Environment supervision method and system based on edge cloud architecture

Abstract

The application provides an environment supervision method and system based on an edge cloud architecture. The method comprises an edge device and a cloud platform, and the edge device is arranged at an environment supervision site. The execution steps of the edge device comprise: collecting multi-modal data streams of pollution sources; triggering an alarm through a hierarchical anomaly recognition model according to the multi-modal data streams of pollution sources; generating a time-stamped evidence chain in response to the alarm; extracting monitoring deviation features D, behavior anomaly features B and semantic features S according to the evidence chain; compressing the monitoring deviation features D, the behavior anomaly features B and the semantic features S to generate a feature package Z; and uploading the feature package Z to the cloud platform. The application can effectively improve cloud data matching and reduce false alarm rates.

Description

Technical Field

[0001] This application relates to the field of environmental regulation, and more specifically, to an environmental regulation method and system based on an edge-cloud architecture. Background Technology

[0002] Off-site pollution source monitoring technologies are gradually evolving from single-data monitoring to multi-source heterogeneous data fusion. Current mainstream monitoring systems collect monitoring data by deploying edge devices at polluting enterprises and then perform data analysis on a cloud platform.

[0003] In this monitoring approach, edge devices, limited by storage capacity and computing resources, are generally only responsible for collecting various data and then transmitting it to the cloud. The cloud then analyzes and processes the data. Therefore, edge devices need to transmit a large amount of multimodal raw data (especially video streams) to the cloud platform. However, the proportion of key features of abnormal events in the raw data is extremely low, yet the entire amount needs to be uploaded to the cloud. This results in a flood of invalid data consuming bandwidth and network resources. Furthermore, differences in format and protocol between data from different sources create "data silos," leading to poor data matching in the cloud and a high false alarm rate. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide an environment monitoring method and system based on an edge-cloud architecture to improve the technical problem of poor data matching and high false alarm rate caused by edge devices transmitting raw data to the cloud platform.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows:

[0006] In a first aspect, this application provides an environmental monitoring method based on an edge-cloud architecture, including an edge device and a cloud platform, wherein the edge device is located at the environmental monitoring site;

[0007] The execution steps of the edge device include:

[0008] Collect multimodal data streams from pollution sources;

[0009] An alarm is triggered based on the multimodal data stream of the pollution source through a hierarchical anomaly identification model.

[0010] In response to the alarm, a timestamped chain of evidence is generated;

[0011] Based on the chain of evidence, extract monitoring deviation feature D, behavioral anomaly feature B, and semantic feature S;

[0012] The monitoring deviation feature D, the behavioral anomaly feature B, and the semantic feature S are compressed to generate feature package Z;

[0013] The feature package Z is uploaded to the cloud platform.

[0014] Optionally, the step of triggering an alarm based on the multimodal data stream of the pollution source through a hierarchical anomaly identification model includes:

[0015] Acquire monitoring data, time-series data of equipment status parameters, access control records, and real-time video streams;

[0016] The monitoring data is subjected to change feature determination, and an option is selected to generate an anomaly flag based on the determination result.

[0017] Perform threshold judgment on equipment status parameters and select whether to generate equipment abnormality flag based on the judgment result;

[0018] Perform time period verification on access control records, and select whether to generate access control anomaly flags based on the verification results;

[0019] Perform behavioral analysis on the video stream and select whether to generate video anomaly flags based on the behavioral analysis results;

[0020] An alarm is triggered when at least two of the following are generated: monitoring data anomaly identifier, equipment anomaly identifier, access control anomaly identifier, and video anomaly identifier.

[0021] Optionally, the step of generating a timestamped chain of evidence in response to the alarm includes:

[0022] Using the alarm trigger time as a baseline, the start and end points of the retrospective period are dynamically determined based on the alarm type.

[0023] During the backtracking period, acquire: associated monitoring data sequence fragments, parameter snapshots at the time of equipment status changes, and video keyframe timestamps related to abnormal events;

[0024] The acquired monitoring data sequence fragments are formatted to generate data class triples, the acquired parameter snapshots are formatted to generate state class triples, and the video keyframe time stamps are formatted to generate video class triples.

[0025] Based on the three types of triples, timestamps are added to generate timestamped evidence items;

[0026] The evidence items are ordered according to the order of their timestamps;

[0027] Based on the event association rules of the hierarchical anomaly identification model, add causal association markers between events;

[0028] The sorted and labeled evidence items are integrated into the evidence chain.

[0029] Optionally, the step of compressing the monitoring deviation feature D, the behavioral anomaly feature B, and the semantic feature S to generate feature package Z includes:

[0030] Based on the monitored deviation feature D, an attention mechanism is applied to extract key trend segments and generate a monitoring feature vector;

[0031] Based on the behavioral anomaly feature B, the associated video segments are processed using a spatiotemporal compression model to generate a behavioral semantic feature vector.

[0032] Based on the semantic feature S, industry risk tags associated with industry information are fused to generate a semantically enhanced vector;

[0033] The monitoring feature vector, behavioral semantic feature vector, and semantic enhancement vector are unified to the same dimension by using a pre-trained encoding matrix, and a low-dimensional feature tensor is generated as the feature package Z.

[0034] Optionally, the execution steps of the cloud platform include:

[0035] After receiving the feature packet Z, match and map the feature packet Z with the environmental knowledge framework;

[0036] Based on the matching mapping results, perform multi-dimensional matching calculations to generate a knowledge tag set;

[0037] Based on the knowledge tag set, construct a mind chain prompt template;

[0038] The language model is driven by the thought chain prompt template to generate an analysis report and feed it back to the edge device.

[0039] Optionally, the environmental protection knowledge framework includes a foundation layer, a pattern layer, and a strategy layer; the step of matching and mapping the feature package Z with the environmental protection knowledge framework after receiving the feature package Z includes:

[0040] Obtain the regulatory provisions and pollutant standard limits in the base layer;

[0041] Obtain the behavior-data association rules of historical anomaly cases in the pattern layer;

[0042] Load the law enforcement process templates associated with laws and / or historical law enforcement cases in the strategy layer.

[0043] Optionally, the knowledge tag set includes over-confidence K1, behavioral pattern similarity K2, and semantic relevance K3; wherein, the step of performing multi-dimensional matching calculations to generate the knowledge tag set based on the matching mapping results includes:

[0044] The exceedance confidence level K1 is calculated based on the feature packet Z and the pollutant standard limit in the base layer;

[0045] The similarity K2 of the behavior pattern is calculated based on the feature package Z and the behavior-data association rules in the pattern layer.

[0046] The semantic correlation degree K3 is calculated based on the feature package Z and the law enforcement process template in the strategy layer.

[0047] Optionally, the step of calculating the behavior pattern similarity K2 based on the feature package Z and the behavior-data association rules in the pattern layer includes:

[0048] The time series sequence of monitoring data is parsed from the monitoring deviation feature D in the feature package Z;

[0049] Retrieve historical anomaly templates that match the behavioral anomaly feature B from the pattern layer;

[0050] Load the process cycle weight function corresponding to the enterprise's industry type;

[0051] The behavioral pattern similarity K2 is generated based on the time sequence of the monitoring data, the historical anomaly template, and the process cycle weight function.

[0052] Optionally, the step of calculating the semantic relevance K3 based on the feature package Z and the law enforcement process template in the policy layer includes:

[0053] The text description features are parsed from the semantic features S in the feature package Z;

[0054] Extract the relationship chain from the law enforcement process template in the strategy layer;

[0055] Based on the text description features and the association chain, language model encoding is performed;

[0056] The semantic relevance K3 is calculated based on the language model encoding.

[0057] Optionally, the step of constructing a mind chain prompt template based on the knowledge tag set includes:

[0058] Match the legal provisions in the base layer according to the over-confidence level K1;

[0059] Generate a causal chain between the abnormal event and the associated behavior based on the behavioral pattern similarity K2;

[0060] Based on the semantic relevance K3, output evidence priority and law enforcement steps.

[0061] Optionally, the step of generating an analysis report by driving the language model through the thought chain prompt template and feeding it back to the edge device includes:

[0062] Analyze the data triples, state triples, and video triples in the evidence chain;

[0063] The video class triples are converted into natural language behavior descriptions using a cross-modal semantic alignment model;

[0064] By fusing the data triples, state triples, and natural language behavior descriptions, enhanced input text is generated.

[0065] An analysis report is generated by calling the language model based on the thought chain prompt template and the enhanced input text;

[0066] The analysis report is then fed back to the edge device.

[0067] Secondly, embodiments of this application provide an environment monitoring system based on an edge-cloud architecture, including an edge device and a cloud platform, wherein the edge device is signal-connected to the cloud platform to implement the method described in the first aspect.

[0068] Thirdly, embodiments of this application provide a storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect.

[0069] Fourthly, embodiments of this application provide a computer program product including computer instructions that, when run on an edge-cloud-based environment monitoring system, cause the system to perform the method described in the first aspect.

[0070] In the method described in the first aspect above, the following can be understood:

[0071] This application provides an edge-cloud architecture-based environmental monitoring method. First, it dynamically filters pollution-related features based on an event-driven mechanism using a hierarchical anomaly identification model, accurately extracting behavioral anomaly features B, monitoring deviation features D, and semantic features S from the original data stream, eliminating most non-critical data redundancy. Second, it achieves spatiotemporal alignment and fusion of multi-source heterogeneous data through a timestamped evidence chain architecture, completing protocol normalization locally at the edge and completely breaking down data silos. Finally, it uses cross-modal feature distillation technology to compress multi-dimensional features into a lightweight feature package Z with entropy optimization, making it a high-value-density decision input that can be directly processed in the cloud, thereby completing the reconstruction of the edge-cloud collaborative paradigm from a "data quagmire" to a "value path".

[0072] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, embodiments of this application are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0073] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0074] Figure 1 A schematic diagram of an edge-cloud architecture-based environmental monitoring system provided in this application embodiment;

[0075] Figure 2 A flowchart illustrating an environment monitoring method based on an edge-cloud architecture, provided for embodiments of this application;

[0076] Figure 3 A flowchart illustrating an environment monitoring method based on an edge-cloud architecture provided in this application embodiment;

[0077] Figure 4 A flowchart illustrating the triggering of alarms and generation of evidence chains in an edge-cloud architecture-based environmental monitoring method provided in this application embodiment;

[0078] Figure 5 This application provides a flowchart of the cloud platform workflow in an edge-cloud architecture-based environment monitoring method. Detailed Implementation

[0079] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0080] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0081] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0082] It should be noted that, where there is no conflict, the features in the embodiments of this application can be combined with each other.

[0083] This application provides a technical solution, including an environment monitoring method and system based on an edge-cloud architecture. The technical solution provided in this application will be described below with reference to the accompanying drawings.

[0084] First, this application introduces an edge-cloud architecture-based environmental monitoring system, comprising edge devices and a cloud platform. The edge devices and the cloud platform are signal-connected, forming an edge-cloud collaborative structure. The edge devices and the cloud platform achieve bidirectional communication via encrypted MQTT (Message Queuing Telemetry Transport) protocol. The edge devices include a data acquisition module, a data analysis module, a data display module, an edge-cloud interaction module, and an edge system management module. The cloud platform includes a data access module, a knowledge management module, a feature-knowledge matching module, a model inference module, an intelligent interaction module, a data visualization module, a law enforcement information push module, and a cloud system management module.

[0085] The edge devices collect real-time monitoring data, device status, access control records, and multimodal video stream data via multi-protocol communication interfaces (compatible with Modbus / OPC-UA / ISAPI / FPI, etc.). Their built-in data analysis module uses a hierarchical processing mechanism (LSTM data anomaly detection + YOLOv8 behavior recognition model) to trigger anomaly alarms and generates a timestamped structured evidence chain through logical backtracking, which is then compressed into lightweight feature packages using feature distillation technology. The accompanying data display module presents data and events in real-time using multi-dimensional dashboards such as digital station layouts, operational graphs, and alarm matrices. The edge-cloud interaction module uses a bidirectional message queue (based on the MQTT protocol) to upload feature packages and receive cloud commands (including supplementary verification commands and Bluetooth unlocking control). Finally, the edge system management module completes terminal configuration monitoring. The cloud platform receives edge data and performs protocol conversion through the data access module. The knowledge management module constructs a three-level knowledge framework (basic layer - national standard limits / pattern layer - case rules / strategy layer - enforcement templates) and dynamically updates the knowledge graph with the help of graph neural networks. The feature-knowledge matching module uses attention mechanisms, improved DTW algorithms, and Sentence-BERT models to achieve multi-dimensional matching (numerical anchoring / temporal alignment / semantic association) of feature packages and knowledge nodes and to verify the integrity of the evidence chain. The large model reasoning module generates structured reports containing causal analysis, legal provisions indexes (such as Article XX of the Environmental Protection Law), and enforcement guidelines based on the thought chain prompt template. The intelligent interaction module provides a natural language question-and-answer interface to realize semantic parsing and answer tracing. The data visualization module displays regulatory dashboards such as "one file per enterprise" through multiple terminals such as PCs and mobile phones. The environmental supervision and enforcement module automatically generates a list of violations and tracks the handling process. Finally, the system management module realizes the upgrading of all platform devices and access control.

[0086] Traditional environmental monitoring methods suffer from several problems. Firstly, edge devices are limited by storage capacity and computing resources, enabling only shallow feature extraction and analysis of monitoring data. This prevents them from supporting the deep computation required for complex models. Secondly, large amounts of raw data (especially video streams) need to be transmitted to the cloud platform. This process is hampered by network latency, bandwidth constraints, and differences in data formats and protocols from various sources, creating "data silos" and resulting in poor data matching in the cloud, leading to a high false alarm rate.

[0087] First, traditional environmental regulatory methods output isolated alarm events (such as excessive COD or obstructed cameras). Law enforcement officers need to rely on experience to manually connect scattered, multi-dimensional alarm clues to build a chain of evidence. The lack of a standardized causal reasoning framework makes it difficult to quickly identify the responsible party for pollution, which increases the enforcement costs of regulatory departments and prolongs the response cycle.

[0088] Second, in off-site pollution source monitoring scenarios, the industry adaptability of general-purpose models faces significant bottlenecks: their lack of industry knowledge depth makes it difficult for generated conclusions to accurately match actual regulatory needs, manifesting as a generalization of the understanding of industry-specific processes and pollutant risks; at the same time, limited by narrow context windows and insufficient text processing capabilities, they cannot effectively analyze the complex relationships of multimodal on-site data (such as video behavior clips, equipment time-series logs, and monitoring mutation components), causing anomaly assessments to deviate from regulatory priorities (such as misjudging equipment calibration drift as malicious tampering), ultimately outputting decision recommendations with inaccurate analysis dimensions and weak operability, making it difficult to support highly accurate enforcement actions.

[0089] This edge-cloud-based environment monitoring system can leverage its own structure to implement an edge-cloud-based environment monitoring method to solve the aforementioned problems, as detailed below:

[0090] The edge device is located at the environmental monitoring site, and the execution steps of the edge device include:

[0091] S1. Collect multimodal data streams of pollution sources.

[0092] Edge devices collect four types of data from pollution sources via industrial bus and network protocols: monitoring data streams, such as time-series parameters like COD and ammonia nitrogen; equipment operating status, such as analyzer temperature, pump current, and the on / off status and fault codes of some equipment; access control operation records, such as personnel entry / exit timestamps; and video surveillance streams, which can be collected at 1080P resolution and a frame rate of 15fps. Of course, in other embodiments, the resolution and frame rate can be freely set according to actual conditions and are not limited. For example, edge devices in a wastewater treatment plant collect COD values ​​every 5 minutes, simultaneously recording the on / off status of the dosing pumps and video clips of the pump room area.

[0093] S2. Based on the multimodal data stream of pollution sources, trigger an alarm through a hierarchical anomaly identification model.

[0094] Multimodal data is input into a pre-installed hierarchical anomaly detection model. This model can include four main categories: behavioral anomalies, data anomalies, equipment anomalies, and operational anomalies. These four categories are further subdivided into a model library of 13 dimensions and 40 subcategories of specific alarm scenarios, constructing a comprehensive anomaly perception framework. For example, the 13 dimensions can be categorized as follows:

[0095] Abnormal behavior can be categorized into three dimensions: environmental interference, obstruction of monitoring points, and unauthorized equipment operation.

[0096] Data anomalies can be categorized into four dimensions: momentary data exceeding limits, sustained data exceeding limits, data mutations, and disruption of data stability.

[0097] Equipment malfunctions can be categorized into four aspects: parameter tampering, sensor failure, communication interruption, and power supply failure.

[0098] Operational anomalies can include two dimensions: missing calibration and falsified maintenance records.

[0099] The 40 subcategories can be classified as follows:

[0100] Abnormal Behavior: Bottle interference (hanging dilution water bottles on sampling tubes), bypass discharge (using concealed drainage pipes), camera obstruction, probe wrapping (wrapping water quality probes with sponges, etc.), unauthorized entry into the station (unauthorized personnel entering the monitoring station), reagent replacement (replacing standard reagents in the analyzer), sampling tube insertion / removal, electromagnetic interference (such as using strong magnets to interfere with flow meters), abnormal nighttime activities (such as operating equipment outside of working hours), falsifying the sampling environment (such as injecting clean water into the sampling point).

[0101] Data anomalies include: instantaneous COD exceeding the standard, continuous ammonia nitrogen exceeding the standard, sudden pH change, abnormal zero flow rate, periodic fluctuation of total phosphorus, dissolved oxygen saturation, negative turbidity, data freeze, excessive noise, sudden drop in smoke and dust concentration, COD inversion, and lack of residual chlorine.

[0102] Equipment malfunctions include: temperature tampering, range modification, sensor displacement, light source attenuation, communication timeout, power fluctuation, memory overflow, clock malfunction, standard sample verification failure, and backflushing failure.

[0103] Operational anomalies include: overdue calibration, fake maintenance, expired reagents, undisposed waste liquid, missing inspections, log tampering, spare parts not replaced, and access violations.

[0104] For example, in the event of data exceeding the standard, an alarm can be triggered if COD exceeds 100 mg / L three times consecutively (the national standard limit is 50 mg / L). Abnormal behavior events can be set to trigger an alarm based on access control records recorded outside of working hours.

[0105] S3. In response to an alarm, generate a time-stamped chain of evidence.

[0106] Data is extracted from a preset time period, then timestamped triplet evidence items are generated, and finally, evidence chains are generated by sorting the data by timestamp.

[0107] S4. Based on the chain of evidence, extract the monitoring deviation feature D, the behavioral abnormality feature B, and the semantic feature S.

[0108] Among them, the monitoring deviation feature D is the core indicator for quantifying the degree of pollution. It is generated by mathematically modeling the abnormal trends of the monitoring data sequence, characterizing the degree of deviation of pollutant concentration from the statutory standard limit or process baseline. The behavioral anomaly feature B is the spatiotemporal encoding of personnel violations. Through collaborative analysis of access control records and video streams, it generates a structured vector representing unauthorized behavior. The semantic feature S is the industry semantic label of the pollution scenario. By integrating industry information, such as basic enterprise information and discharge permit data, it generates a risk-weighted semantic code.

[0109] S5. Compress the monitoring deviation feature D, behavioral abnormality feature B, and semantic feature S to generate feature package Z.

[0110] The monitoring deviation feature D, behavioral anomaly feature B, and semantic feature S are extracted from the evidence chain and then compressed to generate a feature package Z. Essentially, the monitoring deviation feature D quantifies the degree of contamination, the behavioral anomaly feature B identifies human factors, and the semantic feature injects industry-specific semantics. These three features are then fused into a lightweight feature package Z during feature distillation. For example, the monitoring deviation feature D may include the deviation of the COD value from the average of the previous hour. The behavioral anomaly feature B may include the interval between access control events and data anomalies. The semantic feature S may include the enterprise industry type code.

[0111] S6. Upload the feature package Z to the cloud platform.

[0112] For example, the feature packet Z is uploaded to the cloud platform via the MQTT protocol.

[0113] The execution steps on the cloud platform include:

[0114] S7. After receiving the feature packet Z, match and map the feature packet Z with the environmental knowledge framework.

[0115] After receiving the feature packet Z, it is matched against a pre-stored environmental knowledge framework. For example, the environmental knowledge framework may include a basic layer, a pattern layer, and a strategy layer. The basic layer can compare COD standard limits, the pattern layer can retrieve historical cases of COD exceeding standards due to regional intrusion, and the strategy layer can associate it with the on-site inspection process of the Water Pollution Prevention and Control Law. For instance, if the matching result is 2.4 times the standard, it meets the "serious exceedance" pattern and is associated with Article 74 of the law (note that this is just an example; it may not actually be associated with this article, and it may not actually be 2.4 times the standard; it is only used as a hypothetical example for ease of understanding).

[0116] S8. Based on the matching mapping results, perform multi-dimensional matching calculations to generate a knowledge tag set.

[0117] The output label set is calculated through multiple dimensions (without limiting the specific algorithm). The label set may include: over-standard confidence K1, behavioral pattern similarity K2, and semantic relevance K3.

[0118] S9. Based on the knowledge tag set, construct a mind chain prompt template.

[0119] By constructing a thought chain prompt template based on a knowledge tag set, and generating a report in three steps: "regulatory matching - behavioral interpretation - evidence suggestion", compared with traditional AI reports that give conclusions directly without evidence, the thought chain prompt template in this embodiment can improve the completeness of the causal chain in the report, which helps to reduce the probability of legal citation errors.

[0120] S10. The language model is driven by the thought chain prompt template to generate an analysis report and feed it back to the edge device.

[0121] A thought chain prompt template is constructed. For example, based on the confidence level K1 of exceeding the standard, legal clauses are matched, and the causal relationship is explained by the similarity of behavioral patterns K2. This drives the language model to generate a report, such as: "COD exceeding the standard is due to illegal operation of the pump room, which needs to be checked according to Article 74." Finally, the cloud platform will send the report text back to the edge device.

[0122] The technical solution provided in this application, firstly, dynamically filters pollution-related features based on an event-driven mechanism of a hierarchical anomaly identification model, accurately extracting behavioral anomaly features B, monitoring deviation features D, and semantic features S from the original data stream, eliminating most of the non-critical data redundancy; secondly, it achieves spatiotemporal alignment and fusion of multi-source heterogeneous data through a timestamped evidence chain architecture, completing protocol normalization locally at the edge, and completely breaking down data silo barriers; finally, it uses cross-modal feature distillation technology to compress multi-dimensional features into a lightweight feature package Z with entropy optimization, making it a high-value-density decision input that can be directly processed in the cloud, thereby completing the reconstruction of the edge-cloud collaborative paradigm from "data quagmire" to "value path".

[0123] In detail, by generating timestamped evidence chains at the edge, traditional isolated alarm events are upgraded into spatiotemporally correlated data chains (monitoring data + device status + video behavior), achieving complete encapsulation of the illegal behavior process. Combined with cloud-based report generation driven by thought chain prompt templates, illegal behavior correlation analysis is automatically output within minutes, significantly shortening the abnormal event backtracking cycle compared to traditional manual reconstruction of illegal behavior. Furthermore, the lightweight transmission mechanism of feature packets (compressed uploading of monitoring deviation feature D, behavioral anomaly feature B, and semantic feature S) and the matching and mapping of the cloud knowledge framework form a two-way optimization. The edge only needs to transmit core features, saving bandwidth. The cloud no longer needs to compress the data collected by the edge and can directly perform cross-scenario correlation analysis based on the received feature packets and the preset environmental protection knowledge framework, reducing the fragmented data verification work of law enforcement personnel and directly outputting a complete and correlated decision-making basis.

[0124] In some embodiments, the environmental knowledge framework includes a foundation layer, a pattern layer, and a strategy layer; the step of matching and mapping the feature package Z with the environmental knowledge framework after receiving the feature package Z includes:

[0125] S71. Obtain the regulatory provisions and pollutant standard limits in the basic layer.

[0126] Pollutant standard limits are imported from the national ecological and environmental standards database and stored as a key-value pair mapping table. A key-value pair is a basic data structure consisting of a unique identifier and associated data. The unique identifier serves as an index for fast retrieval, while the associated data stores specific information. The mapping table is a collection of multiple key-value pairs, forming a structured lookup table. For example, in a scenario where COD exceedance data is matched on a cloud platform: the monitoring deviation feature D in the feature package Z is input, then a key-value query is performed, the standard limit is output, exceedance calculations are performed based on the standard limit, and finally, based on the exceedance result (e.g., whether it exceeds the standard and the exceedance multiple), the relevant regulations are automatically queried.

[0127] S72. Obtain the behavior-data association rules of historical anomaly cases in the schema layer.

[0128] Analyze the historical penalty case database and extract behavior-data association rules. For example, if someone enters the pump room outside of working hours and their COD decreases by more than 40% within 30 minutes, the behavior is classified as Level 1 suspected evasion of supervision based on the behavior-data association rules.

[0129] S73. Load law enforcement process templates associated with laws and / or historical law enforcement cases in the strategy layer.

[0130] The system generates enforcement procedure templates by associating legal provisions. For example, an enforcement procedure for COD exceeding the standard could be: confirm the location of the sampling port on-site, retrieve the analyzer's three most recent calibration records, and collect parallel water samples for testing. Alternatively, it could link to previous historical enforcement cases or combine historical enforcement cases with legal provisions to load the corresponding enforcement procedure template.

[0131] It should be noted that matching and mapping the feature package Z with the environmental knowledge framework can include basic layer matching, pattern layer matching, and strategy layer matching. Basic layer matching: Extracting monitoring deviation characteristics D from feature package Z and querying the basic layer to obtain the corresponding limits. Pattern layer matching: Parsing behavioral anomaly characteristics B from feature package Z and retrieving similar case rules from the pattern library. Strategy layer matching: Loading the corresponding enforcement template based on the matching results.

[0132] In some embodiments, the knowledge tag set includes an over-confidence score K1, a behavioral pattern similarity score K2, and a semantic relevance score K3. The step of generating the knowledge tag set by performing multi-dimensional matching calculations based on the matching mapping results includes:

[0133] S81. Calculate the exceedance confidence level K1 based on the feature package Z and the pollutant standard limit in the base layer.

[0134] The numerical values ​​of the deviation from the monitoring feature D are extracted from the feature package Z, and the corresponding limit is obtained by querying the base layer to calculate the exceedance multiple. For example, if the measured COD is 65 mg / L and the limit is 50 mg / L, the exceedance multiple is equal to the measured value minus the limit, and then divided by the limit, i.e., (65-50) / 50=0.3, resulting in an exceedance of 30%, or K1=30%. By upgrading the degree of exceedance from a qualitative description to a quantitative indicator, law enforcement officers can quickly determine the priority of handling, such as upgrading severe exceedance to K1=0.3.

[0135] S82. Calculate the behavioral pattern similarity K2 based on the feature package Z and the behavior-data association rules in the pattern layer.

[0136] The system parses abnormal behavior features B from feature package Z, such as the set of abnormal access control timestamps. Then, it retrieves matching historical cases from the pattern layer, such as the matching rules between access control during non-working hours and sudden drops in COD. Finally, it calculates the behavior sequence similarity, i.e., the behavior pattern similarity K2. K2 = number of matching cases / total number of relevant cases. By using the similarity score to intuitively reflect the degree of consistency between the current behavior and historical illegal access patterns, it replaces traditional experience-based guessing.

[0137] S83. Calculate the semantic correlation degree K3 based on the feature package Z and the law enforcement process template in the strategy layer.

[0138] Semantic features S are extracted from the feature package Z, and an enforcement template from the strategy layer is loaded. The speech relevance between semantic features S and the enforcement template is calculated. For example, semantic features S may include enterprise industry codes, and the enforcement template may include the illegal discharge process of wastewater from a chemical enterprise. By using the relevance score to directly indicate the fit between the enforcement module and the current enterprise, the incorrect application of the process is avoided.

[0139] Further, the step of calculating the exceedance confidence level K1 based on the feature packet Z and the pollutant standard limit in the base layer includes:

[0140] S811. Extract the monitoring feature vector value V of the monitoring deviation feature D from the feature package Z.

[0141] For example, after receiving the feature packet Z uploaded by the edge device, the cloud platform analyzes the monitoring deviation feature D within it and extracts three core values: the current pollutant concentration value, the concentration change rate, and the baseline deviation. For instance, a COD exceeding the standard event at a wastewater treatment plant specifically has a pollutant concentration value of 65, a concentration change rate of 0.32, and a baseline deviation of 45.7.

[0142] S812. Query the pollutant standard limit L corresponding to the monitoring deviation feature D from the basic layer.

[0143] Based on the pollutant identifier, such as COD, in feature packet Z, query the pre-stored basic layer knowledge base in the cloud. Querying the pre-stored basic layer knowledge base in the cloud may include retrieving the national standard limit for the pollutant and obtaining the relevant regulatory provisions index.

[0144] S813. Calculate the Euclidean distance based on the monitoring feature vector value V and the pollutant standard limit value L.

[0145] First, construct the baseline vector: using the standard limit value L as the core, supplement it with two ideal values ​​(e.g., a rate of change of 0 and a deviation of 0) to generate the baseline vector [L, 0, 0]. Then, calculate the weighted distance. The formula for calculating the weighted distance is: d e =√∑ 3 i=1 w i (V i -L i ) 2 .

[0146] Corresponding to the specific parameters in this embodiment, the formula for calculating the weighted distance can be: d e =√[w1×(v1-L1) 2 +w2×(v2-L2) 2 +w3×(v3-L3) 2 .

[0147] Where, de For weighted Euclidean distance, w1 is the pollutant concentration weight, w2 is the concentration change rate weight, w3 is the baseline deviation weight, v1 is the current pollutant concentration value, v2 is the concentration change rate, v3 is the baseline deviation, L1 is the pollutant standard limit, L2 is the change rate (in this example, L2=0), and L3 is the deviation (in this example, L3=0).

[0148] S814. Generate the overscore confidence level K1 based on the Euclidean distance.

[0149] Scaling Mapping: Dividing the Euclidean distance by the scaling factor α yields the overscaling confidence level K1. K1 is limited to a value between 0 and 1; if the result is greater than 1, K1 is set to 1. Specifically, the formula for calculating the overscaling confidence level K1 is as follows:

[0150] K1=min(d e / α,1).

[0151] From the formula for calculating the over-standard confidence level K1, we know that: [The following is a separate, unrelated statement:] ...the distance value d of any dimension... e Convert to a dimensionless confidence score. α is related to the sensitivity of the over-standard confidence level K1; the smaller α is, the lower the sensitivity for the same d. e The larger the calculated K1, the more sensitive the over-supplied confidence level K1 is; the larger α is, the more sensitive the over-supplied confidence level K1 is. e The smaller the calculated K1, the more relaxed the over-standard confidence level K1 is.

[0152] For example, when COD slightly exceeds the standard e =8, α=20, K1=min(8 / 20,1)=min(0.4,1)=0.4. Based on K1=0.4, the current risk can be judged as medium risk, and the law enforcement response can be set to check within 24 hours. When COD seriously exceeds the standard, d e =25, α=20, K1=min(25 / 20,1)=min(1,1.25)=1. Based on K1=1, the current risk can be judged as high risk, and the law enforcement response can be set to immediately activate the emergency plan. When a false alarm occurs (such as interference from heavy rain), d e =15 (actually due to rainwater dilution), α=30 (temporarily raising the threshold), K1=min(15 / 30,1)=min(0.5,1)=0.5. Based on K1=0.5, the current risk can be determined to be medium risk, and the enforcement response can be set to prioritize checking the equipment status to avoid false alarms.

[0153] In some embodiments, the step of calculating the behavioral pattern similarity K2 based on the feature package Z and the behavior-data association rules in the pattern layer includes:

[0154] S821. Parse the time sequence of monitoring data from the monitoring deviation feature D in the feature package Z.

[0155] After receiving the feature packet Z on the cloud platform, the monitoring data time series within it is first parsed. For example, a pollutant concentration sequence (such as a COD value sequence) sorted by timestamp is obtained from the monitoring deviation feature D. Then, key features are identified, such as locating concentration abrupt change points and marking periodic fluctuations. Locating concentration abrupt change points can be set to a change rate exceeding 10% / minute, and marking periodic fluctuations can be done by identifying the main fluctuation frequencies using a Fast Fourier Transform. Finally, the timestamps are converted to relative time, using the alarm trigger time as the reference point.

[0156] S822. Retrieve historical anomaly templates that match the behavioral anomaly feature B from the pattern layer.

[0157] Based on the encoding of behavioral anomaly feature B, matching templates are retrieved at the pattern layer. The retrieval layer can be set up as a three-level retrieval mechanism, such as: Level 1: behavioral encoding matching (e.g., code 105 corresponds to "regional invasion"); Level 2: pollutant type matching (e.g., COD / ammonia nitrogen); Level 3: enterprise size screening (daily wastewater discharge ±20% range). Then, template loading is performed, including obtaining typical concentration curves of historical cases based on the results of the three-level retrieval, and then extracting key time parameters (e.g., duration of mutation) based on the typical concentration curves.

[0158] For example, when behavior code 105 is retrieved, the template "illegal discharge case of a sewage treatment plant" is matched, and then the template is loaded to obtain typical concentration curves of historical cases and extract key time parameters.

[0159] S823, Load the process cycle weight function corresponding to the enterprise industry type.

[0160] The system dynamically loads industry-specific process cycle weighting functions based on the company's registration information. For continuous production industries, such as petrochemical plants, a 24-hour sinusoidal weight is used; for example, the process cycle weighting function is η(t) = sin²(πt / 24) + 0.5 (24-hour cycle). For intermittent production industries, such as electroplating plants, a 6-hour exponential decay weight is used; for example, the process cycle weighting function is η(t) = 1.5 (operating period) / 0.5 (downtime) (step function).

[0161] In addition, dynamic parameter adaptation can be performed, such as adjusting based on work shifts: the weight of night shifts in three-shift companies is 1.2; seasonal factor compensation: the weight of pollution prevention options in winter is 1.3. Examples are as follows:

[0162] The electroplating plant is operating on a night shift, which is intermittent. The current time is 22:10, which is the night shift operation period. The loading function η(t) = 1.5, the seasonal compensation is for the winter anti-fouling period, and the final weight = 1.5 × 1.3 = 1.95.

[0163] S824. Generate the behavior pattern similarity K2 based on the monitoring data time sequence, the historical anomaly template, and the process cycle weight function.

[0164] The behavioral pattern similarity K2 is generated using an improved DTW algorithm. The specific calculation process is as follows:

[0165] First, establish a time mapping between the current sequence and the template, with the constraint that the maximum time shift is less than 3 minutes (threshold for industrial scenarios).

[0166] Second, weighted distance calculation: Single point distance = process weight η(t) × (current value - template value) 2 The total path distance is equal to the sum of the distances to multiple individual points along the optimal path.

[0167] Third, perform similarity normalization. The similarity normalization formula is as follows:

[0168] K2 = 1 / (1 + √total path distance).

[0169] In some embodiments, the step of calculating the semantic relevance K3 based on the feature package Z and the law enforcement process template in the policy layer includes:

[0170] S831. Parse the text description features from the semantic features S in the feature package Z;

[0171] S832. Extract the relationship chain from the law enforcement process template in the strategy layer;

[0172] S833. Based on the text description features and the association chain, perform language model encoding;

[0173] S834. Calculate the semantic relevance K3 based on the language model encoding.

[0174] The calculation process for semantic relevance K3 is illustrated below:

[0175] First, extract text description fields from the semantic features S of the feature package Z: original text (e.g., abnormal opening of the pump station at night) and associated entities (e.g., "pump station", "night"). Perform text standardization: remove stop words ("of", "at", etc.) and normalize entities ("pump station" is normalized to "sewage lifting pump station"). For example: input text "COD analyzer cover was opened", standardized output "analyzer cover illegally opened".

[0176] Second, retrieve the knowledge graph based on the core entities in the text (such as "analyzer cover"), and then extract the related relationship chains. For example, trace upwards: the analyzer cover is open, which is related to suspected data tampering; trace downwards: data tampering is related to violating Article 42 of the Environmental Protection Law.

[0177] Third, the Sentence-BERT model, finely tuned for the environmental field, is used to perform text encoding and relational chain encoding, generating text vectors and relational chain vectors.

[0178] Fourth, perform semantic distance and association strength calculation:

[0179] The formula for calculating semantic distance is:

[0180] d sem =|vec feature -v KG |;

[0181] The formula for calculating the correlation strength is:

[0182] K3=1 / (1+d sem ).

[0183] Among them, vec feature This refers to a text vector, specifically the mathematical representation of text extracted from the semantic features S of the feature bag Z and encoded by the Sentence-BERT model; v KG This refers to the relational chain vector, specifically the result of encoding relational chains stored in a cloud-based knowledge graph (KG) using the same Sentence-BERT model; d sem K1 refers to semantic distance, which quantifies the semantic difference between text description and knowledge relationship; the smaller the value, the more similar they are. K2 refers to semantic association strength, which is the degree of matching between text description and knowledge relationship; the larger the value, the stronger the association.

[0184] In some embodiments, after receiving the feature packet Z and matching and mapping it with the environmental knowledge framework, the method further includes: evidence chain integrity verification. By verifying the integrity of the evidence chain, if a key evidence type is missing, a supplementary evidence instruction is triggered by the rule engine and fed back to the edge device. Specifically, the evidence chain integrity verification includes:

[0185] A pre-built standard rule base for structured evidence chains is established at the strategy layer of the cloud platform;

[0186] Parse the event identifiers in the evidence chain and query the standard rules for the evidence chain of that event type from the policy layer;

[0187] The event identifier is compared with the standard rules of the chain of evidence, and the risk level of evidence completeness is assessed based on the comparison results. For example, if all necessary evidence is complete, it can be determined as low risk; if one necessary piece of evidence is missing, it can be determined as medium risk; if two or more necessary pieces of evidence are missing, it can be determined as high risk.

[0188] Generate a verification report, which can list the evidence items provided, indicate the types of missing evidence, and provide a completeness score.

[0189] Based on the type of missing evidence, the rules in the preset structured evidence chain standard rule base are invoked. For example, if the key evidence type is operation log, the instruction "retrieve operation records 30 minutes before and after the alarm time" is generated; if the key evidence type is video evidence, the instruction "retrieve surveillance video 5 minutes before and after the alarm time" is generated.

[0190] The invoked rules are encapsulated in a structured instruction format, which includes: clearly defining the instruction type as "evidence supplementation", specifying the missing evidence items, the precise time window, specifying the specific equipment to be operated on, and indicating the relevant legal provisions;

[0191] Instructions are pushed to edge devices via encrypted message queues;

[0192] The edge device automatically executes the data acquisition task. The specific content of the acquisition task depends on the missing evidence. If video is missing, the acquisition task is to activate the specified camera for playback; if logs are missing, the acquisition task is to connect to the PLC to read historical records; if parameters are missing, the acquisition task is to remotely read the device configuration snapshot.

[0193] In some embodiments, the step of constructing a mind chain prompt template based on a knowledge tag set includes:

[0194] S911. Match legal provisions in the base layer based on the over-confidence level K1.

[0195] The exceedance confidence level K1 is extracted from the knowledge tag set. K1 is calculated from the feature package Z and the pollutant limit of the base layer. For example, when K1 ≥ 0.8, it matches the "serious violation" category; when 0.5 ≤ K1 < 0.8, it matches the "general violation" category; and when K1 < 0.5, it matches the "administrative warning" category. A fixed-format statement is then generated in the thought chain template: Based on the exceedance confidence level K1, associate {law name} with {article number}. For example, in a COD exceedance event, K1 = 0.93, matching Article 83 of the Water Pollution Prevention and Control Law.

[0196] S912. Generate a causal chain between abnormal events and related behaviors based on the behavioral pattern similarity K2.

[0197] The behavioral pattern similarity K2 is extracted from the knowledge tag set to represent the degree of matching between the current behavior and historical violation patterns. For example: when K2 ≥ 0.7, a strong causal chain is generated: the specific behavior directly leads to the exceedance of {pollutant}; when 0.4 ≤ K2 < 0.7, a medium causal chain is generated: the specific behavior may be related to the exceedance of {pollutant}; when K2 < 0.4, a weak causal chain is generated: the specific behavior has a low correlation with the exceedance of {pollutant}. Then, the occurrence time of the behavior and the time of data anomaly are automatically inserted. For example, if an intrusion occurs in the pump room area at 22:05 and a sudden drop in COD occurs at 22:08, and K2 = 0.88 at this time, then the output can be: the intrusion occurred in the pump room area at 22:05, directly causing the sudden drop in COD at 22:08.

[0198] S913. Output evidence priority and law enforcement steps based on semantic relevance K3.

[0199] In this embodiment, when K3 ≥ 0.8, the evidence level can be defined as critical evidence, and the processing method is immediate action required; when 0.5 ≤ K3 < 0.8, the evidence level can be defined as important evidence, and the processing method is action within 24 hours; when K3 < 0.5, the evidence level can be defined as reference evidence, and the processing method is deferred. It is understood that the aforementioned relationship between K3, evidence level, and processing method can be changed according to actual circumstances, such as changing K3 ≥ 0.8 to K3 ≥ 0.9. For the execution steps, corresponding operations can be performed according to the type of evidence, and the execution steps can be ordered according to the evidence priority.

[0200] For example, suppose the electroplating plant has excessive cyanide levels: Input parameters K1=0.95, i.e., the confidence level of cyanide exceeding the standard is 0.95; K2=0.91, i.e., the similarity of behavioral patterns is 0.91; K3=0.86, i.e., the relevance of video evidence is 0.86. K1=0.95 matches Article 58 of the "Regulations on the Management of Hazardous Waste," and the output basis K1=0.95 is associated with Article 58 of the "Regulations on the Management of Hazardous Waste," completing the matching of legal provisions; K2=0.91 generates a strong causal chain, outputting that the illegal discharge of the electroplating tank at 22:03 directly caused the total cyanide to exceed the standard at 22:06, completing the generation of the causal chain; K3=0.86 matches the video evidence as key evidence, and the output evidence priority is that the priority of the surveillance video is higher than that of the tank liquid detection record. The execution steps are: immediately seal off the electroplating workshop, and then collect water samples from the hidden pipe discharge outlet. It should be noted that the above-mentioned implementation steps, specific regulations and articles are all fictional examples and not actual regulations and articles. The implementation steps may also be adjusted according to the actual situation.

[0201] In some embodiments, the step of generating an analysis report by driving a language model through a thought chain prompt template and feeding it back to the edge device includes:

[0202] S101. Analyze the data triples, state triples, and video triples in the evidence chain;

[0203] S102. Convert video triples into natural language behavior descriptions using a cross-modal semantic alignment model;

[0204] S103. Integrate data triples, state triples, and natural language behavior descriptions to generate enhanced input text;

[0205] S104. Generate an analysis report by calling the language model based on the thought chain prompt template and enhanced input text;

[0206] S105. Feed the analysis report back to the edge device.

[0207] It should be noted that data triples are generated from formatted segments of the acquired monitoring data sequence; state triples are generated from formatted snapshots of the acquired parameters; and video stream triples are generated from formatted video keyframe timestamps. The processing of monitoring data sequence segments, parameter snapshots, and video keyframe timestamps will be described in detail in subsequent edge device processing, and will not be repeated here.

[0208] In detail, this embodiment decodes the video vectors in video triples into enhanced input text, i.e., natural language descriptions. This effectively solves the problem that traditional text reports cannot carry video information and require manual review of recordings and manual text entry. This approach is simpler and faster. For example, video feature vectors (such as 256-dimensional tensors) are extracted from video triples and input into a pre-trained cross-modal semantic alignment model (such as the CLIP-ViT model). This model parses the vectors using a spatial-temporal attention mechanism: high-activation dimensions are mapped to behavioral subjects (such as "personnel" or "vehicles"), spatial distribution features are decoded into location information (such as "pump station area"), and temporal change features are converted into dynamic descriptions (such as "gathering" or "opening valves"). Finally, a natural language description with a fixed grammatical structure is generated: "time + location + subject + behavior". For example, an input vector [0.88, -0.18, 0.42] outputs "22:05 Two people in the pump station area open the drainage valve". Then, by using thought chain prompt templates to constrain the language model's free expression, standardized output is ensured, avoiding the generation of irrelevant content as in traditional language models.

[0209] The following is an example of generating enhanced input text by fusing data triples, state triples, and natural language behavior descriptions:

[0210] The natural language behavior descriptions generated by cross-modal models (such as "two people opened the valve in the pump room area at 22:05") are deeply integrated with the evidence chain: First, the structured data in the evidence chain (such as monitoring data "COD=200mg / L at 22:08" and equipment status "pump frequency increased by 50% at 22:05") are analyzed. The relationship between behavior and data is established through a spatiotemporal alignment algorithm—the order of behavior and result is quantified by the time difference Δt (such as COD exceeding the standard 3 minutes after the valve is opened), and the causal marker "→" is inserted to explicitly express the logical link. Then, semantic features S (such as the company description "equipment maintenance") are fused, and the conflict points between objective behavior and subjective statement are automatically marked by the contradiction detection module (such as "claiming maintenance but the behavior matches illegal discharge"). Finally, structured enhanced text is generated.

[0211] In this embodiment, the causal relationship between behavior and data is forcibly established by calculating Δt and using the "→" symbol, thus forming a unified chain of evidence from traditionally separately stored video, data, and text evidence. By comparing the semantic differences between the company's description and the video behavior, the detection rate of deceptive claims that are difficult for humans to detect is improved, such as a factory claiming "equipment failure" but the video showing "human short-circuiting of the sensor". The structured input improves the accuracy of large model report generation, especially in complex scenarios (such as dilution and illegal discharge during rainstorms), it can still accurately output the complete chain of "behavior → data → legal consequences".

[0212] In some embodiments, the analysis report includes: anomaly determination conclusions and confidence levels, causal tree construction, evidence chain integrity assessment and supplementary evidence recommendations, law enforcement process guidelines, and an index of relevant legal provisions.

[0213] In some embodiments, the step of constructing a causal tree includes:

[0214] The source of contamination is determined based on the type of the initial abnormal event in the chain of evidence: the first abnormal event in the chain of evidence (e.g., event code 201 represents "abnormal drop in COD") is parsed, and the source of contamination is matched with the source of contamination mapping table (e.g., "COD drop → dilution and illegal discharge"). When the chain of evidence contains an earlier behavioral event (e.g., "area intrusion"), the source of contamination is dynamically corrected to the initial behavior (e.g., "illegal area intrusion").

[0215] Fill in the details of the behavior node based on the causal description of the behavior pattern similarity K2: extract the causal description of the behavior pattern similarity K2 (e.g., K2=0.88 corresponds to "valve operation → COD exceeds the standard"), inject spatiotemporal details (timestamp is extracted from the evidence chain, and the location is decoded by video features), and generate the node: "${time}${location}${K2 behavior description}" (e.g., "22:05 valve operation in the pump room area").

[0216] Use the exceedance value corresponding to the exceedance confidence level K1 to mark the pollution performance: Calculate the exceedance range based on the monitoring value corresponding to the exceedance confidence level K1 (e.g., COD=200mg / L): (Measured value - Limit) / Limit × 100% (e.g., Limit 50mg / L → Exceedance 300%), and bind the K1 value as "${pollutant} Exceedance ${range}% (confidence level ${K1})" (e.g., "COD exceeds the standard by 300% (K1=0.95)").

[0217] In some embodiments, the step of acquiring multimodal data streams of pollution sources includes:

[0218] S11. Determine the data collection protocol based on the environmental regulatory scenario;

[0219] S12. Configure the acquisition source according to the four-dimensional anomaly system to collect multimodal data streams of pollution sources;

[0220] The four-dimensional anomaly system includes behavioral anomalies, data anomalies, equipment anomalies, and operation and maintenance anomalies.

[0221] When deploying edge devices at pollution source sites, the first step is to dynamically select the data acquisition protocol (such as the HJ 212-2017 environmental protection protocol or the Modbus industrial protocol) based on the characteristics of the regulatory scenario (e.g., wastewater treatment plants need to monitor COD / ammonia nitrogen, and chemical plants need to monitor VOCs); then, the data acquisition source is configured according to the four-dimensional anomaly system.

[0222] Abnormal behavior: AI cameras can be used to detect behaviors such as area intrusion and illegal operations (e.g., personnel entering the pump room outside of working hours).

[0223] Data anomaly: Connect to an online analyzer to obtain pollutant concentrations in real time (e.g., sudden change in COD value > 10% / min).

[0224] Equipment malfunction: Read equipment status parameters (such as abnormal analyzer temperature, sudden drop in pump current);

[0225] Operational anomalies: Analyze access control logs and maintenance records (such as overdue calibration, fake maintenance work orders).

[0226] In some embodiments, the step of triggering an alarm based on a hierarchical anomaly identification model according to the multimodal data stream of the pollution source includes:

[0227] S21. Acquire monitoring data, equipment status parameter time series data, access control records, and real-time video stream.

[0228] S22. Perform change characteristic judgment on the monitoring data and select whether to generate monitoring data anomaly identifier based on the judgment result.

[0229] The determination of these change characteristics includes at least whether the specific values ​​of the monitored data exceed the limits, whether the monitored data changes abruptly, and whether the monitored data fluctuates smoothly. For example, an exceedance threshold can be set, and the monitored data can be compared with the exceedance threshold to determine whether the change characteristic exceeds the limit; a change rate threshold can be set, and the monitored data can be compared with a time period to obtain the actual change rate, and whether the actual change rate exceeds the change rate threshold can determine whether the change characteristic is abrupt; a fluctuation threshold can be set, the actual fluctuation value can be calculated, and the actual fluctuation value can be compared with the fluctuation threshold to determine whether the change characteristic is smooth fluctuation.

[0230] S23. Perform threshold determination on the equipment status parameters and select whether to generate an equipment abnormality flag based on the determination result.

[0231] Edge devices collect equipment status parameters in real time, such as the parameters and status of analytical instruments, and pump current. Analytical instrument parameters can include the instrument's operating range, digestion temperature, and digestion time, while status can include operating status (calibration, measurement, idle, etc.) and alarm status. Dynamic judgment is performed using a preset threshold rule base: when parameters continuously exceed the threshold range (e.g., temperature > 165℃ or current fluctuation > 15%), an equipment anomaly identifier is generated, triggering an equipment anomaly alarm event (event code 501). For example, if the pump current at a wastewater treatment plant suddenly drops by 30% (threshold ± 10%), the system immediately marks the anomaly and triggers an alarm.

[0232] S24. Perform time period verification on the access control records, and select whether to generate an access control anomaly flag based on the verification results.

[0233] The system analyzes the entry / exit timestamps and authorization information from the access control records and compares them with a pre-loaded enterprise work / rest period rule base (e.g., for manufacturing companies, 8:00-18:00 is the work period). If unauthorized entry / exit outside of work hours is detected (e.g., unauthorized personnel entering at 22:05), an access control anomaly flag is generated and a behavioral anomaly alarm (event code 101) is triggered. In a chemical plant case, the system accurately identified the unauthorized entry into the hazardous materials warehouse at 22:03.

[0234] S25. Perform behavior analysis on the video stream and select whether to generate video anomaly flags based on the behavior analysis results.

[0235] The lightweight YOLOv8 model analyzes video streams in real time to identify 20 predefined types of violations (such as area intrusion and illegal equipment operation). When the confidence level of the behavior recognition is greater than 90%, a video anomaly identifier is generated, triggering a behavior anomaly alarm (event code 105). For example, if the camera captures "22:10 Personnel in the pump room area short-circuiting the sensor", the model will trigger an alarm with a 92% confidence level.

[0236] S26. An alarm is triggered when at least two of the following are generated: monitoring data anomaly identifier, equipment anomaly identifier, access control anomaly identifier, and video anomaly identifier.

[0237] By requiring at least two anomaly indicators to be linked to trigger an alarm, the number of false alarms can be effectively reduced. Alternatively, in other embodiments, three anomaly indicators can be linked: when equipment anomaly, access control anomaly, and video anomaly are generated, the specific details of each anomaly are input into a preset rule model for comprehensive logical analysis. Based on the analysis result, an alarm is triggered, further reducing the number of false alarms. This comprehensive logical analysis means that in addition to requiring at least two anomaly indicators, it also involves comprehensively judging whether two or more anomaly indicators can be correlated to determine whether an alarm should be triggered. Compared to simply triggering an alarm based on the presence of two or more anomaly indicators, this comprehensive analysis method further reduces the probability of false alarms. An example of comprehensive logical analysis is as follows:

[0238] Within a similar time period, access control anomaly indicators, equipment anomaly indicators, and monitoring data anomaly indicators appeared. Specifically, the access control system was abnormally activated, followed by some equipment related to the monitoring data malfunctioning or stopping, and then the monitoring data showed a sudden increase. At this point, it can be determined that these three anomaly indicators are related, triggering an alarm.

[0239] In some embodiments, the step of generating a timestamped chain of evidence in response to an alarm includes:

[0240] S31. Using the alarm trigger time as the reference point, dynamically determine the start point and set the end point of the retrospective period according to the alarm type.

[0241] For example, using the alarm trigger time (e.g., COD exceeding the limit at 22:08) as the baseline, the backtracking period is automatically determined based on the alarm type:

[0242] Behavioral alarm: Backtracking starting point = alarm time - 5 minutes (e.g., 22:08 → 22:03) to capture prior behavior;

[0243] Equipment alarm: Trace back to the starting point = alarm time - 30 minutes, and analyze the gradual failure of the equipment;

[0244] The endpoint is standardized as follows: alarm time + 2 minutes, to cover subsequent impacts.

[0245] By utilizing dynamic windows, the waste of resources in fixed backtracking can be resolved. For example, in a case of illegal dumping, the key operations performed 4 minutes before the alarm can be accurately identified, which helps to improve backtracking efficiency.

[0246] S32. During the retrospective period, acquire: associated monitoring data sequence fragments, parameter snapshots at the time of equipment status change, and video keyframe timestamps related to abnormal events.

[0247] For example, data is automatically collected during the backtracking period (e.g., 22:03-22:10):

[0248] Monitoring data sequence: extracting time segments of pollutant concentration (e.g., COD value rising from 80 mg / L to 200 mg / L from 22:05 to 22:08).

[0249] Equipment parameter snapshot: Records the equipment status at abnormal moments (e.g., the water pump frequency suddenly drops to 30% at 22:05);

[0250] Video keyframes: Mark the timestamp of behavioral events (e.g., 22:05 pump room personnel intrusion).

[0251] Multi-protocol compatibility (HJ 212 / Modbus / ONVIF) helps improve the completeness of data acquisition, such as in a case where two key pieces of evidence related to "sudden current drop" and "valve opening" were obtained simultaneously.

[0252] S33. Format the acquired monitoring data sequence fragments to generate data class triples, format the acquired parameter snapshots to generate state class triples, and format the video keyframe time stamps to generate video class triples.

[0253] For example, the raw data is converted into structured triples:

[0254] Data type: {"Monitoring data", "COD: 80mg / L→200mg / L", "22:05-22:08"};

[0255] Status category: {"Device status", "Pump frequency: 40Hz→15Hz", "22:05"};

[0256] Video category: {“Behavioral event”, “Area intrusion”, “22:05:03”}.

[0257] By utilizing the triplet structure, the volume of evidence storage can be reduced, thus saving storage costs.

[0258] S34. Based on the three types of triples, add timestamps to generate timestamped evidence items.

[0259] For example, add a standard timestamp to each triple: add associated sampling time to data classes, add binding change time to state classes, and add precise synchronization frame time to video classes.

[0260] S35. Sort the evidence items according to the order of their timestamps.

[0261] For example, rearranging evidence items in ascending order of timestamps can facilitate the automatic reconstruction of illegal processes. For instance: a video event occurs at 22:05:03: area intrusion; a change in equipment status occurs at 22:05:17: water pump frequency drops sharply; a change in monitoring data occurs at 22:08:00: COD spikes to 200 mg / L.

[0262] S36. Based on the event association rules of the hierarchical anomaly identification model, add causal association markers between events.

[0263] Logical tags are added based on event association rules, for example:

[0264] Rule: If a “regional intrusion” is accompanied by a “device malfunction” within 5 minutes, then the regional intrusion is marked as causing the device parameters to be tampered with. Through the automatic generation of the causal chain, the evidentiary value is improved compared to human experience judgment.

[0265] S37. Integrate the sorted and marked evidence items into a chain of evidence.

[0266] In some embodiments, the step of compressing the monitored deviation feature D, the behavioral anomaly feature B, and the semantic feature S to generate a feature package Z includes:

[0267] S51. Based on the monitoring deviation feature D, use the attention mechanism to extract key trend segments and generate a monitoring feature vector.

[0268] For example, for the monitored deviation feature D (such as COD time series data), an attention mechanism is applied to focus on the magnitude of the exceedance (such as a sudden increase of 80% within 10 minutes) and statistical markers. The deviation feature is calculated using a time series pattern matching algorithm (Fourier transform to extract the fundamental frequency). Normal data within a dynamic time window before the abnormal period (such as a sampling frequency of 5 minutes and a backtracking of 20 minutes) is selected as a benchmark to generate a 128-dimensional feature vector representing the key trend (such as "COD continuously exceeds the standard from 22:05 to 22:15"). The technical solution provided in this step can improve the retention rate of key segments while effectively compressing data and reducing the data volume.

[0269] Statistical identification refers to the label corresponding to each data point. The label represents the operating status of the equipment when the corresponding data is monitored. The labels generally include normal (N), calibration (C), maintenance (M), and shutdown (P).

[0270] S52. Based on the abnormal behavior feature B, process the associated video segments using a spatiotemporal compression model to generate a behavioral semantic feature vector.

[0271] Based on abnormal behavioral features B (such as access control logs and video streams), behavioral pattern analysis is performed using a behavioral recognition model (such as a lightweight 3DCNN or a lightweight spatiotemporal graph network). This involves identifying the frequency of unauthorized entry into key areas during unauthorized periods (e.g., intrusion into the pump room at 22:03), followed by temporal correlation calculations: matching the timestamps of monitored events (e.g., 5 minutes before a sudden drop in COD), and finally outputting a 256-dimensional behavioral semantic vector (e.g., [0.82, -0.3] represents "short-circuit sensor operation"). This step effectively improves analysis speed, increases video clip processing speed, and enhances the accuracy of the correlation between behavior and events.

[0272] S53. Based on semantic feature S, integrate industry risk tags associated with industry information to generate a semantic enhancement vector.

[0273] For example, instrument parameter fusion is performed: basic monitoring, equipment operation, and calibration quality control. A three-layer feature pyramid is constructed and fused into a comprehensive risk value. Discharge permit maps from industry information are matched (e.g., electroplating plants are matched with high-risk cyanide processes), and a 128-dimensional semantic augmentation vector is generated using the BERT model.

[0274] S54. By using a pre-trained encoding matrix, the monitoring feature vector, behavioral semantic feature vector, and semantic enhancement vector are unified to the same dimension and a low-dimensional feature tensor is generated as the feature package Z.

[0275] For example, dimensionality unification and tensor generation are performed using a pre-trained cross-modal encoding matrix. Dimensionality unification: The monitoring vector is mapped to 64 dimensions, the behavior vector is compressed to 64 dimensions, and the semantic vector is aligned to 64 dimensions. Tensor generation: The three vectors (monitoring vector, behavior vector, and semantic vector) are concatenated and compressed into a 128-dimensional feature package Z by an autoencoder.

[0276] In summary, this application provides an environmental monitoring method based on an edge-cloud collaborative architecture. Through a two-way optimization mechanism of edge-end intelligent sensing and cloud-driven knowledge, it thoroughly solves the three core problems in traditional pollution source monitoring: "long time consumption for illegal reconstruction, low efficiency in evidence correlation, and weak decision support." Specifically, it dynamically configures data collection sources according to a four-dimensional anomaly system (behavior / data / equipment / maintenance), is compatible with multiple protocols, and achieves full coverage of pollution sources. Through four levels of parallel processing—monitoring data judgment (data anomaly), equipment status judgment (equipment anomaly), time period verification (access control anomaly), and AI behavior analysis (video anomaly)—precise alarm events are triggered. It should be noted that time period verification and AI behavior analysis can be integrated into one category, as some access control anomalies are also obtained through video surveillance. In this embodiment, the triplet evidence item merges video anomalies and access control anomalies into a video category. Dynamic backtracking is performed based on the alarm time to generate timestamped triplet evidence items (data category / status category / video category), which are then integrated into a structured evidence chain in spatiotemporal order. A three-tiered knowledge architecture (foundation layer - regulatory limits / pattern layer - historical cases / strategy layer - enforcement templates) enables intelligent mapping of the feature package Z. It calculates the exceedance confidence level K1 (quantifying the degree of contamination), behavioral pattern similarity K2 (spatiotemporal causal relationship), and semantic relevance K3 (evidence priority). Through a three-step prompt template of "regulatory matching → behavioral interpretation → evidence suggestion," the large model outputs an executable report containing a causal tree and legal provision index. The monitoring feature vector, behavioral semantic vector, and semantic enhancement vector are combined and compressed into a 128-dimensional feature package Z. The cloud report is automatically pushed to edge devices, forming a closed loop of perception, decision-making, and execution.

[0277] Based on the above method embodiments, this application also provides a storage medium, which is a computer-readable storage medium. The storage medium stores a computer program, which, when run by a processor, executes the above method embodiments. Specifically, the storage medium can be a general-purpose storage medium, such as a removable disk or hard disk, and the computer program on the storage medium, when run, can execute the methods described in the above embodiments.

[0278] Based on the above method embodiments, this application also provides a computer program product, including computer instructions, which, when run on an edge-cloud architecture-based environment monitoring system, enable the system to execute the above method embodiments.

[0279] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An environment monitoring method based on an edge-cloud architecture, characterized in that, It includes edge devices and a cloud platform, with the edge devices located at the environmental monitoring site; The execution steps of the edge device include: Collect multimodal data streams from pollution sources; An alarm is triggered based on the multimodal data stream of the pollution source through a hierarchical anomaly identification model. In response to the alarm, a timestamped chain of evidence is generated; Based on the chain of evidence, extract monitoring deviation feature D, behavioral anomaly feature B, and semantic feature S; The monitoring deviation feature D, the behavioral anomaly feature B, and the semantic feature S are compressed to generate feature package Z; The step of compressing the monitoring deviation feature D, the behavioral anomaly feature B, and the semantic feature S to generate feature package Z includes: Based on the monitored deviation feature D, an attention mechanism is applied to extract key trend segments and generate a monitoring feature vector; Based on the behavioral anomaly feature B, the associated video segments are processed using a spatiotemporal compression model to generate a behavioral semantic feature vector. Based on the semantic feature S, industry risk tags associated with industry information are fused to generate a semantically enhanced vector; The monitoring feature vector, behavioral semantic feature vector, and semantic enhancement vector are unified to the same dimension by using a pre-trained encoding matrix, and a low-dimensional feature tensor is generated as the feature package Z. The feature package Z is uploaded to the cloud platform.

2. The environment monitoring method based on edge-cloud architecture according to claim 1, characterized in that, The step of triggering an alarm based on the multimodal data stream of the pollution source through a hierarchical anomaly identification model includes: Acquire monitoring data, time-series data of equipment status parameters, access control records, and real-time video streams; The monitoring data is subjected to change feature determination, and an option is selected to generate an anomaly flag based on the determination result. Perform threshold judgment on equipment status parameters and select whether to generate equipment abnormality flag based on the judgment result; Perform time period verification on access control records, and select whether to generate access control anomaly flags based on the verification results; Perform behavioral analysis on the video stream and select whether to generate video anomaly flags based on the behavioral analysis results; An alarm is triggered when at least two of the following are generated: monitoring data anomaly identifier, equipment anomaly identifier, access control anomaly identifier, and video anomaly identifier.

3. The environment monitoring method based on edge-cloud architecture according to claim 1, characterized in that, The step of generating a timestamped chain of evidence in response to the alarm includes: Using the alarm trigger time as a baseline, the start and end points of the retrospective period are dynamically determined based on the alarm type. During the backtracking period, acquire: associated monitoring data sequence fragments, parameter snapshots at the time of equipment status changes, and video keyframe timestamps related to abnormal events; The acquired monitoring data sequence fragments are formatted to generate data class triples, the acquired parameter snapshots are formatted to generate state class triples, and the video keyframe time stamps are formatted to generate video class triples. Based on the three types of triples, timestamps are added to generate timestamped evidence items; The evidence items are ordered according to the order of their timestamps; Based on the event association rules of the hierarchical anomaly identification model, add causal association markers between events; The sorted and labeled evidence items are integrated into the evidence chain.

4. The environment monitoring method based on edge-cloud architecture according to any one of claims 1 to 3, characterized in that, The execution steps of the cloud platform include: After receiving the feature packet Z, match and map the feature packet Z with the environmental knowledge framework; Based on the matching mapping results, perform multi-dimensional matching calculations to generate a knowledge tag set; Based on the knowledge tag set, construct a mind chain prompt template; The language model is driven by the thought chain prompt template to generate an analysis report and feed it back to the edge device.

5. The environment monitoring method based on edge-cloud architecture according to claim 4, characterized in that, The environmental protection knowledge framework includes a foundation layer, a pattern layer, and a strategy layer; the step of matching and mapping the feature package Z with the environmental protection knowledge framework after receiving the feature package Z includes: Obtain the regulatory provisions and pollutant standard limits in the base layer; Obtain the behavior-data association rules of historical anomaly cases in the pattern layer; Load the law enforcement process templates associated with laws and / or historical law enforcement cases in the strategy layer.

6. The environment monitoring method based on edge-cloud architecture according to claim 5, characterized in that, The knowledge tag set includes over-confidence K1, behavioral pattern similarity K2, and semantic relevance K3; wherein, the step of generating the knowledge tag set by performing multi-dimensional matching calculation based on the matching mapping result includes: The exceedance confidence level K1 is calculated based on the feature packet Z and the pollutant standard limit in the base layer; The similarity K2 of the behavior pattern is calculated based on the feature package Z and the behavior-data association rules in the pattern layer. The semantic correlation degree K3 is calculated based on the feature package Z and the law enforcement process template in the strategy layer.

7. The environment monitoring method based on edge-cloud architecture according to claim 6, characterized in that, The step of calculating the behavior pattern similarity K2 based on the feature package Z and the behavior-data association rules in the pattern layer includes: The time series sequence of monitoring data is parsed from the monitoring deviation feature D in the feature package Z; Retrieve historical anomaly templates that match the behavioral anomaly feature B from the pattern layer; Load the process cycle weight function corresponding to the enterprise's industry type; The behavioral pattern similarity K2 is generated based on the time sequence of the monitoring data, the historical anomaly template, and the process cycle weight function.

8. The environment monitoring method based on edge-cloud architecture according to claim 6, characterized in that, The step of calculating the semantic relevance K3 based on the feature package Z and the law enforcement process template in the policy layer includes: The text description features are parsed from the semantic features S in the feature package Z; Extract the relationship chain from the law enforcement process template in the strategy layer; Based on the text description features and the association chain, language model encoding is performed; The semantic relevance K3 is calculated based on the language model encoding.

9. The environment monitoring method based on edge-cloud architecture according to claim 6, characterized in that, The step of constructing a mind chain prompt template based on the knowledge tag set includes: Match the legal provisions in the base layer according to the over-confidence level K1; Generate a causal chain between the abnormal event and the associated behavior based on the behavioral pattern similarity K2; Based on the semantic relevance K3, output evidence priority and law enforcement steps.

10. The environment monitoring method based on edge-cloud architecture according to claim 4, characterized in that, The step of generating an analysis report by driving the language model through the thought chain prompt template and feeding it back to the edge device includes: Analyze the data triples, state triples, and video triples in the evidence chain; The video class triples are converted into natural language behavior descriptions using a cross-modal semantic alignment model; By fusing the data triples, state triples, and natural language behavior descriptions, enhanced input text is generated. An analysis report is generated by calling the language model based on the thought chain prompt template and the enhanced input text; The analysis report is then fed back to the edge device.

11. An environment monitoring system based on an edge-cloud architecture, characterized in that, It includes an edge device and a cloud platform, wherein the edge device is signal-connected to the cloud platform to implement the method as described in any one of claims 1 to 10.

Images