A city data fusion event early warning method and system

Abstract

This invention relates to the field of smart city safety and emergency management technology, and provides a method and system for urban data fusion event early warning. The method includes: constructing a physical environment time-series dataset, an urban facility asset dataset, and an API call behavior log dataset; constructing a dynamic digital twin graph based on the aforementioned datasets; using the dynamic digital twin graph and the physical environment time-series dataset, applying a sliding time window anomaly detection mechanism to locate initial risk triggering nodes, performing graph traversal search to construct a set of potential risk propagation paths, and using a chain probability model to quantitatively evaluate and generate a set of early warning events; based on high-risk events, calling a natural language generation function to match the optimal emergency plan from an emergency plan knowledge base, visualizing the early warning scenario in conjunction with the natural language early warning message, and parsing the optimal emergency plan to generate scheduling instructions. This invention constructs an event early warning and response mechanism for urban systems, applicable to smart city early warning and emergency management.

Description

Technical Field

[0001] This invention relates to the fields of smart city operation management and digital twin technology, and in particular to a method and system for early warning of urban data fusion events. Background Technology

[0002] With the deep integration and practice of smart city and digital twin concepts in urban management, public safety, and emergency command, event early warning and intelligent response based on multi-dimensional data fusion have become key supports for ensuring safe urban operation and enhancing management resilience. However, in practical applications, how to integrate and analyze multi-dimensional heterogeneous information in real time within complex urban systems with diverse data sources and highly coupled facilities, accurately characterize the dependencies between infrastructures, proactively predict potential cascading risks, and automatically generate dispatch instructions that can be tracked in a closed loop has become a core issue that urgently needs to be addressed in the process of intelligent urban governance and emergency management.

[0003] Chinese patent application CN118643301A discloses a method and system for data fusion and analysis in urban governance. The method includes: establishing a three-dimensional model of the urban ground based on the urban topography; obtaining a map of the urban sewer system and calculating the maximum flow rate in different areas; setting up edge monitoring nodes in each area to monitor the water level on the road surface, obtaining the monitored water level data, and judging the abnormality of the water level data in combination with weather forecast data; predicting the water level change curve at the edge monitoring nodes based on the monitored water level data and rainfall; simulating the direction of urban flooding flow based on the water level change curves of multiple monitoring nodes and the three-dimensional ground model; and pushing evacuation routes to residents in the affected areas based on the direction of urban flooding flow combined with urban road network and population density information.

[0004] However, current technology still faces many challenges. When cities experience sudden events such as short-term heavy rainfall or main power line failures, the independent data systems of departments such as power, transportation, and water create data silos, making it difficult for emergency commanders to obtain a comprehensive and dynamic picture of the operational situation. At this time, the city's emergency command center can only receive scattered alarm information from different systems, making it difficult to immediately discern the deeper connections between events such as "street flooding," "traffic light malfunctions," and "substation overload," thus limiting the comprehensive assessment of the severity of the event. If the cascading propagation path of risks cannot be accurately predicted, commanders will find it difficult to scientifically assess the potential impact on downstream critical facilities, such as hospitals and subway stations, and will also be unable to quickly select and dispatch the optimal response plan from a massive emergency response plan database. Summary of the Invention

[0005] To achieve the above objectives, the present invention provides a method for early warning of urban data fusion events, the specific technical solution of which is as follows:

[0006] Real-time acquisition of raw multi-source data, and sequential construction of physical environment time-series dataset D based on the raw multi-source data. iot Urban infrastructure asset dataset D asset and API call behavior log dataset D api ;

[0007] Based on physical environment time series dataset D iot and urban infrastructure asset dataset D asset Construct a dynamic digital twin graph G.

[0008] Based on dynamic digital twin map G and physical environment time-series data D iot By applying a persistent anomaly detection mechanism within a sliding time window, the initial risk triggering node v is located. trigger With the initial risk triggering node v trigger Starting from the dynamic digital twin graph G, a graph traversal search algorithm is executed to construct a set of potential risk propagation paths, Path. potential A chain probability model is used to analyze the potential risk propagation path set Path. potential Conduct quantitative assessments and construct an early warning event set (Event). warn ;

[0009] Based on the early warning event set Event warn High-risk events in the process call the natural language generation function f NLG (·), access the dynamic digital twin graph G, and generate a natural language warning message M. warn Using semantic matching operations, from a pre-built emergency response plan knowledge base D policy In the middle, is the natural language warning message M. warn Match the optimal emergency response plan rec Based on the aforementioned optimal emergency response plan rec and the natural language warning message M warn The system dynamically and visually presents early warning scenarios and optimizes the emergency response plan. rec The process involves parsing the data to generate traceable dispatch instructions. cmd The dispatch instruction Dispatch cmd Issued through integration with the work order system.

[0010] Furthermore, the physical environment time-series dataset D iot Urban infrastructure asset dataset D asset and API call behavior log dataset D api The construction methods include:

[0011] Real-time acquisition of raw sensor observations, followed by spatiotemporal reference alignment, exponentially weighted moving average filtering, and min-max normalization processing, to construct a physical environment time-series dataset D. iot ;

[0012] Based on raw urban infrastructure asset data from multiple heterogeneous business systems, an automated processing flow is sequentially executed on the raw urban infrastructure asset data, including data parsing, semantic mapping, multi-level verification, confidence scoring, entity alignment, and unique identifier allocation, to construct a structured urban infrastructure asset dataset D. asset ;

[0013] For unstructured raw network traffic or log text, protocol parsing and session reassembly are performed sequentially to generate structured raw session records. Key dimension vectors are extracted from these raw session records and assembled to form API call behavior logs. Based on these API call behavior logs, an API call behavior log dataset D is constructed. api .

[0014] Furthermore, the multi-level verification process includes:

[0015] Syntactic validation automatically verifies the data type, value range, and format specification elements of each field based on the field definitions of the standard asset data model.

[0016] Semantic verification compares the core information of the assets with the city's actual unit / address benchmark database (DB). master The comparison is performed, and a quantified confidence score is output.

[0017] Furthermore, the method for constructing the dynamic digital twin map G includes:

[0018] Traversing the physical environment time series dataset D iot and urban infrastructure asset dataset D asset Based on the physical environment time series dataset D iot and urban infrastructure asset dataset D asset The data is aggregated into a dataset. A mapping function is then called to instantiate each independent data record in the dataset, thus constructing a node set for the graph. Among them, v m Let M be the m-th node, where m is the index of the node. node The sum of the nodes;

[0019] Based on node set A dependency construction strategy based on domain rules and a dependency construction strategy based on spatial proximity are used to construct the edge set E of the graph, based on the node set V = Combine the edge set to construct a static digital twin graph G';

[0020] The dependency edges to be evaluated in the graph-based edge set E are used in the API call behavior log dataset D. api The correlation judgment function `relate` is used in the middle. to (·), filter out the subset of API logs related to the dependency edge, and call the composite evaluation function g. eval (·) Quantify and calculate the corresponding credibility W for the dependency edges associated with the API log subset. trust The credibility W trust Dynamically attach to the dependency edges of the graph to construct a dynamic digital twin graph G.

[0021] Furthermore, the correlation judgment function `relate`... to (·), the step of filtering out a subset of API logs related to the dependency edge includes:

[0022] Network address matching, source / destination IP addresses in API call behavior logs. src / ip dst It matches the network address attributes of the source and target nodes connected by the dependency edge;

[0023] Interface type matching: The API interface identifier in the API call behavior log belongs to the dependency relationship type "type" in the dependency relationship edge. rel A list of predefined interfaces.

[0024] Furthermore, the set of early warning events (Event) warn The construction methods include:

[0025] Based on each node v in the dynamic digital twin graph G m The corresponding normalized sensor observation sequence A persistent anomaly detection mechanism within a sliding time window is employed to statistically analyze the normalized sensor observations within a preset time window T. Exceeding the preset sensor anomaly alarm threshold θ s The frequency of occurrence, if the frequency of occurrence reaches or exceeds a preset confirmation threshold p confirm Then the node will be marked as the initial risk triggering node v. trigger Where i represents the normalized sensor observation value. The index, N, represents the total number of data collections. Starting with the initial risk trigger node v... trigger Starting from the dynamic digital twin graph G, along the direction of the dependency edges, a method constrained by a preset maximum propagation depth d is executed. max A graph traversal search algorithm is used to construct a set of potential risk propagation paths.potential ;

[0026] A chain probability model is used to analyze the potential risk propagation path set Path. potential A quantitative assessment is conducted to calculate the total cascading risk probability R of each potential risk propagation path from the initial risk triggering node to the endpoint node. cascade (path), if the total probability R of the cascaded risks cascade (path) exceeds the preset risk alarm threshold τ' alert Then the total probability R of the risk propagation path and cascading risks will be... cascade (path) is included in the early warning event set Event warn .

[0027] Furthermore, the scheduling instruction Dispatch cmd The generation methods include:

[0028] Traverse the set of warning events Event warn High-risk events in the process call the natural language generation function f NLG (·), access the dynamic digital twin graph G, and extract the attribute information of each node in the potential risk propagation path and the credibility W of each dependency edge. trust Based on the extracted attribute information and the total probability value R of cascading risks cascade Generate natural language warning message M warn ;

[0029] Traverse the pre-built emergency response plan knowledge base D policy The emergency plan p' is used to perform semantic modeling on the emergency plan p' using a text embedding model, generating an emergency plan vector vec(p'), and storing all emergency plan vectors vec(p') in a vector index database; the text embedding model is then used to process the natural language warning message M. warn Perform semantic modeling and transform it into a query vector vec(M) warn In the vector index database, the query vector vec(M) is calculated. warn The optimal emergency plan is selected by using the cosine similarity between the plan and each emergency plan vector vec(p'). rec ;

[0030] Based on the optimal emergency response plan rec and natural language warning message M warn This enables dynamic visualization of early warning scenarios and facilitates the development of the optimal emergency response plan. rec Perform structured parsing to generate structured dispatch instructions. cmd .

[0031] A city data fusion event early warning system is used to implement the above-mentioned city data fusion event early warning method, including a multi-source data acquisition module, a digital twin mapping module, a risk identification and assessment module, and an early warning response linkage module;

[0032] The multi-source data acquisition module is used to acquire raw multi-source data in real time, and to construct a physical environment time-series dataset D based on the raw multi-source data. iot Urban infrastructure asset dataset D asset and API call behavior log dataset D api ;

[0033] The digital twin mapping module is based on the physical environment time-series dataset D. iot and urban infrastructure asset dataset D asset Construct a dynamic digital twin graph G;

[0034] The risk identification and assessment module is based on the dynamic digital twin map G and the time-series data of the physical environment D. iot By applying a persistent anomaly detection mechanism within a sliding time window, the initial risk triggering node v is located. trigger With the initial risk triggering node v trigger Starting from the dynamic digital twin graph G, a graph traversal search algorithm is executed to construct a set of potential risk propagation paths, Path. potential A chain probability model is used to analyze the potential risk propagation path set Path. potential Conduct quantitative assessments and construct an early warning event set (Event). warn ;

[0035] The early warning response linkage module is based on the early warning event set Event. warn High-risk events in the process call the natural language generation function f NLG (·), access the dynamic digital twin graph G, and generate a natural language warning message M. warn Using semantic matching operations, from a pre-built emergency response plan knowledge base D policy In the middle, is the natural language warning message M. warn Match the optimal emergency response plan rec Based on the aforementioned optimal emergency response plan rec and the natural language warning message M warn The system dynamically and visually presents early warning scenarios and optimizes the emergency response plan. rec The process involves parsing the data to generate traceable dispatch instructions. cmd The dispatch instruction Dispatch cmd Issued through integration with the work order system.

[0036] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0037] This invention constructs and applies a unified data standardization procedure that covers semantic mapping, spatiotemporal benchmark alignment, and dimensional normalization. This procedure enables integrated processing of multi-source heterogeneous raw data from different urban management departments, avoiding the problem of cross-system data not being directly integrated and analyzed due to inconsistent data formats, field naming, and physical units.

[0038] This invention integrates domain rules, spatial proximity analysis, and real-time interactive data to perform networked modeling and dynamic credibility weighting of urban infrastructure, avoiding the problem that traditional systems can only display the static geographical location of facilities and cannot reveal the functional dependencies between facilities across systems and their actual operating status.

[0039] This invention uses facility dependencies, real-time reliability weights, and initial risk events in a dynamic digital twin graph as the basis for deduction to traverse and quantify the probability of potential cascading propagation paths. This avoids the problem that traditional early warning systems can only respond to single-point failures and cannot proactively predict the risk of cascading failures of downstream facilities that may be caused by such failures.

[0040] This invention utilizes a collaborative processing flow that combines natural language generation, contingency plan semantic matching, and automated instruction parsing to perform end-to-end transformation of structured early warning events from information interpretation to action dispatch. This avoids the decision-making delays and execution disconnects caused by the reliance on manual processes and fragmented workflows in information transmission, contingency plan search, and task assignment in traditional emergency responses. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating the principle of an urban data fusion event early warning method according to the present invention;

[0043] Figure 2 This is a functional module diagram of an urban data fusion event early warning system according to the present invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Example 1

[0046] Please see Figure 1 As shown, this embodiment provides a method for early warning of urban data fusion events, including:

[0047] S1000 acquires raw multi-source data in real time and constructs a physical environment time-series dataset D based on the raw multi-source data. iot Urban infrastructure asset dataset D asset and API call behavior log dataset D api .

[0048] Specifically, this step aims to address the technical challenges of the "city data silo" effect and the "semantic gap." By constructing a unified data standardization procedure, it maps and transforms multidimensional data from diverse sources, with varying formats and ambiguous semantics—including physical environment perception data, business system asset data, and cross-system interaction behavior data—into a common urban data language that can be efficiently parsed by machines.

[0049] Further, step S1000 includes:

[0050] Step S1100: Real-time acquisition of raw sensor observations The original sensor observations By sequentially performing spatiotemporal benchmark alignment, exponentially weighted moving average filtering, and min-max normalization, a physical environment time series dataset D is constructed. iot .

[0051] Specifically, this step aims to focus on the dynamic, continuous, and high-precision monitoring of urban physical environment state parameters (PESP), generating a dynamic data mirror of the urban physical environment with high spatiotemporal resolution, providing reliable data support for subsequent urban situational awareness, risk prediction, and emergency response.

[0052] The urban physical environment state parameters refer to various physical variables used to measure the state of environmental elements in urban space, covering environmental elements such as air, water, soil, climate, sound, light and heat, such as air quality, urban heat island intensity, noise level and water pollution index.

[0053] In practice, the process begins with the large-scale deployment of Internet of Things (IoT) sensor arrays at key urban infrastructure nodes (e.g., drainage networks in high-risk urban flooding areas, substations ensuring core functions, and densely populated transportation hubs) to achieve continuous, high-frequency, real-time monitoring of the city's Physical State Parameters (PESP). These sensors constitute the front-end network for refined urban sensing, encapsulating the collected telemetry signals into raw observations. These raw observations are then periodically transmitted to a centralized IoT data platform via heterogeneous communication protocols such as Low-Power Wide-Area Network (LPWAN) or High-Bandwidth Cellular Network (HBCN), forming a stable, massive amount of raw sensor observations with temporal characteristics.

[0054] The raw sensor observations are characterized by multi-source nature, heterogeneity, and noise interference, and must be standardized to construct a high-quality physical environment time-series dataset D that can be directly consumed by upper-layer applications. iot This processing flow aims to transform raw sensor observations into a standardized and high-quality physical environment time-series dataset D with a unified spatiotemporal reference and dimensionless measurement. iot The specific processing procedure is as follows:

[0055] First, time and space reference alignment. The timestamps reported by all sensing devices are first parsed and calibrated, then uniformly converted to Coordinated Universal Time (UTC) to eliminate time reference inconsistencies caused by geographical time zone differences and clock drift of terminal devices. The specific process formula is as follows:

[0056] t i =f align (t' i ,Δt sync );

[0057] Where i represents the index of the data acquisition, used to uniquely identify a discrete piece of data; t i The aligned coordination time after the i-th data acquisition is represented by the UTC timestamp; f align (·) represents the time alignment function; t' i Δt represents the original timestamp reported by the sensing device during the i-th data acquisition; sync This represents the time synchronization offset, used to quantify the difference between the sensor device's clock and the globally recognized authoritative time standard UTC. Its value is dynamically obtained through the Network Time Protocol (NTP).

[0058] Next, the sensor device identifier s of each raw sensor observation will be... i It is linked to a pre-set equipment asset ledger, and based on this, each raw sensor observation is assigned internationally recognized geospatial coordinates. i (e.g., WGS-84 coordinate system) to ensure consistency and comparability of spatial locations.

[0059] Second, observation cleaning and filtering. The urban physical environment is highly complex, and raw sensor observations are often subject to random measurement noise. i The influence of the noise ∈ i This may originate from external disturbances such as electromagnetic interference, mechanical vibration, or sudden environmental changes. Among these, ∈ i This represents the random measurement noise from the i-th data acquisition, typically assumed to follow a Gaussian distribution with a mean of 0, i.e., ∈ i ~N(0,σ 2 ), σ 2 This represents the noise variance. From a mathematical perspective, each raw sensor observation... Both can be considered as ideal physical signals and noise. i The superposition process is as follows:

[0060]

[0061] in, f represents the raw sensor observation at the current moment of the i-th data acquisition; acquire (·) represents the ideal signal acquisition function, i.e., the sensor s i At precise time t i The actual physical quantity measured.

[0062] To extract raw sensor observations The actual physical state change trend reflected requires analysis of the original sensor observations. Filtering is performed to suppress high-frequency noise interference. An Exponential Weighted Moving Average (EWMA) method is used to filter the raw sensor observations. The process is as follows: The specific formula for the process is as follows:

[0063]

[0064] in, This represents the filtered sensor observation value at the current moment of the i-th data acquisition. represents the filtered sensor observation value at the moment preceding the i-th data acquisition; 'a' represents the smoothing factor, a preset weighting coefficient whose value ranges within the interval (0,1).

[0065] Third, sensor observations need to be normalized. Because different types and manufacturers of sensors differ significantly in measurement parameters, unit systems, and numerical ranges (for example, water level is measured in meters, while power load is measured in kilowatts), these dimensional differences hinder the fusion of multi-source data and cross-indicator comprehensive analysis. Therefore, it is necessary to normalize the filtered sensor observations. Normalization is performed to unify the numerical scale and eliminate the influence of physical dimensions. The normalization process employs the Min-Max Normalization method, linearly scaling the observations from each sensor to the dimensionless interval [0,1]. The specific process formula is as follows:

[0066]

[0067] in, Represents the normalized sensor observation value of the i-th data acquisition; It represents the lower limit of effective observations for a specific type of sensor and is a predefined constant. It represents the upper limit of the effective observations for a specific type of sensor and is a predefined constant.

[0068] After the above processing, a high-quality physical environment time-series dataset D is finally constructed. iot The specific formula is as follows:

[0069]

[0070] Among them, D iot This represents the physical environment time-series dataset; i represents the index of the data acquisition, used to uniquely identify a discrete data acquisition data; N represents the total number of data acquisitions.

[0071] Step S1200: Based on the original urban infrastructure asset data asset'j from the multi-source heterogeneous business system, process the original urban infrastructure asset data asset'j. j An automated processing flow is executed sequentially, including data parsing, semantic mapping, multi-level validation, confidence scoring, entity alignment, and unique identifier assignment, to construct a structured urban infrastructure asset dataset D. asset .

[0072] Specifically, this step aims to transform the original urban infrastructure asset information from multiple sources, in heterogeneous formats, and with inconsistent semantics into a unified, standardized, and reliable structured urban infrastructure asset dataset D through a series of automatic parsing and standardization processes.asset .

[0073] The specific implementation process includes the following three core steps:

[0074] First, the analysis and semantic mapping of raw urban infrastructure asset data. This begins with the systematic aggregation of raw urban infrastructure asset data (asset') from various vertically managed urban departments (such as electricity, transportation, water, and communications). j Next, the built-in parser automatically identifies the original urban infrastructure asset data (asset). j The input format (e.g., .xlsx, .csv, JSON, etc.) is processed, and syntactic-level structural parsing is performed to extract the original key-value pairs. After the initial parsing, based on the pre-configured mapping rule set M, field names from different source systems and with different expressions are uniformly mapped to the standard fields defined in the Canonical Asset Data Model (C-ADM). For example, the fields "Equipment Name," "Asset Name," or "ZCMC" in the original data are all uniformly mapped to the standard field "name" in the C-ADM. The mapping process is expressed as follows: for any original urban facility asset data asset' j The specific formula for mapping the original field k' in the model to the standard model field k is as follows:

[0075]

[0076] in, The j-th intermediate format asset object is a structured data object temporarily created in memory, whose field structure strictly follows the standard asset data model C-ADM; .k represents the intermediate format asset object asset. intermediate In standard attribute name access, . represents the standard member access operator used to access object attributes, k represents the standard model field, for example, .name represents the standard name and .loc represents the standard location; M(·) represents the mapping function, where M is a set of mapping rules encapsulating all mapping logic; asset' j This represents the j-th original urban infrastructure asset data received from an external business system; .k' represents the j-th original urban infrastructure asset data asset'. j A non-standard, custom primitive field.

[0077] For example, suppose the standard asset data model C-ADM requires all assets to include the following standard fields: {name:string, type:string, location} coordThe preset mapping rule set M is configured as follows to handle data from different business departments. The specific rules are as follows: If the source field name belongs to ["Equipment Name", "Asset Name", "ZCMC"], it is mapped to the target field name. If the source field name belongs to ["Asset Type", "LX"], it is mapped to the target field type. If the source field name belongs to ["Installation Location", "Coordinates"], it is mapped to the target field location. coord .

[0078] Based on this, assume the system receives two heterogeneous original urban infrastructure asset records: asset'1 reported by the power department's Excel file, with the following content: {"Equipment Name": "Chengnan No. 1 Transformer", "Asset Type": "Power Facilities", "Installation Location": "No. 123, Renmin Road"}; and asset'1 pushed by the water department's API, with the following content: {"Asset Name": "West District Main Pipeline No. 2 Pump", "LX": "Drainage Facilities", "Coordinates": "121.47, 31.23"}. According to the above mapping rules, the asset'1 reported by the power department's Excel file is mapped, and the resulting intermediate format asset object is...

[0079]

[0080] Second, multi-level verification and confidence scoring. This is done after completing the aforementioned semantic mapping and generating the intermediate format asset object. Afterwards, multi-dimensional verification is required. This verification process mainly includes two levels: First, syntactic verification. Based on the field definitions of the standard asset data model C-ADM, the data type (e.g., string, integer), value range, and format specifications (e.g., ISO 8601 date format, WGS-84 coordinate format) of each field are automatically verified. Second, semantic verification. The core information of the asset (including but not limited to unit name and address description) is compared with the authoritative "City Real Units and Address Reference Database" DB. master The comparison is performed, and the quantified confidence score c is output. j The specific process formula is as follows:

[0081] c j =V verify (asset' j DB master );

[0082] Among them, c j This represents the j-th original urban infrastructure asset data, asset'. j The confidence score, with a value range of [0,1], Vverify (·) represents the verification function.

[0083] If the confidence score is c j Greater than or equal to the preset confidence threshold τ c At that time, the original urban infrastructure asset data (asset') is considered valid. j The specific process formula, after verification, is as follows:

[0084] asset j =f struct ({asset' j |c j ≥τ c});

[0085] Among them, asset j This represents the standardized urban infrastructure asset data for the j-th item; f struct (·) represents a structured function; | represents a separator for constraints.

[0086] Third, entity alignment and unique identifier allocation. After completing multi-level verification and confidence scoring, the standardized urban infrastructure asset data is then processed. j Entity alignment is performed to identify and merge duplicate or redundant records that point to the same physical entity. The core is to construct a reasonable similarity measurement mechanism to calculate the similarity score between any two records, thus determining whether the two records correspond to the same entity. The specific process and formula are as follows:

[0087] Sim(asset a ,asset b ) = w name Sim name +w loc Sim loc +w attr Sim attr ;

[0088] Where Sim(·) represents the similarity function, with a range of [0,1], used to quantify any two urban infrastructure asset data sets. a and asset b The possibility of them pointing to the same physical entity; w name w loc w attr These represent the pre-configured weight coefficients for name, geographic location, and business attributes, respectively. The sum of these three is 1, used to determine the relative importance of each dimension in the overall similarity assessment; Sim name This represents a similarity metric in the name dimension, used to measure the similarity between two urban facility asset records in the name field. The output value is in the range [0,1].loc A similarity metric representing the spatial dimension, used to calculate the geographical proximity of two urban infrastructure asset datasets; Sim attr This represents a similarity metric based on attribute dimensions, used to assess the degree of overlap in business attributes between two sets of urban infrastructure asset data.

[0089] If the two input urban infrastructure asset data assets a and asset b Similarity score Sim(asset) a ,asset b The similarity is higher than the preset similarity threshold τ. s When this happens, the two sets of urban infrastructure asset data are determined. a and asset b For duplicate records of the same entity, merge the two into a single unified data record.

[0090] In summary, standardized urban infrastructure asset data... j The generation process is essentially a systematic process based on high confidence, involving deduplication verification and structured parsing. After the above complete process, a standardized urban infrastructure asset dataset D is finally formed. asset The specific formula is as follows:

[0091] D asset ={asset j |asset j =(id) j ,name j ,type j ,loc j ,attr j )};

[0092] Among them, D asset This represents a standardized urban infrastructure asset dataset, containing a total of M' standardized urban infrastructure asset records. j ;j represents standardized urban infrastructure asset data. j The index number, with a value range of j = {1, 2, ..., M'}, is used to uniquely identify each standardized data record. There are a total of M' standardized urban facility asset data records. j ;id j This represents the standardized urban infrastructure asset data of the j-th item. j The globally unique identifier; name j This represents the standardized urban infrastructure asset data of the j-th item. j Standardized name; tyepj This represents the standardized urban infrastructure asset data of the j-th item. j Standardized classification; loc j This represents the standardized urban infrastructure asset data of the j-th item. j authoritative geographical location; attr j This represents the standardized urban infrastructure asset data of the j-th item. j Business attribute vector.

[0093] Step S1300: For unstructured raw network traffic or log text, protocol parsing and session reassembly are performed sequentially to generate structured raw session records. From the original session record Extract key dimension vectors and assemble them to form API call behavior logs. Based on the API call behavior log Construct API call behavior log dataset D api .

[0094] Specifically, this step aims to automatically extract multidimensional key features that accurately characterize data exchange from massive amounts of unstructured raw network traffic or log text, and transform them into a highly structured API call behavior log dataset D that can be used for time-series analysis. api .

[0095] The specific implementation process includes the following core steps:

[0096] First, network / log protocol parsing and session reassembly.

[0097] For network traffic, the collector performs in-depth analysis of network packets at the application layer. By analyzing information such as TCP sequence number and source / destination port, it reassembles fragmented packets into a logically complete "request-response" session.

[0098] For log files, based on their specific format, efficient regular expressions or dedicated parsers are used for line-by-line structured extraction.

[0099] Finally, the output is a structured raw session record that can be used for further analysis. The original session record As a data object, it fully encapsulates all the original information of a single API interaction, providing a standardized and unified input source for subsequent feature extraction.

[0100] Second, multi-dimensional feature vector extraction. Based on the original session record. Key dimensions were extracted, reflecting the core metrics of a single API call action, and these were then constructed into a refined and efficient API call behavior log. The specific process formula is as follows:

[0101]

[0102] in, This represents the API call log for the k-th API call; k represents the index of the API call, with a value range of k = {1, 2, ..., M}. api} is used to uniquely identify each independent API call behavior, with a total of M. api API call behavior; F extract (·) represents a feature extraction function, used to extract features from the original session records according to preset rules. Key dimensions were extracted and assembled into a structured, unified API call behavior log. This represents the original session record of the k-th API call event.

[0103] The key dimensions include the following four important dimensions:

[0104] Request timestamp t k , representing the request timestamp of the k-th API call. This timestamp t k It has been calibrated with high precision and standardized to Coordinated Universal Time (UTC) format.

[0105] Network identifier IP src / ip dst , representing the IP addresses of the client system (Source) initiating the API call and the server system (Destination) providing the API service, respectively, are used to associate the abstract API call behavior with the key indexes of the physical interaction nodes in the graph.

[0106] API interface identifier api k , represents the API interface identifier of the k-th API call behavior, used to identify which API interface was called by the API call behavior. For example, the URL path in the HTTP request can be used as the API interface identifier.

[0107] Response status code status kThe status code represents the HTTP response for the k-th API call. It is used to determine whether the API call was successful at the technical level. For example, the 2xx series status codes indicate success, indicating that the API call request was successfully received, understood, and processed; the 5xx series status codes indicate server errors, such as internal error 500 or temporary unavailability of service 503.

[0108] Third, payload content fingerprint generation. This involves generating the business payload based on API call behavior. k A fixed-length payload content fingerprint h is generated by calculating a deterministic and collision-resistant one-way cryptographic hash function H(·) (such as the SHA-256 algorithm). k , serving as a unique identifier for the business payload.

[0109] After the three complete steps of network / log protocol parsing, multi-dimensional feature vector extraction, and payload content fingerprint generation, a structured API call behavior log dataset D is finally formed. api The specific formula is as follows:

[0110]

[0111] Among them, D api This represents an API call behavior log dataset, containing M api Structured API call behavior logs The API call behavior log represents the behavior of the k-th API call.

[0112] S2000, based on the physical environment time series dataset D iot and urban infrastructure asset dataset D asset Construct a dynamic digital twin graph G.

[0113] Specifically, this step aims to construct a computable and predictable digital twin neural network for complex urban systems. This digital twin neural network transforms the city from a static collection of infrastructure assets into an interconnected dynamic system by revealing the explicit and implicit dependencies between key infrastructures such as electricity, transportation, and water.

[0114] Further, step S2000 includes:

[0115] Step S2100: Traverse the physical environment time series dataset D iot and urban infrastructure asset dataset D asset Based on the physical environment time series dataset D iot and urban infrastructure asset dataset D asset The data is aggregated into a dataset. A mapping function is then called to instantiate each independent data record in the dataset, thus constructing a node set for the graph.

[0116] Specifically, this step aims to objectify physical assets and sensing devices in the real world in the digital space, mapping them to basic computing units in the graph, namely entity nodes.

[0117] In the specific implementation process, the physical environment time-series dataset D constructed in step S1100 is traversed. iot And the urban facility asset dataset D constructed in step S1200 asset Based on the above two datasets, a unified dataset is formed. For each independent data record d in the dataset... m Call the mapping function f map In the graph database, each independent data record d m Instantiate a unique entity node v m Finally, the node set V of the graph is constructed, and the specific process formula is as follows:

[0118] v m =f map (d m ), where d m ∈D iot ∪D asset ;

[0119]

[0120] Among them, v m Let m represent the m-th entity node, which is the mapping of an entity in the physical world (such as a substation or camera) to the digital twin world; that is, a basic element in the graph. m represents the index of the node in the graph, used to uniquely identify each entity node, and its value range is m = {1, 2, ..., M}. node There are a total of M. node One entity node; f map (·) represents a mapping function, encapsulating the complete logic for node creation, used to map each independent data record d. m Mapped to entity node v in the graph m ;d m Representing an independent data record, it is any record from either of the two input datasets. When traversing the physical environment time-series dataset D... iot At that time, d m Indicates a specific sensor device s i Data records, when traversing the city facility asset dataset D asset At that time, d m This represents specific urban infrastructure asset data records. j ;D iot ∪Dasset Represents the physical environment time series dataset D iot and urban infrastructure asset dataset D asset The union of the sets; ∈ represents the set membership operator; V represents the set of nodes in the graph.

[0121] Step S2200, based on the node set A dependency construction strategy based on domain rules and a dependency construction strategy based on spatial proximity are used to construct the edge set E of the graph, based on the node set. Construct a static digital twin graph G' = (V, E) using the edge set E.

[0122] Specifically, this step aims to leverage prior domain knowledge and data-driven spatial analysis, based on the node set constructed in step S2100. By assigning contextual relationships to isolated infrastructure nodes, the dependencies between nodes are automatically identified and constructed, thereby forming the topological skeleton of the entire digital twin graph.

[0123] In the specific implementation process, two complementary strategies are used to automatically identify and construct the edge set E, as follows:

[0124] First, dependency building based on domain rules. This strategy is primarily used to identify dependencies with clear business logic or functional relationships. It includes a built-in configurable business rule library, R. biz It predefines typical dependency patterns between different types of nodes. It iterates through all possible node pairs (v...) in the graph. m ,v n ), and based on each r∈R biz The "condition-action" rule is validated. Here, r represents the business rule base R. biz A specific rule. For example, regarding the "power supply dependency" relationship, the rule can be formally described as:

[0125] If v m' The type attribute of .type is "traffic light", and the v attribute is "traffic light". n The type attribute of .type is "substation" and the node pair (v m ',v n The Boolean function `Predicate` for predicate matching. match (v m ',v n If the return value of ) is true, then v is between the two nodes. m' and v n Create a directed edge (v) between them. m ',v n ,'power supply dependency'). Among them, Predicate matchA Boolean function representing predicate matching, used to verify the relationship between two nodes v. m' and v n Does the specific attribute meet the preset matching conditions? (v) m ',v n ,'Power supply dependency') represents the source node v of the edge. m '(Dependency) and the target node v of the edge n Create a directed edge of type "power supply dependency" between (the dependent party) and (the dependent party).

[0126] Second, dependency construction based on spatial proximity. This strategy is mainly used to identify dependencies that lack explicit business rules but have physical associations due to high geographical proximity (such as potential electromagnetic interference, shared physical channels, etc.). A spatial proximity algorithm is used to traverse the nodes. For example, regarding the "physical carrying" relationship, the rule can be formally described as:

[0127] If Dist(v m '.loc,v n .loc) <d prox And v m' .Pipe Gallery ID=v n The pipe gallery ID is then located between the two nodes (v). m ',v n Create a directed edge (v) between them. m ',v n ,'power supply dependency'). That is, when two nodes v m' and v n The actual geographic spatial distance between them is less than the preset proximity distance threshold d. prox And if other constraints are satisfied, then at the two nodes v m' and v n A directed dependency edge is constructed between the nodes v. Here, Dist(·) represents the spatial distance metric function used to calculate the distance between two nodes v. m' .loc and v n The actual geographic distance between .loc files; v m' .loc and v n .loc represents node v m' and v n The geographic location attribute; d prox This represents the proximity threshold, used to determine whether two nodes are physically close enough; v m' .Pipe gallery ID and v n The pipe gallery IDs represent nodes v. m' and v n The attribute name.

[0128] After the complete execution of the two strategies described above, the final edge set E of the graph is constructed, and the specific formula is as follows:

[0129] E={e m'n |e m'n =(v m' ,v n ,type rel )};

[0130] Where E represents the set of edges in the graph, containing all dependency edges identified and created using both "domain-based" and "spatial proximity-based" strategies; e m'n Let an element of edge set E be a node v in the graph. m' to node v n Dependency edges, where node v m' As the source node, node v n For target node; type rel Indicates the dependency type, used to describe the nature and type of the dependency, such as "power supply dependency" or "physical load".

[0131] Ultimately, the node set based on the graph Given the set of edges E of the graph, construct a static digital twin graph G' = (V, E).

[0132] Step S2300: Based on the graph edge set E, the dependency edges e to be evaluated m'n In the API call behavior log dataset D api The correlation judgment function `relate` is used in the middle. to (·), filter out edges e that have the dependency relationship with the above. m'n The relevant API log subset calls the composite evaluation function g. eval (·) For the dependency edges e associated with the subset of API logs m'n The confidence level W corresponding to the quantization calculation trust The credibility W trust Dependency edges e dynamically attached to the graph m'n On top of that, a dynamic digital twin graph G is constructed.

[0133] Specifically, this step aims to break through the static and idealized limitations of traditional network topologies. By quantitatively assessing the true health status of information flow between nodes, it assigns dynamic, data-driven credibility weights to each dependency edge, thereby enabling the digital twin graph to accurately reflect the operational quality in the real world.

[0134] In the specific implementation process, based on the API call behavior log dataset D formed in step S1300 apiThe edge set E of the graph constructed in step S2200 is then deeply coordinated. The specific process is as follows:

[0135] First, filtering the related behavior logs. First, select any dependency edge e to be evaluated from the edge set E of the graph. m'n And in a massive dataset of API call behavior logs D api In the middle, the correlation judgment function relate is used. to (·), filter out edges e that have the dependency relationship with the above. m'n A directly relevant subset of API logs. For the API call behavior log dataset D... api Each API call log The judgment is made based on the association judgment function. If the return result is true, then the API call log will be... It will be categorized into the relevant API log subset. The correlation function `relate`... to (·) is a Boolean filter function used to determine API call logs. Is it a corresponding dependency edge e? m'n A specific activity record within [the context]. If the aforementioned association judgment function [relate]... to (·) If the return value is true, then the following two core matching conditions must be met:

[0136] First, network address matching. API call behavior logs. Source / destination IP address src / ip dst It must be related to the dependency edge e m'n The connected node v m' and node v n The network address attributes match.

[0137] Second, interface type matching. API call behavior logs. API interface identifier api k It must belong to the dependency edge e m'n Dependency type tyep rel A list of predefined interfaces.

[0138] Second, the quantitative calculation of multi-dimensional monitoring indicators. This involves obtaining the edge parameters related to dependencies. m'n After a subset of the relevant API logs, a composite evaluation function g is used. eval (·) For the dependency edge e m'n Credibility W trust Quantitative calculations are performed. The composite evaluation function g eval(·) is a weighted average model that comprehensively considers the following three dimensions of behavioral health indicators, as detailed below:

[0139] First, the success rate of interaction R succ This is used to measure the reliability of communication channels, and the specific process formula is as follows:

[0140]

[0141] Here, Count(·) represents a counting function used to return the number of elements in the set; status k [200, 299] represents the status code of the response to all API calls. k Successful call logs within the range of 200 to 299.

[0142] Second, frequency stability S freq This is used to measure the regularity of API call behavior over time. The specific process and formula are as follows:

[0143]

[0144] Here, σΔt represents the standard deviation of the time interval Δt between adjacent API calls. The smaller the value, the more uniform and stable each API call is over time. The standard deviation σΔt of the time interval sequence is calculated based on the individual time interval Δt of the API call.

[0145] Thirdly, content consistency C cons Payload content fingerprint (h) used to measure API call behavior k Whether the dynamic changes meet expectations, the specific process formula is as follows:

[0146]

[0147] Among them, {h k} represents the sequence of payload content fingerprints (hash values) of all subsets of API logs; unique({h k}) represents the fingerprint sequence of the payload content {h k Perform deduplication.

[0148] The monitoring metrics from the three dimensions mentioned above are weighted and summed to output the dependency edge e. m'n Credibility W trust (e m'n The specific process formula is as follows:

[0149]

[0150] Among them, W trust(e m'n ) represents the dependency edge e m'n The credibility of the edge e is used to assess the dependency relationship. m'n The final quantitative score of health is a floating-point number ranging from [0,1]; w succ w freq w cons These represent the pre-configured interaction success rates R. succ Frequency stability S freq Content consistency C cons The weighting coefficients of the three factors are summed to 1.

[0151] Finally, the credibility W of the above output trust (e m'n Dependency edges e are dynamically attached to the graph. m'n This upgrades the static digital twin graph G'=(V,E) into a dynamic digital twin graph G=(V,E).

[0152] S3000, based on dynamic digital twin map G=(V,E) and physical environment time-series data D iot By applying a persistent anomaly detection mechanism within a sliding time window, the initial risk triggering node v is located. trigger With the initial risk triggering node v trigger Starting from the dynamic digital twin graph G=(V,E), a graph traversal search algorithm is performed on the graph to construct a set of potential risk propagation paths. potential A chain probability model is used to analyze the potential risk propagation path set Path. potential Conduct quantitative assessments and construct an early warning event set (Event). warn .

[0153] Specifically, this step aims to utilize the dynamic digital twin map G = (V, E) generated in step S2300 to analyze the physical environment time-series dataset D collected in real time in step S1100. iot To conduct simulations and forward-looking predictions of potential future impacts.

[0154] Further, step S3000 includes:

[0155] Step S3100: Based on the normalized sensor observation sequence corresponding to each node in the dynamic digital twin map G=(V,E) A persistent anomaly detection mechanism within a sliding time window is employed to statistically analyze the normalized sensor observations within a preset time window T. Exceeding the preset sensor anomaly alarm threshold θ s The frequency of occurrence, if the frequency of occurrence reaches or exceeds a preset confirmation threshold pconfirm Then the node v m Marked as the initial risk trigger node v trigger .

[0156] Specifically, this step aims to extract data from the continuously, real-time acquired physical environment time-series dataset D. iot In this process, the initial abnormal event that is persistent and sufficient to trigger a system emergency response is accurately identified, and its location is determined in the dynamic digital twin graph G=(V,E), and the initial risk trigger node v is marked. trigger .

[0157] In the specific implementation process, in order to avoid false alarms caused by instantaneous environmental interference or single-point sensor jitter, this step abandons the traditional single-point threshold triggering mechanism and adopts a continuous anomaly detection mechanism based on a sliding time window.

[0158] The anomaly monitoring mechanism continuously monitors each node v in the dynamic digital twin graph G=(V,E). m The corresponding normalized sensor observation sequence Where i represents the normalized sensor observation value There are N total indices. When judging anomalies, the normalized sensor observations of a particular node are not used. Does it exceed the preset sensor abnormality alarm threshold θ? s Instead of responding immediately, the focus is on the persistent manifestation of the abnormal state within a preset time window T. If the abnormal reading (i.e. The frequency of occurrence of ) reaches or exceeds the preset confirmation threshold p confirm When this occurs, the initial risk event is considered to have occurred, and the node is marked as the initial risk trigger node v. trigger The specific process formula is as follows:

[0159] v trigger =v m ,like

[0160] Among them, v trigger Indicates the initial risk trigger node; v m This represents any node v in the dynamic digital twin graph G=(V,E) that is being monitored in real time. m T represents the size of the historical time window, which is a preset integer time span; t represents the current time point. This symbol represents the summation term used for normalized sensor observations within a window period (from t-T+1 to t). Perform a traversal and accumulate the results of the indicator function I(·); I(·) represents the indicator function, if When the condition is true, its value is 1; otherwise, it is 0. s This represents the sensor's abnormal alarm threshold, used to determine whether the sensor's observed values ​​are in an abnormal state; p confirm This represents the preset confirmation threshold, a preset floating-point number in the range [0,1], used to quantify the judgment of the node v being monitored in real time. m Is the frequency of anomalies within the window sufficient to trigger the initial risk trigger node v? trigger The determination.

[0161] For example, suppose a water level sensor node v is located in a city's drainage pipe. m Its abnormal alarm threshold θ s The value is set to 0.9, meaning that an abnormal state is considered to occur when the water level reaches 90% of the pipe capacity. The detection parameters are configured as follows: time window T = 10, meaning the observation data within the most recent 10 minutes is examined; confirmation threshold p... confirm =0.8, which means that at least 80% of the readings within the most recent 10-minute time window are considered abnormal events.

[0162] In scenarios involving avoiding false alarms caused by sudden heavy rainfall, the water level sensor node v m Sensor observation sequence The values ​​within the most recent 10-minute time window are {0.7, 0.8, 0.92, 0.95, 0.85, 0.8, 0.75, 0.7, 0.65, 0.6}. Within this 10-minute time window, only the 3rd and 4th readings, 0.92 and 0.95 respectively, exceed the abnormal alarm threshold θ. s =0.9, therefore the anomaly count value The corresponding anomaly frequency value is 2 / 10 = 0.2. In summary, since the anomaly frequency value of 0.2 is far below the confirmation threshold p... confirm =0.8, the system determines that the anomaly is a temporary surge in water level, not a sustained risk of flooding, therefore no initial risk trigger node v is generated. trigger This helps avoid false alarms.

[0163] In a real-world risk identification scenario caused by continuous heavy rainfall, the water level sensor node v m Sensor observation sequence The values ​​within the most recent 10-minute time window are {0.85, 0.88, 0.91, 0.93, 0.92, 0.94, 0.95, 0.96, 0.95, 0.97}. Within this 10-minute time window, starting from the third reading, a total of 8 readings exceeded the abnormal alarm threshold θ. s =0.9, therefore the anomaly count value The corresponding anomaly frequency value is 8 / 10 = 0.8. In summary, since the anomaly frequency value of 0.8 equals the confirmation threshold p...confirm =0.8, the system determines that the water level sensor node v m The water level has entered a state of persistent high water level risk, therefore the water level sensor node v... m Marked as the initial risk trigger node v trigger .

[0164] Step S3200, with the initial risk trigger node v trigger Starting from the dynamic digital twin graph G=(V,E), along the direction of the dependency edges, a method limited by a preset maximum propagation depth d is executed. max A graph traversal search algorithm is used to construct a set of potential risk propagation paths. potential .

[0165] Specifically, this step aims to simulate the chain reaction mechanism that the risk may trigger, namely the "domino effect," based on the initial risk triggering node v marked in step S3100. trigger The system systematically identifies all downstream facility nodes that may be affected by the initial event from the dynamic digital twin graph G=(V,E), and constructs a set of potential risk propagation paths. potential .

[0166] In the specific implementation process, the initial risk trigger node v trigger As the starting point for traversal, one or more graph traversal algorithms (GTAs), such as breadth-first search (BFS) or depth-first search (DFS), are executed on the dynamic digital twin graph G = (V, E). During the traversal, the graph traversal algorithm strictly follows the direction of the dependency edges in the graph, starting from the initial risk-triggering node v. trigger It begins by systematically exploring all its downstream nodes, layer by layer.

[0167] Furthermore, to effectively control computational complexity and focus on the most direct and critical impacts, the traversal process is limited by a preset maximum propagation depth d. max The maximum propagation depth d max The influence radius of risk projection is defined, limiting the maximum allowed path length, i.e., the number of edges, during graph traversal. All paths originating from the initial risk-triggered node v... trigger The starting point and path length both do not exceed the maximum propagation depth d. max All valid paths together constitute the potential risk propagation path set. potential The specific formula is as follows:

[0168]

[0169] Where, Path potential This represents a set of potential risk propagation paths, where each element is a specific path starting from the initial risk triggering node v. trigger Potential risk propagation paths from which the virus originates; (v0,v1,...,v dep () represents a potential risk propagation path, which is an ordered sequence of nodes. v0 is the starting node of the potential risk propagation path, i.e., the initial risk triggering node. v1 represents the downstream node reached by the first step from the starting node in the potential risk propagation path. dep This represents the endpoint of a potential risk propagation path, i.e., the last node in the path; dep represents the path length of a single potential risk propagation path, i.e., from the starting node v0 to the ending node v. dep The number of edges traversed (dep+1); v0 = v trigger This indicates that the starting point of a potential risk propagation path is the initial risk trigger node v. trigger , is used to constrain the starting point of a potential risk propagation path to ensure the traceability of the path deduction; ∧ represents the logical AND operator, that is, the three constraints it connects must be true at the same time, which constitute the judgment standard for the legality of the potential risk propagation path; Represents the depth digit in a single potential risk propagation path. i step; Represents adjacent node pairs in a single potential risk propagation path. It is the edge set E corresponding to the dynamic digital twin graph G, used to constrain the continuity of potential risk propagation paths; dep≤d max This means that the path length dep of all potential risk propagation paths must not exceed the preset maximum propagation depth d. max This is used to control the computational scope and computational resource consumption of risk simulation.

[0170] For example, suppose that in a simplified dynamic digital twin graph G of urban infrastructure, v0 = "Chengnan Substation" has been identified as the initial risk triggering node v trigger And the preset maximum propagation depth d max =2.

[0171] The nodes and dependencies in the dynamic digital twin graph G are as follows: The node set V contains four nodes: v0 = "Chengnan Substation", v1 = "Main Power Supply Line A", v2 = "First Municipal Hospital Power Distribution Room", and v3 = "West Road Traffic Signal Group". The edge set E contains three directed dependency edges, namely e 01 =v0→v1 (Chengnan Substation supplies power to main power line A), e 12=v1→v2 (Main power supply line A supplies power to the First Municipal Hospital's power distribution room) and e 13 =v1→v3 (Main power supply line A supplies power to the traffic signal group on West Road).

[0172] The graph traversal search process is as follows, taking breadth-first search (BFS) as an example:

[0173] The first stage is the initial phase. The propagation depth dep = 0, and the starting node is v0 = "Chengnan Substation" as the starting point for traversal.

[0174] The second method is the first-level traversal. The propagation depth *dep* = 1, at which point the path length is 1, and *dep* ≤ d. max Identify valid potential risk propagation paths (v0, v1) and add them to the potential risk propagation path set Path. potential ;

[0175] The third method is the second-level traversal. The propagation depth *dep* = 2, at which point the path length is 2, and *dep* ≤ d. max The system identifies two valid potential risk propagation paths (v0, v1, v2) and (v0, v1, v3) and adds them to the potential risk propagation path set Path. potential ;

[0176] The fourth is the third level of traversal. The propagation depth *dep* = 3, at which point the path length is 3, and *dep* ≤ d0 does not satisfy the condition. max Therefore, the algorithm stops exploring downstream, and the graph traversal search terminates.

[0177] The final output is a set of potential risk propagation paths. potential ={(v0,v1),(v0,v1,v2),(v0,v1,v3)}.

[0178] Step S3300: Use a chain probability model to analyze the potential risk propagation path set Path. potential A quantitative assessment is conducted to calculate the total cascading risk probability R of each potential risk propagation path from the initial risk triggering node to the endpoint node. cascade (path), if the total probability R of the cascaded risks cascade (path) exceeds the preset risk alarm threshold τ' alert Then the total probability R of the risk propagation path and cascading risks will be... cascade (path) is included in the early warning event set Event warn .

[0179] Specifically, this step aims to analyze the potential risk propagation path set Path constructed in step S3100. potentialA quantitative assessment is conducted to calculate the total cascading risk probability R of each potential risk propagation path from the initial risk triggering node to the endpoint node. cascade (path) to form a comprehensive risk measurement index that is more in line with the actual operating status of the system.

[0180] In the specific implementation process, based on the potential risk propagation path set Path potential A chain probability model is applied to calculate the total cascading risk probability R for each potential risk propagation path. cascade (path), the specific process formula is as follows:

[0181]

[0182] Among them, R cascade (path) represents the total cascading risk probability of each potential risk propagation path, and its value is a floating-point number in the interval [0,1]. That is, it represents the probability of successfully propagating from the initial starting point v0 along the direction of the potential risk propagation path to the end node v0. dep The overall cumulative probability value; P init (v0) represents the probability of the risk occurring at the initial starting point v0; This represents the chain multiplication operator, i.e., multiplying by node index dep. i Perform continuous cumulative multiplication from 1 to dep; The dep represents the potential risk propagation path. i The edge that connects the dep-th edge i -1 node and dep i Directed dependency edges of nodes; Representing dependency edges The inherent failure probability, whose value is usually derived from an expert knowledge base or a static probability value from long-term failure statistics, is used to reflect the upstream node's failure probability under ideal conditions. The risk is transmitted to downstream nodes. The static probability level; Representing dependency edges Credibility.

[0183] The probability value P of the initial starting point v0 init (v0) is used to quantify the severity of the risk at the initial starting point v0. Its value is not fixed but dynamically adjusted based on sensor observations. The specific formula is as follows:

[0184]

[0185] Where min(·,·) represents the minimum value function, which is used to limit the maximum value of the probability of risk occurrence to no more than 1; θ represents the upper limit of the effective observations of the sensor and is a predefined constant; s This indicates the threshold for sensor malfunction alarms.

[0186] Ultimately, the total probability value R of the cascading risks across all potential risk propagation paths is... cascade (path) exceeds the preset risk alarm threshold τ' alert The potential risk propagation paths and their corresponding risk probability values ​​will be combined with the total probability R of the cascading risks. cascade (path) is uniformly included in the early warning event set Event warn .

[0187] S4000, based on the early warning event set Event warn High-risk events Call the natural language generation function f NLG (·), access the dynamic digital twin graph G, and generate a natural language warning message M. warn Using semantic matching operations, from a pre-built emergency response plan knowledge base D policy In the middle, is the natural language warning message M. warn Match the optimal emergency response plan rec Based on the aforementioned optimal emergency response plan rec and the natural language warning message M warn The system dynamically and visually presents early warning scenarios and optimizes the emergency response plan. rec The process involves parsing the data to generate traceable dispatch instructions. cmd The dispatch instruction Dispatch cmd By integrating and issuing work orders through the work order system, a full-process management mechanism from risk warning to closed-loop tracking is achieved.

[0188] Specifically, this step aims to leverage the set of early warning events containing quantified risk values ​​output in step S33000. warn The system automatically translates and extracts visual alert instructions (Dispatch) for managers at all levels, providing clear action guidelines. cmd This achieves a closed loop from technological insights to management actions.

[0189] Further, step S4000 includes:

[0190] Step S4100: Traverse the set of warning events (Event) warn High-risk events Call the natural language generation function f NLG (·), access the dynamic digital twin graph G, and extract each node from the potential risk propagation path path. The attribute information and the credibility weight W of each dependency edge. trust Based on the extracted information and the total probability value R of cascading risks cascade Generate natural language warning message M warn .

[0191] Specifically, this step aims to build a bridge between computer languages ​​and human management languages, transforming highly structured but poorly readable sets of early warning events (Events) into more accessible and understandable formats. warn Automatically converts the warning message M into natural language that conforms to human reading habits and decision-making logic and has rich contextual information. warn .

[0192] In the specific implementation process, firstly, the set of warning events (Event) is traversed. warn High-risk events The high-risk events Includes potential risk propagation paths and the corresponding total probability value R of cascading risks. cascade Then, the Natural Language Generation (NLG) function f is called. NLG For high-risk events Express it semantically.

[0193] The natural language generation function f NLG (·) is a dynamic content filling mechanism based on structured templates. This function first accesses the dynamic digital twin graph G and extracts each node in the potential risk propagation path path. Detailed attribute information (such as attribute name, type attribute, geographic location attribute, etc.), and the credibility weight W of each dependency edge on the potential risk propagation path path. trust Next, the dynamic information of the above access and the total probability value of cascading risks R are combined. cascade Fill the predefined text template to generate a natural language warning message M. warn The specific process formula is as follows:

[0194] in

[0195] in, Event represents the set of warning events. warn The warn i A high-risk event; warning i Represents the index of high-risk events; path = (v0, v1, ..., v dep () indicates a high-risk event The corresponding potential risk propagation path is an ordered sequence of nodes used to describe the source and direction of propagation of potential risks.

[0196] Step S4200: Traverse the pre-built emergency response plan knowledge base D policy The emergency plan p' is used to perform semantic modeling on the emergency plan p' using a text embedding model, generating an emergency plan vector vec(p'), and storing all emergency plan vectors vec(p') in a vector index database; the text embedding model is then used to process the natural language warning message M. warn Perform semantic modeling and transform it into a query vector vec(M) warn In the vector index database, the query vector vec(M) is calculated. warn The optimal emergency plan is selected by using the cosine similarity between the plan and each emergency plan vector vec(p'). rec .

[0197] Specifically, this step aims to achieve an intelligent transformation of the emergency response plan matching mechanism, upgrading the traditional plan search method that relies on manual keyword searches to an automatic identification process based on artificial intelligence semantic matching. This focuses on addressing the pain point of command personnel struggling to obtain accurate and timely response procedures due to information overload during emergencies, ensuring that the most authoritative and targeted optimal emergency response plan can be matched in any complex and ever-changing early warning scenario. rec .

[0198] In the specific implementation process, the contextualized natural language warning message M generated in step S4100 is used as the basis. warn Then, combined with the pre-built emergency response plan knowledge base D policy It automatically performs semantic matching operations based on the current warning scenario to select the most relevant response plan. This process, centered on deep semantic understanding, is specifically divided into two independent stages:

[0199] First, the offline vectorization stage. During offline status processing, the emergency response plan knowledge base D is first traversed. policy For each emergency plan p', the system invokes an advanced deep learning text embedding model, such as Sentence-BERT, to semantically model the text content of the emergency plan p', transforming it into a high-dimensional mathematical vector vec(p') that accurately captures its core semantic features. This vector is denoted as the emergency plan vector. Finally, the semantic vectors of all plans are centrally stored and further constructed into a structured, optimized vector index database. This database supports high-speed similarity retrieval, providing technical support for real-time queries in the subsequent online phase.

[0200] Second, the online semantic matching stage. When the contextualized natural language warning message M... warn During online real-time generation, the same text embedding model as in the offline stage is invoked to instantly transform the natural language warning message content into a query vector vec(M). warn Subsequently, in a pre-built vector index database, the query vector vec(M) is computed. warn The cosine similarity between the emergency response plan (P) and all plan vectors (vec(p')) in the vector index database is used to identify the semantically closest emergency response plan. Finally, the optimal emergency response plan is selected. rec The specific process formula is as follows:

[0201]

[0202] Among them, Plan rec This indicates that it comes from the emergency response plan knowledge base D. policy The selected natural language warning message M warn The optimal emergency response plan; This represents the maximum value selection function, used to limit the working range of the maximum value selection function p'∈D. policy ;vec(·) represents the text embedding function, which maps text to a high-dimensional mathematical vector; · represents the click operator, which measures the alignment of vectors in a direction; ||·|| represents the norm of the vector, which normalizes the length of the vector.

[0203] Step S4300, based on the optimal emergency response plan rec and natural language warning message M warn This enables dynamic visualization of early warning scenarios and facilitates the development of the optimal emergency response plan. rec Perform structured parsing to generate structured dispatch instructions. cmd The scheduling instruction Dispatch cmd By integrating with the work order system, a full-process management mechanism is achieved, from risk warning and instruction distribution to closed-loop tracking.

[0204] Specifically, this step aims to implement the optimal emergency response plan identified in step S4200. rec And the contextualized natural language warning message M generated in step S4100 warn It is deeply integrated and seamlessly transformed into DIspatch, a scheduling instruction set with a clear structure, explicit semantics, and is executable and traceable, for front-line execution units. cmd This allows for the construction of a closed-loop management mechanism encompassing the entire process of "prediction-response-feedback".

[0205] In the specific implementation process, the optimal emergency response plan is obtained through two parallel methods. rec With natural language warning message M warn Deep integration will be carried out, as detailed below:

[0206] First, the visualization of situational information. This includes presenting the optimal emergency response plan. rec With natural language warning message M warn The data is integrated and dynamically presented on the large screen of the Geographic Information System (GIS) in the command center. The GIS serves as the base map for various static geographic and asset data of the city, providing necessary contextual support for the spatial representation of dynamic early warning events. Specific forms of visualization include, but are not limited to: marking the initial risk source with a bright, flashing icon on the city's electronic map; drawing the risk's propagation path segment by segment on the map using dynamic arrows; and highlighting or marking key affected facilities such as hospitals, schools, and transportation hubs along the path with special colors.

[0207] By visualizing the situational information as described above, commanders are provided with an intuitive situational awareness capability that allows them to "understand the overall situation from a single map," which helps them to formulate response strategies quickly and accurately.

[0208] Second, the generation and distribution of dispatch instructions. First, the optimal emergency response plan... rec The content is structured and analyzed. The optimal emergency response plan is described. rec Derived from a pre-built emergency response plan knowledge base D policy The emergency response plan knowledge base D policy All emergency response plans (p') follow a unified, standardized document structure (e.g., using XML or JSON format, or a rich text document with clear chapter divisions). Based on this standardized document structure, the optimal emergency response plan is identified and extracted. rec The document defines the responsible departments / action roles and a standardized list of procedures.

[0209] Based on the information parsed above, a structured scheduling instruction (Dispatch) is dynamically generated. cmd The specific process formula is as follows:

[0210] Dispatch cmd =(Msg content ,Target role Action list Trace ID );

[0211] Among them, Dispatchcmd Indicates a scheduling instruction; Msg content Indicates the dispatch instruction Dispatch cmd Contextual and background information is provided to ensure that the task executor fully understands the task's background, severity, and objectives; Target role Indicates the dispatch instruction Dispatch cmd The recipient and responsible party are identified to clearly define the specific department, team, or role responsible for performing this task; Action list Indicates the dispatch instruction Dispatch cmd The specific work involves developing an optimal emergency response plan. rec The extracted, structured list of action steps; Trace ID An index representing a high-risk event, i.e., a trace identifier, is used to track dispatch instructions. cmd The entire lifecycle status, including the issuance, receipt, processing, and completion of orders, is monitored in real time and audited afterward.

[0212] Finally, the dispatch instruction Dispatch cmd By deeply integrating with the city's existing work order system or task management system, the electronic work orders are accurately issued to the relevant frontline personnel or department heads.

[0213] Example 2

[0214] This embodiment, based on Embodiment 1, provides a city data fusion event early warning system, such as... Figure 2 As shown, it includes a multi-source data acquisition module, a digital twin mapping module, a risk identification and assessment module, and an early warning and response linkage module;

[0215] The multi-source data acquisition module is used to acquire raw multi-source data in real time, and to construct a physical environment time-series dataset D based on the raw multi-source data. iot Urban infrastructure asset dataset D asset and API call behavior log dataset D api ;

[0216] The digital twin mapping module is based on the physical environment time-series dataset D. iot and urban infrastructure asset dataset D asset Construct a dynamic digital twin graph G;

[0217] The risk identification and assessment module is based on the dynamic digital twin map G and the time-series data of the physical environment D. iot By applying a persistent anomaly detection mechanism within a sliding time window, the initial risk triggering node v is located. trigger With the initial risk triggering node vtrigger Starting from the dynamic digital twin graph G, a graph traversal search algorithm is executed to construct a set of potential risk propagation paths, Path. potential A chain probability model is used to analyze the potential risk propagation path set Path. potential Conduct quantitative assessments and construct an early warning event set (Event). warn ;

[0218] The early warning response linkage module is based on the early warning event set Event. warn High-risk events Call the natural language generation function f NLG (·), access the dynamic digital twin graph G, and generate a natural language warning message M. warn Using semantic matching operations, from a pre-built emergency response plan knowledge base D policy In the middle, is the natural language warning message M. warn Match the optimal emergency response plan rec Based on the aforementioned optimal emergency response plan rec and the natural language warning message M warn The system dynamically and visually presents early warning scenarios and optimizes the emergency response plan. rec The process involves parsing the data to generate traceable dispatch instructions. cmd The dispatch instruction Dispatch cmd Issued through integration with the work order system.

[0219] The parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of corresponding technical solutions in the prior art have not been described in detail to avoid excessive elaboration.

[0220] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for early warning of urban data fusion events, characterized in that, include: Real-time collection of raw multi-source data, and sequential construction of physical environment time-series dataset, urban facility asset dataset, and API call behavior log dataset based on the raw multi-source data; A dynamic digital twin map is constructed based on a time-series dataset of physical environment and a dataset of urban infrastructure assets. The method for constructing the dynamic digital twin graph includes: traversing the physical environment time-series dataset and the urban facility asset dataset, summarizing the physical environment time-series dataset and the urban facility asset dataset to form a data set, calling a mapping function to instantiate each independent data record in the data set, and constructing a node set for the graph; Based on the node set, a dependency construction strategy based on domain rules and a dependency construction strategy based on spatial proximity are used to construct the edge set of the graph. Based on the node set and the edge set, a static digital twin graph is constructed. Based on the dependency edges to be evaluated in the edge set of the graph, a subset of API logs related to the dependency edges is filtered out in the API call behavior log dataset through an association judgment function. A composite evaluation function is called to quantify the credibility of the dependency edges related to the API log subset. The credibility is dynamically attached to the dependency edges of the graph to construct a dynamic digital twin graph. The step of filtering out a subset of API logs related to the dependency edge through the association judgment function includes: network address matching, where the source / destination IP address in the API call behavior log matches the network address attributes of the source and target nodes connected by the dependency edge; and interface type matching, where the API interface identifier in the API call behavior log belongs to the predefined interface list of the dependency type in the dependency edge. Based on dynamic digital twin graphs and physical environment time-series data, a continuous anomaly detection mechanism within a sliding time window is applied to locate the initial risk triggering node. Starting from the initial risk triggering node, a graph traversal search algorithm is executed on the dynamic digital twin graph to construct a set of potential risk propagation paths. A chain probability model is used to quantitatively evaluate the set of potential risk propagation paths and construct a set of early warning events. Based on high-risk events in the early warning event set, a natural language generation function is invoked to access the dynamic digital twin graph and generate a natural language early warning message. Semantic matching is then used to match the optimal emergency plan from a pre-built emergency plan knowledge base for the natural language early warning message. Based on the optimal emergency plan and the natural language early warning message, the early warning scenario is dynamically and visually presented. The optimal emergency plan is then analyzed to generate a traceable dispatch instruction, which is then distributed through the integrated work order system.

2. The urban data fusion event early warning method according to claim 1, characterized in that, The methods for constructing the physical environment time-series dataset, the urban infrastructure asset dataset, and the API call behavior log dataset include: Real-time acquisition of raw sensor observations; spatiotemporal reference alignment, exponential weighted moving average filtering and min-max normalization are sequentially performed on the raw sensor observations to construct a physical environment time series dataset. Based on the original urban infrastructure asset data from multi-source heterogeneous business systems, an automated processing flow is sequentially executed on the original urban infrastructure asset data, including data parsing, semantic mapping, multi-level verification, confidence scoring, entity alignment, and unique identifier allocation, to construct a structured urban infrastructure asset dataset. For unstructured raw network traffic or log text, protocol parsing and session reassembly are performed sequentially to generate structured raw session records. Key dimension vectors are extracted from the raw session records and assembled to form API call behavior logs. An API call behavior log dataset is then constructed based on the API call behavior logs.

3. The urban data fusion event early warning method according to claim 2, characterized in that, The multi-level verification process includes: Syntactic validation automatically verifies the data type, value range, and format specification elements of each field based on the field definitions of the standard asset data model. Semantic verification compares the core information of the asset with the city's actual unit / address benchmark database and outputs a quantitative confidence score.

4. The urban data fusion event early warning method according to claim 1, characterized in that, The method for constructing the set of early warning events includes: Based on the normalized sensor observation sequence corresponding to each node in the dynamic digital twin map, a continuous anomaly detection mechanism within a sliding time window is adopted. Within a preset time window, the frequency of occurrence of the normalized sensor observation exceeding a preset sensor anomaly alarm threshold is counted. If the frequency of occurrence reaches or exceeds a preset confirmation threshold, the node is marked as an initial risk trigger node. Starting from the initial risk trigger node, a graph traversal search algorithm limited by a preset maximum propagation depth is executed along the direction of the dependency edges on the dynamic digital twin graph to construct a set of potential risk propagation paths; A chain probability model is used to quantitatively evaluate the set of potential risk propagation paths. The total probability of cascading risks for each potential risk propagation path from the initial risk triggering node to the endpoint node is calculated. If the total probability of cascading risks exceeds a preset risk alarm threshold, the risk propagation path and the total probability of cascading risks are included in the set of early warning events.

5. The urban data fusion event early warning method according to claim 1, characterized in that, The method for generating the scheduling instructions includes: Traverse the high-risk events in the early warning event set, call the natural language generation function, access the dynamic digital twin graph, extract the attribute information of each node in the potential risk propagation path and the credibility of each dependency edge, and generate a natural language early warning message based on the extracted attribute information and the total probability value of cascaded risks. The system iterates through the emergency plans in the pre-built emergency plan knowledge base, calls the text embedding model to perform semantic modeling on the emergency plans, generates emergency plan vectors, and stores all emergency plan vectors in the vector index database; it calls the text embedding model to perform semantic modeling on natural language warning messages, converts them into query vectors, calculates the cosine similarity between the query vectors and each emergency plan vector in the vector index database, and selects the optimal emergency plan. Based on the optimal emergency plan and natural language early warning messages, the system realizes dynamic visualization of the early warning scenario, performs structured parsing of the optimal emergency plan, generates structured dispatch instructions, and issues the dispatch instructions through integration with the work order system.

6. A city data fusion event early warning system, used to implement the city data fusion event early warning method according to any one of claims 1-5, characterized in that, The system includes: a multi-source data acquisition module, a digital twin mapping module, a risk identification and assessment module, and an early warning response linkage module; The multi-source data acquisition module is used to collect raw multi-source data in real time, and to construct a physical environment time series dataset, an urban facility asset dataset, and an API call behavior log dataset based on the raw multi-source data. The digital twin mapping module constructs a dynamic digital twin map based on a physical environment time-series dataset and an urban facility asset dataset. The risk identification and assessment module, based on the dynamic digital twin map and physical environment time-series data, applies a continuous anomaly detection mechanism within a sliding time window to locate the initial risk trigger node. Starting from the initial risk trigger node, it executes a graph traversal search algorithm on the dynamic digital twin map to construct a set of potential risk propagation paths. It then uses a chain probability model to quantitatively assess the set of potential risk propagation paths and construct a set of early warning events. The early warning response linkage module, based on high-risk events in the early warning event set, calls a natural language generation function, accesses a dynamic digital twin graph, and generates a natural language early warning message; it uses semantic matching to match the optimal emergency plan from a pre-built emergency plan knowledge base for the natural language early warning message; based on the optimal emergency plan and the natural language early warning message, it dynamically and visually presents the early warning scenario, analyzes the optimal emergency plan, generates a traceable dispatch instruction, and distributes the dispatch instruction through the integrated work order system.

Images