecture based environment supervision method of claim 1, wherein, The step of generating a time-stamped evidence chain in response to the alarm includes: Taking the alarm triggering time as a reference point, dynamically determining the starting point of the backtracking period according to the alarm type and setting the ending point; Obtaining, within the backtracking period: associated monitoring data sequence segments, parameter snapshots at device state change times, and video key frame time markers related to abnormal events; Formatting the obtained monitoring data sequence segments to generate data class triples, formatting the obtained parameter snapshots to generate state class triples, and formatting the video key frame time markers to generate video class triples; According to the three types of triples, respectively add time stamps to generate time-stamped evidence items; Ordering the evidence items according to the order of time stamps; According to the event correlation rules of the hierarchical abnormality recognition model, adding causal correlation markers between events; Integrating the ordered and marked evidence items into the evidence chain.

4. The edge cloud architecture based environment supervision method of claim 1, wherein, The step of compressing the monitoring deviation features D, the behavior abnormality features B, and the semantic features S to generate a feature package Z includes: According to the monitoring deviation features D, applying an attention mechanism to extract key trend segments and generate a monitoring feature vector; According to the behavior abnormality features B, processing associated video segments through a spatio-temporal compression model to generate a behavior semantic feature vector; According to the semantic features S, fusing industry information associated industry risk labels to generate a semantic enhancement vector; Through a pre-trained encoding matrix, the monitoring feature vector, the behavior semantic feature vector, and the semantic enhancement vector are unified to the same dimension to generate a low-dimensional feature tensor as the feature package Z.

5. The edge cloud architecture based environment supervision method according to any one of claims 1 to 4, characterized in that, The execution steps of the cloud platform include: After receiving the feature package Z, matching and mapping the feature package Z with an environmental protection knowledge framework; According to the matching mapping result, a multi-dimensional matching calculation is performed to generate a knowledge label set; According to the knowledge label set, a thinking chain prompt template is constructed; The language model is driven by the thinking chain prompt template to generate an analysis report and feedback to the edge device.

6. The edge cloud architecture based environment supervision method of claim 5, wherein, The environmental protection knowledge framework includes a basic layer, a mode layer, and a strategy layer; after receiving the feature package Z, the step of matching and mapping the feature package Z with the environmental protection knowledge framework includes: Obtain the regulatory provisions and pollutant standard limits in the basic layer; Obtain the behavior-data association rules of historical abnormal cases in the mode layer; Load the law enforcement process templates associated with laws and / or historical law enforcement cases in the strategy layer.

7. The edge cloud architecture based environmental supervision method according to claim 6, wherein, The knowledge label set includes over-standard confidence K1, behavior pattern similarity K2, and semantic correlation degree K3; wherein, the step of performing multi-dimensional matching calculation according to the matching mapping result to generate a knowledge label set includes: According to the feature package Z and the pollutant standard limits in the basic layer, the over-standard confidence K1 is calculated; According to the feature package Z and the behavior-data association rules in the mode layer, the behavior pattern similarity K2 is calculated; According to the feature package Z and the law enforcement process templates in the strategy layer, the semantic correlation degree K3 is calculated.

8. The edge cloud architecture based environmental supervision method of claim 7, wherein, The step of calculating the behavior pattern similarity K2 according to the feature package Z and the behavior-data association rules in the mode layer includes: From the monitoring deviation features D in the feature package Z, the monitoring data time sequence is parsed; From the mode layer, the historical abnormal template matching the behavior abnormal features B is retrieved; Load the process cycle weight function corresponding to the enterprise industry type; According to the monitoring data time sequence, the historical abnormal template, and the process cycle weight function, the behavior pattern similarity K2 is generated.

9. The edge cloud architecture based environmental supervision method of claim 7, wherein, The step of calculating the semantic correlation degree K3 according to the feature package Z and the law enforcement process templates in the strategy layer includes: From the semantic features S in the feature package Z, the text description features are parsed; From the law enforcement process templates in the strategy layer, the association relationship chain is extracted; According to the text description features and the association relationship chain, language model coding is performed; According to the language model coding, the semantic correlation degree K3 is calculated. 10.The edge cloud architecture based environment supervision method of claim 7, wherein, The step of constructing a thinking chain prompt template according to the knowledge label set includes: According to the over-standard confidence K1, the legal provisions in the basic layer are matched; According to the behavior pattern similarity K2, the cause-effect chain of abnormal events and associated behaviors is generated; According to the semantic correlation degree K3, the evidence priority and law enforcement steps are output.

11. The edge cloud architecture based environmental regulation method of claim 5, wherein, The step of driving the language model to generate an analysis report and feedback to the edge device through the thinking chain prompt template includes: Parse the data class triplets, state class triplets, and video class triplets in the evidence chain; Convert the video class triplets into natural language behavior descriptions through a cross-modal semantic alignment model; Fuse the data class triplets, state class triplets, and natural language behavior descriptions to generate enhanced input text; According to the thinking chain prompt template and the enhanced input text, the language model is called to generate an analysis report; feeding back the analysis report to the edge device.

12. An environment supervision system based on an edge cloud architecture, characterized in that, comprising an edge device and a cloud platform, the edge device being signal connected with the cloud platform to implement the method according to any one of claims 1 to 11.

Images