Railway ticket station-level security operation method and platform based on rwkv model

Abstract

The application discloses a railway ticket station-level safe operation and maintenance method and platform based on an RWKV model, which comprises the following steps: collecting multi-source heterogeneous time sequence data generated in the operation of a ticket terminal device; preprocessing the collected multi-source heterogeneous time sequence data; inputting the preprocessed multi-source heterogeneous time sequence data into a pre-trained RWKV model, performing reasoning by using a time mixing module and a channel mixing module of the RWKV model, and outputting a quantitative index for evaluating the health state of the device; the quantitative index comprises a fault early warning probability value representing the health state of the device; generating and executing operation and maintenance instructions based on the quantitative index, wherein the operation and maintenance instructions comprise triggering a hierarchical alarm, generating a treatment work order or starting and stopping a device function. The application can improve the fault diagnosis efficiency and accuracy, guarantee the high availability and safety of the railway ticketing system, and significantly improve the operation and maintenance efficiency. In addition, the application also provides a railway ticket station-level safe operation and maintenance platform based on an RWKV model, which also has the above beneficial effects.

Description

Technical Field

[0001] This invention relates to the field of railway information technology, and more specifically, to a railway passenger ticket station-level safety operation and maintenance method based on the RWKV model. Furthermore, this invention also relates to a railway passenger ticket station-level safety operation and maintenance platform based on the RWKV model. Background Technology

[0002] The railway passenger ticketing system is a core component of critical transportation infrastructure. Its station-level nodes undertake key functions such as ticket terminal management, local transaction processing, and data synchronization and verification. The stable operation of terminal equipment such as self-service ticket machines and ticket gates deployed in these nodes is directly related to transportation order and passenger travel experience.

[0003] Currently, railway passenger station-level security operations and maintenance mainly rely on rule-based monitoring systems and human experience. This existing technical solution typically consists of the following parts: First, it collects equipment status data, network traffic, and operation logs through deployed sensors and logging systems; second, it uses preset static thresholds for anomaly detection; and finally, when a threshold is triggered, it generates an alarm and relies on maintenance personnel for fault diagnosis and handling. However, this existing technical solution has inherent structural flaws. Relying on static thresholds, it cannot effectively handle long-sequence, multi-source, heterogeneous time-series data generated during equipment operation. Furthermore, it suffers from low fault diagnosis efficiency and poor accuracy, easily causing passenger congestion during peak travel periods. In other words, the existing technology suffers from technical problems such as delayed early warning, inefficient diagnosis, and insufficient intelligence.

[0004] Therefore, how to provide a railway passenger ticket station-level safety operation and maintenance method based on the RWKV model, which can improve the efficiency and accuracy of fault diagnosis, and improve operation and maintenance efficiency through automated processes, and ensure the high availability and security of the railway ticketing system, is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a railway passenger ticket station-level security operation and maintenance method based on the RWKV model, which can improve the efficiency and accuracy of fault diagnosis and enhance operation and maintenance efficiency through automated processes, ensuring the high availability and security of the railway ticketing system. This invention also provides a railway passenger ticket station-level security operation and maintenance platform based on the RWKV model, which also has the aforementioned beneficial effects.

[0006] The present invention provides the following technical solution:

[0007] This invention provides a railway passenger ticket station-level safety operation and maintenance method based on the RWKV model, including the following steps: collecting multi-source heterogeneous time-series data generated during the operation of passenger ticket terminal equipment;

[0008] The collected multi-source heterogeneous time-series data are preprocessed;

[0009] The preprocessed multi-source heterogeneous time series data is input into a pre-trained RWKV model. The time mixing module and channel mixing module of the RWKV model are used for joint inference to output quantitative indicators for evaluating the health status of the equipment.

[0010] Receive and parse the quantitative indicators output by the RWKV model, the quantitative indicators including fault warning probability values ​​that characterize the health status of the equipment;

[0011] Operation and maintenance instructions are generated and executed based on the quantitative indicators. These instructions include triggering tiered alarms, generating work orders, or starting / stopping equipment.

[0012] Furthermore, in a preferred embodiment of the present invention, preprocessing the collected multi-source heterogeneous time-series data includes: parsing the text log data and converting the original log into a normalized word sequence through dynamic variable replacement and word segmentation filtering; normalizing the numerical sensor data and performing time alignment, missing value interpolation, and Z-score normalization to eliminate the influence of dimensions; constructing high-order time-series features and calculating their statistical and frequency domain features within a sliding window based on the normalized numerical data.

[0013] Furthermore, in a preferred embodiment of the present invention, the construction of the RWKV model includes the following steps: dynamically adjusting the weights of historical information using a time decay factor to enhance the memory of key events in the long term of the equipment; assigning dynamic weights to different equipment parameters in the multi-source heterogeneous time series data using a multivariate attention mechanism; and training the model using historical time series data containing equipment fault labels, employing Focal Loss as the loss function to address the problem of imbalanced fault sample categories.

[0014] Furthermore, in a preferred embodiment of the present invention, the inference using the time mixing module and channel mixing module of the RWKV model specifically involves: weighting and fusing the outputs of the RWKV sub-model, LSTM-CNN sub-model, Support Vector Machine (SVM) sub-model, and Random Forest sub-model through a multi-model fusion system to generate the fault warning probability value.

[0015] Furthermore, in a preferred embodiment of the present invention, the step of:

[0016] The system incorporates a database of equipment failure cases and knowledge of equipment structure. The database of equipment failure cases includes: historical failure types, corresponding failure characteristics, and failure handling solutions.

[0017] The CNN-Transformer model is used to process the waveform data when the fault occurs, and the local and global features of the fault waveform are extracted to form the fault feature vector.

[0018] The similarity between the fault feature vector and the cases in the equipment fault case library is calculated, and the equipment structure knowledge is combined to perform reverse deduction to accurately locate the fault module.

[0019] Furthermore, in a preferred embodiment of the present invention, the method further includes the step of: using personnel activity data, equipment status data, and environmental factor data, and employing fuzzy comprehensive evaluation method or hierarchical analysis method to establish a station safety risk assessment model.

[0020] Furthermore, in a preferred embodiment of the present invention, the method further includes the steps of: periodically collecting feedback data generated during the execution of operation and maintenance, and using the feedback data to incrementally train the RWKV model to optimize the model parameters; predicting future business load peaks based on historical passenger flow data, and automatically adjusting computing resources, spare parts inventory, or personnel scheduling plans based on the prediction results.

[0021] Furthermore, this invention also provides a railway passenger ticket station-level security operation and maintenance platform based on the RWKV model, used to implement the railway passenger ticket station-level security operation and maintenance method based on the RWKV model as described above, including:

[0022] The data acquisition layer is used to collect multi-source heterogeneous time-series data from the station-level ticketing system;

[0023] The RWKV model inference layer, deployed on the station edge server, includes a pre-trained RWKV model for real-time inference of pre-processed data, outputting fault probability and risk warnings.

[0024] The security operation and maintenance service layer provides functions such as equipment status monitoring, intelligent fault diagnosis, security incident handling, and operation and maintenance resource scheduling. It is used to drive the closed-loop operation and maintenance process based on the output results of the RWKV model inference layer.

[0025] The human-computer interaction layer is used to display early warning information, operation and maintenance work orders and statistical reports, and supports voice interaction with operation and maintenance personnel.

[0026] Furthermore, in a preferred embodiment of the present invention, the data acquisition layer specifically includes:

[0027] The equipment status monitoring module is used to collect operating parameters of ticket vending terminals and ticket gates;

[0028] The environmental monitoring module is used to monitor the operating environment of the equipment through temperature and humidity sensors and smoke sensors;

[0029] The network probe module is used to collect network traffic, port access records, and abnormal login logs;

[0030] The data preprocessing module is used to clean, transform, integrate, and reduce the collected multi-source heterogeneous data to form standardized input feature vectors.

[0031] Furthermore, in a preferred embodiment of the present invention, the RWKV model inference layer specifically includes:

[0032] The model training module is used to train the RWKV model using historical device time-series data and Focal Loss as the loss function.

[0033] The real-time inference engine is used to input preprocessed feature vectors into the trained RWKV model, capture temporal dependencies through the temporal fusion module, and perform cross-feature correlation analysis through the channel fusion module to output device health status scores and failure probabilities. The RWKV model inference layer also integrates a multi-model fusion module, which is used to receive the output results of the RWKV sub-model, the machine learning sub-model based on SVM and random forest, and the deep learning sub-model based on LSTM-CNN.

[0034] This invention provides a railway passenger ticket station-level safety operation and maintenance method based on the RWKV model. Compared with the prior art, the technical solution provided by this invention includes: collecting multi-source heterogeneous time-series data generated during the operation of passenger ticket terminal equipment; preprocessing the collected multi-source heterogeneous time-series data; inputting the preprocessed multi-source heterogeneous time-series data into a pre-trained RWKV model, using the time mixing module and channel mixing module of the RWKV model for joint inference, and outputting quantitative indicators for evaluating the health status of the equipment; receiving and parsing the quantitative indicators output by the RWKV model, wherein the quantitative indicators include fault warning probability values ​​characterizing the health status of the equipment; generating and executing operation and maintenance instructions based on the quantitative indicators, wherein the operation and maintenance instructions include: triggering graded alarms, generating disposal work orders, or starting and stopping equipment functions. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model provided by this invention can improve the efficiency and accuracy of fault diagnosis, enhance operation and maintenance efficiency through automated processes, ensure the high availability and security of the railway ticketing system, significantly shorten the average fault diagnosis time, and significantly improve the efficiency of resolving difficult faults, thus improving overall operation and maintenance efficiency. Simultaneously, it reduces the risk of data misoperation, significantly improves the accuracy of security event prediction, and, combined with passenger flow prediction, enables dynamic scheduling of operation and maintenance personnel and spare parts, significantly improving resource utilization and reducing operation and maintenance costs. This invention also features enhanced scalability, requiring no platform reconstruction and adapting to various station scenarios. Furthermore, this invention also provides a railway passenger ticket station-level safety operation and maintenance platform based on the RWKV model, which also possesses the aforementioned beneficial effects. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a flowchart illustrating the railway passenger ticket station-level safety operation and maintenance method based on the RWKV model involved in an embodiment of the present invention.

[0037] Figure 2 This is the overall system architecture for railway passenger ticket station-level safety operation and maintenance based on the RWKV model in this embodiment of the invention;

[0038] Figure 3 This is a schematic diagram of the architecture of the station safety operation and maintenance service platform involved in an embodiment of the present invention. Detailed Implementation

[0039] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0040] Please Figures 1 to 3 As shown, this invention provides a railway passenger ticket station-level safety operation and maintenance method based on the RWKV model, comprising: collecting multi-source heterogeneous time-series data generated during the operation of passenger ticket terminal equipment; preprocessing the collected multi-source heterogeneous time-series data; inputting the preprocessed multi-source heterogeneous time-series data into a pre-trained RWKV model, using the time mixing module and channel mixing module of the RWKV model for joint inference, and outputting quantitative indicators for evaluating the health status of the equipment;

[0041] The method receives and parses the quantitative indicators output by the RWKV model, including fault warning probability values ​​characterizing the health status of equipment. Based on these quantitative indicators, it generates and executes operation and maintenance instructions, including triggering tiered alarms, generating work orders, or starting / stopping equipment functions. This invention provides a railway passenger ticket station-level safety operation and maintenance method based on the RWKV model, which improves fault diagnosis efficiency and accuracy, enhances operation and maintenance efficiency through automated processes, ensures high availability and security of the railway ticketing system, reduces the average fault diagnosis time from 40 minutes to less than 10 minutes, significantly improves the efficiency of resolving difficult faults, and enhances overall operation and maintenance efficiency. Simultaneously, it reduces the risk of data misoperation, significantly improves the accuracy of safety event prediction, and, combined with passenger flow prediction, enables dynamic scheduling of operation and maintenance personnel and spare parts, significantly improving resource utilization and reducing operation and maintenance costs. This invention also features enhanced scalability, requires no platform reconstruction, and is adaptable to various station scenarios. Furthermore, this invention also provides a railway passenger ticket station-level safety operation and maintenance platform based on the RWKV model, which also possesses the aforementioned beneficial effects.

[0042] In the data acquisition step, multi-source heterogeneous time-series data are collected from ticket terminal equipment such as self-service ticket machines and ticket gates through sensors deployed at the station, such as temperature sensors, voltage sensors, and log interfaces such as network controllers. This includes hardware sensor data, such as temperature, current, and voltage, with a sampling frequency of 1Hz to 10Hz, operation log data, such as operation records and error codes, and network communication data, such as network latency and data packet loss rate. These data are encrypted and transmitted via the YD-SOMN security management protocol to ensure data security. In the data preprocessing step, the collected data is cleaned; for example, missing values ​​are handled using linear interpolation, outliers are marked and aligned based on the 3σ principle, non-equal-frequency data are uniformly interpolated to 1Hz time series and standardized, numerical features are standardized using Z-score, and categorical features are mapped using embedding, forming input feature vectors within 512 dimensions to eliminate baseline differences between devices and improve data quality. In the intelligent analysis and early warning step, the preprocessed feature vectors are input into a pre-trained RWKV model. This model captures the temporal evolution of device states, such as a slow temperature increase trend, through the Time-mix module, and further analyzes the Channel-mix module. L-mix performs cross-feature nonlinear interactive modeling, such as the correlation between voltage sags and monitoring signal fluctuations, outputting the probability of device failure (values ​​between 0 and 1). The model inference latency is controlled within 100ms, supporting real-time processing. In the operation and maintenance handling steps, it triggers graded early warnings based on the failure probability, such as a level 1 warning for a probability of 0.3-0.6, a level 2 warning for 0.6-0.8, and a level 3 warning for ≥0.8. It also automatically generates operation and maintenance work orders, which are pushed to the operation and maintenance personnel's terminals via APP or SMS. Through the efficient time-series processing capabilities of the RWKV model, it achieves early warning of device failures 30 minutes to 2 hours in advance, reducing the average fault diagnosis time from 40 minutes to less than 10 minutes, improving the speed and accuracy of operation and maintenance response, and reducing manual intervention and operation and maintenance costs through automated handling.

[0043] Specifically, in the embodiments of the present invention, the preprocessing of the collected multi-source heterogeneous time-series data includes: parsing the text log data, converting the original log into a normalized word sequence through dynamic variable replacement and word segmentation filtering; normalizing the numerical sensor data, performing time alignment, missing value interpolation, and Z-score normalization to eliminate the influence of dimensions; constructing high-order time-series features, and calculating their statistical features and frequency domain features within a sliding window based on the normalized numerical data.

[0044] This invention is implemented based on a three-tier distributed system architecture, which includes a Remote Security Service Center (SSOC), a railway bureau-level ticketing security system, and a station security operation and maintenance access platform. Through the YD-SOMN security management protocol, it achieves policy distribution, event reporting, and global collaboration. The ticketing security system, as a secondary management node, includes a security management center composed of boundary protection devices and intrusion detection devices. The security monitoring and auditing center uses ELK-Stack for log aggregation and combines it with the RWKV model for abnormal behavior identification, along with a security emergency response center. The station security operation and maintenance access platform, as a terminal node, deploys a network controller to support monitoring of over 100,000 network sessions and uploads data to the railway bureau via API interfaces. This enables multi-level data processing and collaboration, improving system scalability and reliability. Hierarchical processing reduces network load, supports station-level edge deployment, and adapts to the decentralized and real-time requirements of railway ticketing systems. Simultaneously, standardized protocols ensure secure data transmission.

[0045] Specifically, in an embodiment of the present invention, the construction of the RWKV model includes the following steps: dynamically adjusting the weights of historical information using a time decay factor to enhance the memory of key events in the long term of the equipment; using a multivariate attention mechanism to assign dynamic weights to different equipment parameters in the multi-source heterogeneous time series data; and training the model using historical time series data containing equipment fault labels, with Focal Loss as the loss function to solve the problem of imbalanced fault sample categories.

[0046] Specifically, in the embodiments of the present invention, the inference using the time mixing module and channel mixing module of the RWKV model is as follows: the outputs of the RWKV sub-model, LSTM-CNN sub-model, support vector machine (SVM) sub-model and random forest sub-model are weighted and fused through a multi-model fusion system to generate the fault warning probability value.

[0047] Specifically, in embodiments of the present invention, the following steps are also included:

[0048] The system incorporates a database of equipment failure cases and knowledge of equipment structure. The database of equipment failure cases includes: historical failure types, corresponding failure characteristics, and failure handling solutions.

[0049] The CNN-Transformer model is used to process the waveform data when the fault occurs, and the local and global features of the fault waveform are extracted to form the fault feature vector.

[0050] The similarity between the fault feature vector and the cases in the equipment fault case library is calculated, and the equipment structure knowledge is combined to perform reverse deduction to accurately locate the fault module.

[0051] In the embodiments of this invention, the model uses a time decay factor to dynamically adjust the weights of historical information. For example, for equipment fault warning scenarios, the decay parameters are optimized to enhance the memory of key events in the long term, such as the last maintenance record. A multivariate attention mechanism is used to assign dynamic weights to different equipment parameters, such as temperature and current, focusing on key influencing factors. During training, historical time-series data containing equipment fault labels, such as a continuous 72-hour monitoring signal sequence, is used. The dataset is constructed through a sliding window, such as a window length of 120 steps, with the label indicating whether a fault occurred within 30 minutes after the window ends. Data augmentation, such as time perturbation and noise injection, is used to solve the sample imbalance problem. The optimizer uses AdamW with a learning rate of 1e-4 and a weight decay of 1e-5. The loss function uses Focal Loss to alleviate the class imbalance caused by the scarcity of fault samples. The training hardware is based on 8×NVIDIA A100, and the parallel training capability of RWKV is used to accelerate convergence, improving the accuracy and robustness of the model and increasing the fault warning accuracy to over 95%. At the same time, adaptive learning reduces false alarms and enhances the model's adaptability to individual differences in equipment. Feature extraction from text log data includes data cleaning of the log text: removing redundant symbols such as delimiters, garbled characters, standardizing formats, and dynamic variable substitution. Secondly, semantic features are extracted using TextCNN or the lightweight BERT-mini model: TextCNN uses multi-size convolutional kernels to capture local phrase features and outputs fixed-dimensional vectors; BERT-mini captures contextual semantics through Transformer layers and outputs 256-dimensional vectors. The extracted feature vectors are concatenated with numerical sensor data to form comprehensive input features, effectively handling the heterogeneity and noise of log data, improving feature expression capabilities, enabling the RWKV model to more accurately identify complex fault modes, and reducing false negatives and false positives.

[0052] In addition, embodiments of the present invention also include the step of: using personnel activity data, equipment status data, and environmental factor data, and employing fuzzy comprehensive evaluation method or hierarchical analysis method to establish a station safety risk assessment model.

[0053] Specifically, in the embodiments of the present invention, the steps further include: periodically collecting feedback data generated during the execution of operation and maintenance operations, and using the feedback data to incrementally train the RWKV model to optimize the model parameters; predicting future business load peaks based on historical passenger flow data, and automatically adjusting computing resources, spare parts inventory, or personnel scheduling plans based on the prediction results.

[0054] Furthermore, this invention also provides a railway passenger ticket station-level security operation and maintenance platform based on the RWKV model, used to implement the railway passenger ticket station-level security operation and maintenance method based on the RWKV model as described above, including:

[0055] The data acquisition layer is used to collect multi-source heterogeneous time-series data from the station-level ticketing system;

[0056] The RWKV model inference layer, deployed on the station edge server, includes a pre-trained RWKV model for real-time inference of pre-processed data, outputting fault probability and risk warnings.

[0057] The security operation and maintenance service layer provides functions such as equipment status monitoring, intelligent fault diagnosis, security incident handling, and operation and maintenance resource scheduling. It is used to drive the closed-loop operation and maintenance process based on the output results of the RWKV model inference layer.

[0058] The human-computer interaction layer is used to display early warning information, operation and maintenance work orders and statistical reports, and supports voice interaction with operation and maintenance personnel.

[0059] Specifically, in embodiments of the present invention, the data acquisition layer specifically includes:

[0060] The equipment status monitoring module is used to collect operating parameters of ticket vending terminals and ticket gates;

[0061] The environmental monitoring module is used to monitor the operating environment of the equipment through temperature and humidity sensors and smoke sensors;

[0062] The network probe module is used to collect network traffic, port access records, and abnormal login logs;

[0063] The data preprocessing module is used to clean, transform, integrate, and reduce the collected multi-source heterogeneous data to form standardized input feature vectors.

[0064] Specifically, in embodiments of the present invention, the RWKV model inference layer specifically includes:

[0065] The model training module is used to train the RWKV model using historical device time-series data and Focal Loss as the loss function.

[0066] The real-time inference engine is used to input preprocessed feature vectors into the trained RWKV model, capture temporal dependencies through the temporal fusion module, and perform cross-feature correlation analysis through the channel fusion module to output device health status scores and failure probabilities. The RWKV model inference layer also integrates a multi-model fusion module, which is used to receive the output results of the RWKV sub-model, the machine learning sub-model based on SVM and random forest, and the deep learning sub-model based on LSTM-CNN.

[0067] To elaborate more specifically, the railway passenger ticketing system, as a core component of important transportation infrastructure, is a crucial infrastructure for passenger travel services. Its station-level nodes undertake key functions such as ticket terminal management, local transaction processing, and data synchronization verification. Its safe and stable operation is directly related to transportation order and passenger experience. While existing railway operation and maintenance technologies exist, they focus on network-wide data analysis and resource scheduling, failing to address the challenges of dispersed station-level equipment and high real-time response requirements. Furthermore, centralized ticketing operation and maintenance platforms only standardize processes and lack AI-driven proactive early warning and intelligent diagnostic capabilities. The novel RWKV model, a fusion architecture combining the advantages of recurrent neural networks (RNNs) and Transformers, possesses efficient processing capabilities for long-sequence data. Its computational complexity and memory usage are significantly lower than traditional Transformer models, demonstrating superior performance in fields such as time series prediction and natural language understanding.

[0068] Introducing the RWKV model into the field of railway passenger ticket security operation and maintenance provides a technical foundation for operation and maintenance log analysis and fault diagnosis. Therefore, deeply integrating the RWKV model with station-level operation and maintenance scenarios is expected to break through existing technical bottlenecks. However, there are currently no relevant technical solutions that have been implemented. There is an urgent need to build an AI operation and maintenance system adapted to station scenarios to achieve a transformation from passive emergency repair to proactive defense. Based on this, the embodiments of this invention aim to solve the problems of delayed fault response, low accuracy of security threat identification, insufficient multi-source data integration capabilities, and lack of intelligent decision-making in the existing railway passenger ticket station-level operation and maintenance. Specifically, it includes: realizing early warning of equipment failure and data security risks, shortening fault diagnosis time; building a closed-loop operation and maintenance mechanism to integrate the entire process of fault location, handling, and tracing; and adapting to the heterogeneous data environment at the station level to improve the accuracy of operation and maintenance decisions in complex scenarios. The platform involved in this invention relies on the security management platform and network security foundation supported by the railway passenger ticket four-level network security protection system to establish a security monitoring and auditing service platform. This platform is deployed in various railway group companies and can proactively collect users' security service information through the YD-SOMN security management protocol and related API interfaces. Through security monitoring, security auditing, and simulation technology, as well as the remote monitoring, auditing, evaluation, and expert diagnosis system deployed by the passenger ticketing bureau center, it can monitor, audit, evaluate, diagnose, and comprehensively analyze the user's network security environment. It automatically helps users handle system security configuration, asset security management, security mechanism and security service call processes to respond to security events that occur in the system, protect the user's set goals, and continuously solve dynamic security problems that users encounter during the operation of the information system.

[0069] This invention is based on a four-level network security system for railway passenger tickets. The platform adopts a three-level distributed architecture: a Remote Security Service Center (SSOC), a central railway ticket security system, and a station security operation and maintenance access platform. It integrates the RWKV model and the YD-SOMN control protocol to achieve intelligent processing of security data and multi-level collaborative operation and maintenance. The Remote Security Service Center (SSOC) supports elastic expansion and establishes trusted communication with the existing security control platform infrastructure through the YD-SOMN security control protocol, achieving coupling with existing security management and control equipment. Ultimately, it enables monitoring, auditing, and simulation security services for the passenger ticket system. Simultaneously, it can collect information such as the operating status, log information, security information, and security events of related equipment deployed in the security control center platform within the railway passenger ticket network security system through the YD-SOMN security control protocol and related API interfaces. Guided by SSE-CMM, this platform system architecture establishes a security service system, implementing security service engineering using systems engineering methods. It continuously cycles through risk processes, engineering processes, and assurance processes to reduce security risks in the information system.

[0070] Security services are categorized into five levels, and graded security services are provided for different security domains and devices at different security levels, enabling information systems to meet the requirements of national authorities with reasonable investment. A dynamic response security service system is established to address the contradiction between constantly changing security risks in information systems and insufficient human resources to detect security risks in information systems at all times. A manageable and automated security service system utilizes the security facilities and security control capabilities deployed by the system to complete a large number of basic security services such as information system vulnerability checks, security audits, security monitoring, and security hardening. This provides basic information for information security experts to design security solutions and establishes a comprehensive information security expert database.

[0071] Specifically, this platform involves three core modules: Security Management Center: Composed of boundary protection equipment, intrusion detection equipment, security authentication system, etc., it provides basic security capabilities such as cryptographic services and access control, and outputs device status data through security monitoring / auditing interfaces; Security Monitoring and Auditing Center: Deploys security assessment scanning, expert diagnosis and service simulation systems, uses ELK-Stack to achieve centralized log aggregation and analysis, and combines the RWKV model for abnormal behavior identification; Security Emergency Response Center: Stores an emergency plan library, receives risk policies issued by SSOC and executes response operations.

[0072] Among them, the station safety operation and maintenance access service platform, as the terminal access node, adopts the architecture of "data layer - large model engine layer - service layer - interaction layer", deploys a network controller, supports monitoring of more than 100,000 network sessions, provides functions such as network status analysis, risk scanning, and local emergency response, and uploads terminal logs to the central office through API interface.

[0073] The data acquisition layer in this embodiment of the invention employs a network controller and various network probes. Utilizing the YD-SOMN security management protocol and standardized API interfaces, it proactively collects security service information from the station-level ticketing system, including terminal device status, network traffic data, operation logs, security configuration parameters, and asset ledger information. Encrypted transmission with station terminals and the central server is achieved through a manageable and secure communication platform. Equipment status monitoring devices, such as ticketing terminals, station service equipment, turnstiles, and cameras, collect real-time equipment operating parameters to monitor equipment status and personnel activity.

[0074] Environmental monitoring equipment, such as temperature and humidity sensors, smoke sensors, and harmful gas sensors, monitors the environmental conditions inside the station in real time.

[0075] Personnel positioning equipment: Real-time positioning of maintenance personnel, tracking personnel location information, and ensuring personnel safety.

[0076] The network controller is used as a data acquisition gateway to aggregate, transform, and transmit data collected by various sensors and devices, and upload it to the data layer, including but not limited to business data and security data.

[0077] Business data interface: collects business data such as ticket transaction records, order status, and data synchronization logs; Security data interface: connects to firewalls and intrusion detection systems to obtain security data such as network traffic, port access records, and abnormal login logs.

[0078] Data storage and archiving: By integrating the above core data, including device status data, business operation data, and security log data, the data is standardized and then transmitted to the local cache node through a dual-redundant communication network.

[0079] The data preprocessing module cleans the collected data, removing noise, filling in missing values, transforming the data, converting data formats, standardizing, integrating multi-source data fusion and data reduction, etc., to improve data quality, reduce data redundancy, and provide clean and standardized data for AI large-scale model training and inference.

[0080] Data Management Module: Enables functions such as data access control, backup and recovery, and data synchronization to ensure data security, integrity, and consistency.

[0081] Regarding the RWKV model inference layer in this embodiment of the invention, the RWKV model inference layer, as the intelligent core of the platform, includes a model training module and an inference engine. It is adapted to the deployment of station-level edge servers, performs feature extraction and association encoding on the collected time-series data, and realizes real-time inference and risk level assessment of safety anomalies through multi-scale time-series segmentation technology. The model inference latency is controlled within 100ms.

[0082] Among them, the data preprocessing model performs feature engineering on the data, such as feature extraction and feature selection, to provide more effective feature vectors for subsequent model training, forming multi-dimensional data on equipment operating status, including historical operating data such as runtime, load rate, and past fault records; real-time operating data such as monitoring data on network congestion, host resource overload, and service failure; and fault status data such as fault inspection features, monitoring signal waveforms, and fault occurrence time.

[0083] The fault warning module integrates RWKV with machine learning. Based on the RWKV model, it incorporates machine learning algorithms, including support vector machines (SVM), random forests, and deep learning models such as LSTM and CNN. It uses historical and real-time data of the equipment to establish a fault warning model and predict potential faults in the equipment.

[0084] Basic model: The RWKV model is used to process the equipment time series data, and the monitoring signal change sequence of 72 consecutive hours is selected to capture the long-term data dependency relationship and output the time series feature vector.

[0085] Fusion Model: The time-series feature vector output by RWKV, together with the static features of the equipment, including the equipment model and the years of use, are input into a set of machine learning algorithms, such as support vector machine (SVM) and random forest. The fault warning result is output through a weighted voting mechanism, including the probability of fault occurrence and the expected occurrence time. When the probability exceeds a preset threshold, an early warning is triggered. The preset threshold is preferably 85%.

[0086] Regarding the fault diagnosis and localization module, the feature extraction uses a CNN-Transformer model to process fault data. The CNN layer extracts local features of the fault waveform, such as waveform abrupt changes and peak anomalies, while the Transformer layer captures the global correlation between features and outputs a fault feature vector.

[0087] Regarding knowledge integration, an equipment failure case library is introduced, including historical failure types, corresponding characteristics, and handling solutions, along with equipment structure knowledge, internal module connection relationships, and the functions of each module. Failure feature vectors are matched with case library data using cosine similarity, and the failure impact path is deduced in reverse by combining equipment structure knowledge, thereby enabling failure type diagnosis, such as voltage module failure, data transmission module failure, and failure location, including the specific failure module number and location.

[0088] The fault diagnosis and location model combines a database of equipment fault cases and knowledge of equipment structure with deep learning models, such as the CNN-Transformer model, to analyze equipment fault data, achieving accurate diagnosis of fault types and precise location of faults. For example, by analyzing the current and voltage data and waveforms of passenger service equipment during faults, the model can diagnose the fault type of the equipment and determine the specific module where the fault occurred.

[0089] Among them, the safety risk assessment model comprehensively considers data from multiple aspects such as personnel activities, equipment status, and environmental factors. It uses fuzzy comprehensive evaluation method, analytic hierarchy process (AHP) combined with machine learning model to establish a station safety risk assessment model, assess the station's safety risk level, and provide a basis for safety management decisions.

[0090] Among them, the emergency response plan generation model: Based on natural language processing (NLP) technology and knowledge graph, a railway station emergency response knowledge graph is constructed, integrating historical emergency response cases and relevant rules and regulations. When an emergency occurs, the AI ​​big model is used to generate corresponding emergency response plans based on information such as event type and severity.

[0091] Regarding the security operation and maintenance service layer involved in the embodiments of the present invention, it provides five major functional services, including equipment status monitoring, intelligent fault diagnosis, security incident handling, operation and maintenance resource scheduling, and decision-making effect evaluation, forming a closed loop of "monitoring, early warning, handling, and review," specifically including:

[0092] The real-time monitoring center establishes a database of monitoring indicators for IT resources, systems, business operations, and health status. It displays real-time information such as equipment operating status, personnel location, and environmental parameters within the station using maps, charts, and other formats. When equipment malfunctions or personnel violate regulations, alarm messages are promptly issued, and the location and situation of the anomaly are marked on the interface.

[0093] Intelligent early warning management: Displays equipment fault early warning information, safety risk early warning information, etc., including the name of the early warning equipment, early warning type, early warning level, and expected occurrence time. Maintenance personnel can view the early warning details and perform corresponding operations, such as dispatching repair orders and conducting on-site investigations.

[0094] Fault Management: This module enables functions such as fault reporting, viewing fault diagnosis results, tracking fault handling progress, and managing fault repair records. Maintenance personnel can submit equipment fault information through this module. The system automatically invokes the fault diagnosis and location model to provide diagnostic results and repair suggestions. After completing the repair, maintenance personnel record the repair process and results, forming a closed loop for fault handling.

[0095] Security Risk Management: By analyzing abnormal logs through causal reasoning mechanisms, security risks such as database misoperation and unauthorized access are identified, and a source tracing report is output. At the same time, the station's security risk assessment results are displayed, including the risk level of each area and each piece of equipment, analyzing the causes of the risks, and providing suggestions for risk control measures. Managers can formulate targeted security management strategies based on the risk assessment results to reduce security risks.

[0096] Emergency Command and Dispatch: In the event of an emergency, it displays event information and emergency response plans, provides resource dispatch functions such as personnel, vehicles, and materials, and tracks the progress of emergency response in real time to ensure that emergency response work is carried out in an orderly and efficient manner.

[0097] Furthermore, by combining passenger flow forecast data, such as peak holiday periods, the allocation of operation and maintenance resources is dynamically adjusted, and work order priority suggestions are generated.

[0098] Human-computer interaction layer:

[0099] The human-computer interaction layer features a graphical user interface, allowing maintenance personnel to trigger fault handling processes with a single click. It also integrates voice interaction functionality for work order voice broadcasting and status queries. Furthermore, it supports report statistical analysis, generating various statistical reports based on maintenance data, such as equipment fault statistics reports, personnel inspection statistics reports, and safety risk statistics reports. This supports multi-dimensional data analysis and querying, providing decision support for management personnel and helping to optimize maintenance workflows and resource allocation.

[0100] In this embodiment of the invention, the fault early warning system based on the RWKV model and ticket terminal equipment is implemented as follows:

[0101] The RWKV model used in this invention to build intelligent fault early warning is key to the station safety operation and maintenance service platform. By leveraging the advantages of RWKV's parallel training with Transformer and the efficient inference characteristics of RNN, it captures the dynamic changes in equipment operating status through time-series modeling, enabling early warning of potential faults, which can be provided 30 minutes to 2 hours in advance.

[0102] Specifically, it includes the following technical aspects:

[0103] RWKV establishes an intelligent early warning mechanism.

[0104] Current mainstream AI large language models mainly adopt the Transformer architecture, such as GPT and LLaMA models. Transformer models perform well in various tasks, but their computational complexity increases quadratically with the length of the input sequence, limiting their efficiency in processing long sequences and making them unsuitable for scenarios requiring timely responses, such as security operations and maintenance.

[0105] This invention employs a novel RWKV sequence modeling architecture, replacing the Transformer's self-attention mechanism with a temporal mixing module and a channel mixing module, while retaining the advantages of both.

[0106] Furthermore, the following early warning mechanism is implemented: equipment data acquisition, data preprocessing, feature engineering, RWKV model inference, fault warning output, and operation and maintenance linkage. Multi-dimensional equipment status data acquisition includes collecting multi-source heterogeneous time-series data from railway ticket terminal equipment, specifically including: hardware sensor data (1Hz~10Hz sampling): temperature, humidity, voltage, current, fan speed, etc.; operation log data: operation records such as "ticket issuance successful" and "refund request"; error codes such as "0x003 paper jam"; status codes such as "standby" and "running"; network and communication data such as 1Hz sampling: network latency, packet loss rate, and connection status with the server; environmental data (0.1Hz sampling): ambient temperature and humidity of the area where the equipment is located; data storage uses a time-series database (InfluxDB can be used), indexed by device ID and timestamp, retaining at least 3 months of historical data for model training.

[0107] The data cleaning and standardization preprocessing are implemented as follows:

[0108] a. Data cleaning:

[0109] Missing value handling: Short-term missing values ​​(<5s) are filled with linear interpolation, and long-term missing values ​​are marked as "outliers" and used as features.

[0110] b. Outlier Handling: Sensor jump anomalies are identified based on the 3σ principle, and the anomaly markers are retained (not as noise removal, as the anomaly may be a precursor to a fault). The 3σ algorithm is as follows:

[0111] The Gaussian distribution, also known as the normal distribution, assumes that the random variable X follows a Gaussian distribution, i.e.:

[0112]

[0113] Its probability density function is:

[0114]

[0115] Where σ is the standard deviation and u is the mean.

[0116] The Gaussian distribution curve depends on two factors: the mean and the standard deviation. The mean of the distribution determines the center position of the graph, while the standard deviation determines the height and width of the graph. When the standard deviation is small, the curve is "tall and thin," and when the standard deviation is large, the curve is "short and wide."

[0117] Sigma principle: The probability that a value lies in the distribution (μ-σ, μ+σ) is 0.6526;

[0118] The 2sigma principle states that the probability of a value being distributed in (μ-2σ, μ+2σ) is 0.9544.

[0119] The 3sigma principle states that the probability of a value falling within the range (μ-3σ, μ+3σ) is 0.9974.

[0120] The 3σ rule states that the interval (μ-3σ, μ+3σ) is considered as the actual possible range of values ​​for a random variable X, and the probability of falling outside this interval is less than three per thousand.

[0121] c. Time alignment: Interpolate non-equal frequency data to a 1Hz timing value to ensure consistent time steps.

[0122] d. Standardization:

[0123] Numerical features such as temperature and voltage are standardized using Z-score, which is based on the historical mean and standard deviation of the device to avoid the influence of baseline differences between different devices.

[0124] Categorical features such as status codes and error codes: use embedding, such as mapping error codes to low-dimensional vectors.

[0125] Text logs: Semantic features are extracted using TextCNN or pre-trained language models such as BERT-mini and transformed into fixed-dimensional vectors.

[0126] The temporal feature enhancement involved in the embodiments of the present invention specifically includes: constructing higher-order temporal features based on the original features to improve the model's sensitivity to fault precursors: statistical features: mean, variance, maximum, minimum, and trend slope such as temperature rise rate within a sliding window (e.g., 5 min, 30 min); frequency domain features: extracting high-frequency components of monitoring signals, such as current signals, through Fourier transform; state transition features: switching frequency of equipment status codes, and finally controlling the dimension of the feature vector input to the model to within 512 dimensions.

[0127] The RWKV fault early warning model design in this embodiment of the invention specifically includes: RWKV architecture, with the goal of building a full-process ticket safety early warning system of "real-time monitoring, intelligent early warning, automatic handling, and review and optimization", shortening the emergency response time to the second level.

[0128] The time mixing module involved in this invention captures the evolution of the device state over time by weighting and aggregating the features of each time step in the sequence with historical information, such as the slow increase in temperature and the change in the frequency of monitoring signal fluctuations.

[0129] The main purpose of the temporal blending module is to achieve global information exchange, similar to the self-attention module in a traditional Transformer. This module uses three variables, R, K, and V, corresponding to Q, K, and V in the Transformer. The specific calculation formula is as follows:

[0130]

[0131] Here, µ is a weight used to control the mixing of time offsets and can be viewed as a scalar of the time dimension. These formulas use a trainable weight vector W on the current time step xi and the previous time step xi. 1. Perform linear interpolation.

[0132] The WKV operator is computed in a manner similar to that used in Attention-Free Transformer (AFT). However, unlike AFT where W is a pairwise matrix, this model treats W as a channel vector, modified by its relative positions. In this model, this recursive behavior is defined by the time-dependent update of the WKV vector, formally represented by the following equation:

[0133]

[0134] In RWKV, this is achieved by performing a scalar-level multiplication operation on the interaction between ki and vi, thus avoiding the overhead of quadratic complexity. Finally, the output calculation formula of the time mixing module is as follows:

[0135]

[0136] As time step i increases, vector Vi is influenced by more and more historical information because wkvi is a weighted sum over the position interval [1, i].

[0137] The interaction is achieved through multiplication within a given time step and summed at different time steps, which can effectively capture long-term dependencies in sequence data.

[0138] Regarding the channel mixing module in this embodiment of the invention, the following technical aspects are involved: Nonlinear interactive modeling is performed on multi-dimensional features of each time step, such as temperature, current, monitoring signals, and operation log encoding, to capture cross-feature correlations, such as the correlation between "voltage drop, abnormal fluctuation of monitoring signals" and power module failure. Parallel computing is supported, and GPUs can be used for efficient training, solving the problem of slow RNN training speed. It is also adapted to scenarios of station equipment fault early warning. Equipment operation data is typical time-series data, continuously generated according to timestamps. RWKV's time-series modeling capabilities are naturally suitable. Given the limited computing power of terminal devices, the O(n) complexity of RWKV inference can meet real-time requirements, while the high computational cost of Transformer makes deployment difficult. Furthermore, it supports long sequence inputs, such as 1024 steps or more, which can incorporate richer historical state information, improving the early warning lead time.

[0139] The system performs parallel processing on multi-dimensional features of ticket data, including user identity, order information, and system logs, and strengthens the weight of key features, such as the identifier of abnormal login devices and the order number of excessive ticket purchases, thereby improving the efficiency of risk location.

[0140] The channel blending module is another important component of the RWKV model, used to process channel-related information in sequence data. The calculation process of the channel blending module is as follows:

[0141]

[0142] Finally, the output calculation formula for the channel mixing module is as follows:

[0143]

[0144] In the RWKV model, acceptance The Sigmoid function is used as a "forget gate" to remove unnecessary historical information. This mechanism allows the model to adjust its focus on information from different channels, thereby more effectively capturing key features of the sequence data. Furthermore, the model also utilizes the squared ReLU activation function... Perform nonlinear processing, that is This function compresses negative values ​​to zero while preserving and amplifying the squares of positive values. In this way, the model can more effectively extract and highlight positive signals, thereby improving its expressive power.

[0145] The RWKV block workflow is as follows:

[0146] The process involves an input layer (512-dimensional features) to an embedding layer (mapped to 1024 dimensions), then 6 layers of RWKV blocks, and finally an output layer (2-classification: normal / alert).

[0147] Temporal Blending Module: For 1024-dimensional features, historical information is weighted by time step (the weights are dynamically adjusted through sigmoid and exponential functions to highlight recent key states).

[0148] Channel blending module: Captures non-linear relationships between feature dimensions through 1D convolution (kernel_size=3) and SwiGLU activation function.

[0149] Each layer contains LayerNorm and residual connections to alleviate the vanishing gradient problem.

[0150] Regarding the training strategies involved in the embodiments of this invention, the following technical contents are included: Dataset construction:

[0151] Sample definition: The input is a sliding window (window length = 120 steps, i.e. 2 hours), and the label is whether a failure occurs within 30 minutes after the window ends (1 = failure, 0 = normal).

[0152] Data augmentation: Time perturbation (such as slight translation) and noise injection (such as sensor Gaussian noise) are applied to normal samples to address the problem of insufficient faulty samples (the ratio of positive to negative samples is controlled at 1:5).

[0153] Regarding the training configuration involved in the embodiments of the present invention, the following technical contents are included:

[0154] Optimizer: AdamW (learning rate = 1e-4, weight decay = 1e-5).

[0155] Loss function: Focal Loss, which addresses class imbalance.

[0156] Training hardware: 8×NVIDIA A100, utilizing RWKV parallel training capabilities to accelerate convergence.

[0157] Iterative strategy: phased training, first pre-training to capture general time series patterns, and then fine-tuning with data from specific devices.

[0158] Regarding the inference optimization involved in the embodiments of the present invention, the following technical contents are included:

[0159] Leveraging the RNN characteristics of RWKV inference, new time-series data is input in real time. Each step takes 1 second, and only the output of the current time step needs to be calculated. There is no need to repeatedly calculate the history, and the inference latency is controlled within 50ms.

[0160] Model quantization: INT8 quantization is used to compress the model size, reducing it from 10GB to 1.25GB, to adapt to the computing power of terminal devices.

[0161] Regarding the multi-level early warning and linkage involved in the embodiments of the present invention, the following technical contents are included:

[0162] Warning levels:

[0163] Level 1 Warning (Low Risk): The model outputs a failure probability of 0.3~0.6, indicating "Abnormal equipment status, please pay attention".

[0164] Level 2 Warning (Medium Risk): Probability 0.6~0.8, indicating "A malfunction may occur, it is recommended to conduct an inspection within 15 minutes".

[0165] Level 3 warning (high risk): Probability ≥ 0.8, indicating "A malfunction is about to occur, take immediate action".

[0166] Linkage mechanism: Connect to the railway operation and maintenance management system (MIS) to automatically push early warning information to the operation and maintenance personnel's terminals (APP / SMS).

[0167] When a high-risk warning is issued, a temporary equipment downgrade strategy is triggered (such as switching a self-service ticket machine to a "query-only, no ticket sales" mode to reduce the impact of the failure).

[0168] Specifically, in the embodiments of the present invention, the RWKV combined with the multi-model fusion optimization model includes the following technical contents:

[0169] Transfer learning: For new devices, fine-tuning is done using pre-trained models on similar devices to reduce data dependency;

[0170] Online learning: Regularly update the model with new data (e.g., weekly incremental training) to adapt to long-term changes such as device aging;

[0171] Hyperparameter optimization: Bayesian optimization is used to optimize parameters such as sequence length, hidden layer dimension, and attention weight of the fusion layer in the RWKV search.

[0172] Data collection: Select 100 railway ticket self-service machines and collect 6 months of historical operating data (sampling frequency 1 time / minute) and real-time data (sampling frequency 1 time / 10 seconds). The data includes information such as voltage (180-240V), temperature (0-40℃), response time (0.5-5s), and historical fault types (such as ticket jam, black screen).

[0173] Data preprocessing: Missing values ​​were filled with the mean, the data were normalized with Z-Score, and the dataset was divided into training set (70%), validation set (20%), and test set (10%).

[0174] Model training:

[0175] RWKV model: with hidden layer dimension of 256, learning rate of 1e-4, and 50 training epochs, the accuracy of temporal feature extraction on the validation set is over 90%.

[0176] SVM and Random Forest: SVM uses the RBF kernel function, and the number of decision trees in the random forest is 100. The accuracy of the validation set after training is 85% and 88%, respectively.

[0177] LSTM-CNN model: 2 LSTM layers, 32 CNN convolutional kernels, and a validation set accuracy of over 93% after training.

[0178] Multi-model fusion: Weights were assigned to RWKV (0.3), SVM (0.2), Random Forest (0.2), and LSTM-CNN (0.3), and the accuracy of early warning on the test set reached over 95%.

[0179] Anomaly monitoring and early warning: By training the model to learn the normal business baseline, real-time early warning is given for behaviors that deviate from the baseline (such as abnormal logins and illegal port access), with a false negative rate of ≤0.1%;

[0180] In addition, the embodiments of the present invention also involve the following technical modules, including a risk assessment module, which quantifies the risk level (low, medium, high) based on the risk characteristics output by the model, triggers an emergency response for high-risk events (such as large-scale user identity leakage events), and medium and low-risk events enter the monitoring queue.

[0181] It also includes an intelligent handling module that outputs handling solutions for different risk levels. For example, in the case of a level 1 anomaly, the account is automatically frozen, and in the case of a level 3 fault, data backup and recovery are initiated, and users and the operation and maintenance team are notified simultaneously.

[0182] Automatic response: In response to high-risk events, the system automatically executes instructions such as freezing abnormal accounts, intercepting suspicious transactions, and locking ticketing operations, with response time controlled within seconds.

[0183] Human collaboration: Push low- to medium-risk events and handling suggestions to the operation and maintenance platform, where human confirmation is followed by supplementary intervention, and the handling process is recorded to provide data for model optimization.

[0184] The optimized detection and feedback module includes debriefing and optimization. After the emergency ends, the model analyzes the data of the handling process, optimizes the identification algorithm and handling process, improves the efficiency of subsequent emergency response, and regularly inputs emergency handling data into the RWKV model to update the parameters of the time mixing and channel mixing modules, thereby improving the accuracy of risk identification and the efficiency of emergency response, forming a closed loop of "collection, analysis, handling-optimization".

[0185] In summary, compared with the prior art, the present invention has the following advantages: First, improved operation and maintenance efficiency: the average fault diagnosis time is shortened from 40 minutes to less than 10 minutes, and the efficiency of solving difficult faults is improved by more than 3 times, supporting 24 / 7 continuous service at stations; Second, upgraded security protection: the risk of data misoperation is reduced by 90%, the accuracy of security event prediction reaches 92%, forming a full-cycle protection system of "pre-event warning, in-event blocking, and post-event traceability"; Third, optimized resource allocation: combined with passenger flow prediction, dynamic scheduling of operation and maintenance personnel and spare parts is realized, significantly improving resource utilization and significantly reducing operation and maintenance costs; Fourth, enhanced scalability: adopting a modular design, when adding new ticketing equipment types, only the feature library needs to be updated, without the need to reconstruct the platform, adapting to various station scenarios. Compared with the prior art, it has outstanding substantive features and significant progress.

[0186] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A railway passenger ticket station-level safety operation and maintenance method based on the RWKV model, characterized in that, Including the following steps: Collect multi-source heterogeneous time-series data generated during the operation of ticket terminal equipment; the ticket terminal equipment includes self-service ticket vending machines and ticket gates. The multi-source heterogeneous time-series data includes hardware sensor data, operation log data, and network communication data; The collected multi-source heterogeneous time-series data are preprocessed; The preprocessing includes: parsing the text log data, converting the original log into a normalized word sequence through dynamic variable replacement and word segmentation filtering; normalizing the numerical sensor data, performing time alignment, missing value interpolation, and Z-score normalization to eliminate the influence of units; constructing high-order time series features, and calculating their statistical and frequency domain features within a sliding window based on the normalized numerical data. The preprocessed multi-source heterogeneous time-series data is input into a pre-trained RWKV model. Joint inference is performed using the time mixing module and channel mixing module of the RWKV model to output quantitative indicators for evaluating the health status of the equipment. The construction of the RWKV model includes the following steps: dynamically adjusting the weights of historical information using a time decay factor to enhance the memory of key events in the long term of the equipment; and using a multivariate attention mechanism to assign dynamic weights to different equipment parameters in the multi-source heterogeneous time-series data. Receive and parse the quantitative indicators output by the RWKV model, the quantitative indicators including fault warning probability values ​​that characterize the health status of the equipment; Based on the quantitative indicators, operation and maintenance instructions are generated and executed. These instructions include: triggering tiered alarms, generating work orders, or starting / stopping equipment functions; and triggering temporary equipment degradation strategies when a high-risk warning is issued.

2. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 1, characterized in that, The construction of the RWKV model also includes the step of training the model using historical time-series data containing equipment fault annotations.

3. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 2, characterized in that, The joint inference using the time mixing module and channel mixing module of the RWKV model specifically involves: weighting and fusing the outputs of the RWKV sub-model, LSTM-CNN sub-model, Support Vector Machine (SVM) sub-model, and Random Forest sub-model through a multi-model fusion system to generate the fault warning probability value.

4. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 1, characterized in that, It also includes the following steps: Introduce a database of equipment failure cases and knowledge of equipment structure; The equipment failure case library includes: historical failure types, corresponding failure characteristics, and failure handling solutions; The CNN-Transformer model is used to process the waveform data when the fault occurs, and the local and global features of the fault waveform are extracted to form the fault feature vector. The similarity between the fault feature vector and the cases in the equipment fault case library is calculated, and the equipment structure knowledge is combined to perform reverse deduction to accurately locate the fault module.

5. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 1, characterized in that, It also includes the following steps: using personnel activity data, equipment status data, and environmental factor data, and employing fuzzy comprehensive evaluation method or hierarchical analysis method to establish a station safety risk assessment model.

6. The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model according to claim 1, characterized in that, It also includes the following steps: regularly collecting feedback data generated during the execution of operation and maintenance, and using the feedback data to incrementally train the RWKV model to optimize the model parameters; predicting future business load peaks based on historical passenger flow data, and automatically adjusting computing resources, spare parts inventory, or personnel scheduling plans based on the prediction results.

7. A railway passenger ticket station-level safety operation and maintenance platform based on the RWKV model, characterized in that, The railway passenger ticket station-level safety operation and maintenance method based on the RWKV model, as described in any one of claims 1 to 6, comprises: The data acquisition layer is used to collect multi-source heterogeneous time-series data from the station-level ticketing system; the ticket terminal equipment includes self-service ticket vending machines and ticket gates; the multi-source heterogeneous time-series data includes hardware sensor data, operation log data, and network communication data. The RWKV model inference layer, deployed on the station edge server, includes a pre-trained RWKV model for real-time inference of pre-processed data, outputting fault probability and risk warnings. The construction of the RWKV model includes the following steps: dynamically adjusting the weights of historical information using a time decay factor to enhance the memory of key events in the long term of the equipment; and using a multivariate attention mechanism to assign dynamic weights to different equipment parameters in the multi-source heterogeneous time-series data. The security operation and maintenance service layer provides functions such as equipment status monitoring, intelligent fault diagnosis, security incident handling, and operation and maintenance resource scheduling. It is used to drive the closed-loop operation and maintenance process based on the output results of the RWKV model inference layer. The human-computer interaction layer is used to display early warning information, operation and maintenance work orders and statistical reports, and supports voice interaction with operation and maintenance personnel.

8. The railway passenger ticket station-level safety operation and maintenance platform based on the RWKV model according to claim 7, wherein the data acquisition layer specifically includes: The equipment status monitoring module is used to collect operating parameters of ticket vending terminals and ticket gates; The environmental monitoring module is used to monitor the operating environment of the equipment through temperature and humidity sensors and smoke sensors; The network probe module is used to collect network traffic, port access records, and abnormal login logs; The data preprocessing module is used to clean, transform, integrate, and reduce the collected multi-source heterogeneous data to form standardized input feature vectors.

9. The railway passenger ticket station-level safety operation and maintenance platform based on the RWKV model according to claim 8, wherein the RWKV model inference layer specifically includes: The model training module is used to train the RWKV model using historical device time-series data and Focal Loss as the loss function. The real-time inference engine is used to input the preprocessed feature vectors into the trained RWKV model, capture temporal dependencies through the temporal fusion module, and perform cross-feature correlation analysis through the channel fusion module to output the device health status score and failure probability. The RWKV model inference layer also integrates a multi-model fusion module, which is used to receive the output results of the RWKV sub-model, the machine learning sub-model based on SVM and random forest, and the deep learning sub-model based on LSTM-CNN.

Images