Cross-domain real-time data analysis system and method for technical reconnaissance terminal

Abstract

This invention discloses a cross-domain real-time data analysis system and method for technical investigation terminals. The invention relates to the field of data processing technology and includes a protocol adaptation module, a standard processing module, an index association module, and a result display module. The protocol adaptation module integrates a dual-source high-precision time-series synchronization mechanism, constructs a protocol-time-series deviation threshold mapping table, and calibrates time-series deviations in real time. The standard processing module generates time-series-attribute dual-label standardized data through sliding window sorting, multi-dimensional standardization, and time-series-attribute dual binding. The index association module constructs a dynamic granular time-series hierarchical index and a time-series-spatiotemporal dual-dimensional association engine. The result display module synchronizes structured results to a visualization module and supports multi-dimensional retrieval and linked display. This invention achieves unified and efficient cross-domain data time-series association, improving the efficiency of technical investigation case analysis.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a cross-domain real-time data analysis system and method for technical reconnaissance terminals. Background Technology

[0002] In technical investigation work, cross-domain real-time data analysis is a core component supporting case judgment. It requires integrating data from the public security, communications, and network domains and mining related clues. However, existing cross-domain real-time data analysis technologies for technical investigation terminals have the following shortcomings:

[0003] Firstly, multi-domain data sources often use independent time bases and rely on a single network time protocol for synchronization, which is susceptible to network latency and jitter, resulting in large time sequence deviations between different domains and making it impossible to guarantee the consistency of data timestamps.

[0004] Secondly, existing technologies lack unified standards for field semantics and spatiotemporal benchmarks of multi-domain data. Synonymous fields in different domains are prone to semantic ambiguity, and the spatial coordinates and time benchmarks are not unified, making it difficult to use them directly for cross-domain association.

[0005] Third, existing indexes mostly adopt a fixed granularity design, which cannot adapt to the differences in update frequency of multi-domain data. High-frequency data is prone to insufficient query accuracy due to coarse granularity, while low-frequency data is prone to waste of resources due to fine granularity. In addition, association analysis mostly focuses on a single dimension and lacks time-series-spatiotemporal dual-dimensional verification.

[0006] Therefore, there is an urgent need for a cross-domain real-time data analysis system and method for technical reconnaissance terminals. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides a cross-domain real-time data analysis system and method for technical reconnaissance terminals, which solves the problems of inaccurate cross-domain timing, inconsistent data, and inefficient indexing.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a cross-domain real-time data analysis system for technical reconnaissance terminals, comprising:

[0009] The protocol adaptation module integrates a dual-source high-precision timing synchronization mechanism to generate a globally unified timing stamp in the protocol adaptation interface for public security, communication, and network multi-domain data. It also presets a protocol-timing deviation threshold mapping table to calibrate real-time monitoring data whose timing deviation exceeds the deviation threshold. The adaptation interface is a dedicated adaptation module for accessing public security video streams, communication signaling, and network logs.

[0010] The standard processing module uses a sliding window to allocate multi-domain raw data with a globally unified time stamp. If the window is full or times out, the time stamp comparator algorithm is called to perform sorting, generate a time-ordered data queue, and perform two-dimensional standardization to generate basic standardized data. The basic standardized data is then bound to time-series and attribute-labeled standardized data.

[0011] The index association module constructs a dynamic granular time-series hierarchical index and a time-series-spatiotemporal dual-dimensional association engine based on time-series-attribute dual-label standardized data.

[0012] In the results display module, after the association engine receives the association task, it first loads the target template, then filters out the trigger and response data sets based on the three-element constraints of the template, filters the two sets based on spatiotemporal coordinates and performs bidirectional uniqueness verification, and outputs the verified data pairs in a structured format.

[0013] As a further aspect of the present invention, the specific steps for generating a globally unified time stamp by integrating a dual-source high-precision timing synchronization mechanism are as follows:

[0014] During the protocol adaptation interface startup phase, a periodic synchronization connection is established with the time server of multiple data sources in public security, communications, and networks through NTPv4, and the reference timestamp of each data source is obtained in real time.

[0015] A GPS and BeiDou dual-mode timing module is deployed on the interface side as a local hardware clock source. The interface time synchronized with NTPv4 is compared with the hardware reference time. If the deviation between the two is greater than the preset compensation threshold, a dynamic compensation mechanism is immediately triggered: the timestamp to be output by the interface is corrected by a linear interpolation algorithm.

[0016] For each multi-domain data that has been calibrated in the first two steps, a globally unified time stamp is generated in a fixed format of "standard UTC time + domain type identifier + device unique code".

[0017] As a further aspect of the present invention, the specific operation for calibrating real-time monitoring data where the timing deviation exceeds the deviation threshold is as follows:

[0018] The time difference D between the current data calibration timestamp and the data source reference timestamp is calculated using the absolute deviation algorithm.

[0019] Compare D with the specific threshold corresponding to the protocol in the protocol-timing deviation threshold mapping table, and determine whether the calibration triggering preconditions are met: if D > threshold once, record the deviation log; if D > threshold N times consecutively, it is determined that the timing deviation exceeds the standard, and calibration is started.

[0020] The specific calibration process is as follows:

[0021] Calculate the average value Davg of N consecutive time series deviations. If the threshold < Davg ≤ twice the threshold, only NTPv4 resynchronization needs to be started, that is, the interface re-establishes a synchronization connection with the data source time server of this protocol and re-aligns the reference time.

[0022] If Davg > twice the threshold, the dual-source high-precision timing synchronization mechanism needs to be activated. That is, on the basis of NTPv4 synchronization, the local GPS and Beidou dual-mode timing module is called to regenerate the local hardware reference time and the timestamp of the link data is calibrated a second time.

[0023] After calibration, the calibration time, deviation before exceeding the limit, deviation after calibration, and calibration method are automatically recorded in the log. At the same time, the deviation of the link is continuously monitored until Davg ≤ the threshold.

[0024] As a further aspect of the present invention, the specific steps for performing two-dimensional standardization on a time-ordered data queue are as follows:

[0025] Call the preset multi-domain field mapping dictionary to unify synonymous fields in different domains into standard field names;

[0026] Convert the spatial information in the data to the WGS84 coordinate system.

[0027] Generate basic standardized data, with each data entry containing "standard fields + unified spatiotemporal information + original time stamp".

[0028] As a further aspect of the present invention, the specific operation of binding basic standardized data with time-series attributes is as follows:

[0029] Based on the start time stamp T_start and the end time stamp T_end, a time series interval is generated in the format of "[T_start,T_end]+data type", and all data within the time series interval is bound.

[0030] Call the multi-domain data attribute dictionary to label the sensitivity level and domain type for each data entry;

[0031] The final output is standardized data with time-series and attribute dual labels. Each data entry contains "standard fields + unified spatiotemporal information + time series interval + sensitivity level + domain type".

[0032] As a further aspect of the present invention, the specific operation for constructing a dynamic granularity time-series hierarchical index is as follows:

[0033] Start a time slice cumulative statistics thread, divide the timeline into independent time slices of fixed length, each time slice lasting H, with no overlap between time slices;

[0034] For the obtained time-series-attribute dual-label standardized data, the number of data updates in each time slice is accumulated according to the domain type. The average value of the accumulated number of K consecutive time slices is taken as Havg, and a preset frequency-granularity mapping table is loaded. The system automatically allocates granularity according to the calculated H.

[0035] The specific correspondence of the frequency-granularity mapping table is as follows: if Havg≥H0, then fine-grained G1 is matched; if Havg<H0, then coarse-grained G2 is matched, where H0 is the number threshold.

[0036] Based on the allocated temporal granularity, the temporal intervals [T_start, T_end] of each domain data are divided into hierarchical units: the continuous temporal axis is divided into multiple temporal hierarchical units with granularity as the basic unit. The temporal interval of each data must fall completely into a certain unit. If it crosses units, it is split into multiple sub-data and assigned to the corresponding units respectively.

[0037] Each index node contains a time-series hierarchical identifier, spatiotemporal coordinates, and data attribute labels, and is stored in partitions according to domain type-granularity. The time-series hierarchical identifier includes granularity and unit range, the spatiotemporal coordinates are standardized WGS84 coordinates, and the data attribute labels include sensitivity level and domain type.

[0038] Start the frequency trend monitoring thread and calculate the frequency trend value of each domain data according to the period H': calculate the slope of the trend line as KF by linearly fitting the update times of K' consecutive time slices. If |KF|≥ preset trend threshold Kth, then trigger granularity adjustment.

[0039] As a further aspect of the present invention, the specific rules for particle size adjustment are as follows:

[0040] If KF≥Kth, upgrade the original granularity G to a finer G', i.e. G'<G, and split the original layered unit into the finer unit corresponding to G', and update the index node identifier;

[0041] If KF≤-Kth, the original granularity G is downgraded to a coarser G'', i.e. G''>G, adjacent G units are merged into G'' units, and redundant nodes are deleted;

[0042] Among them, G' and G'' are the upgraded granularity, and both need to be set according to the actual situation.

[0043] As a further aspect of the present invention, the specific steps for constructing a time-series-spatiotemporal dual-dimensional correlation engine are as follows:

[0044] Establish a configurable association rule template library with "unique identifier + scene name + three-element constraints". Each template corresponds to a type of core technical investigation related scene. The three-element constraints include time-series dependency conditions, spatiotemporal constraints, and data attribute constraints.

[0045] The timing dependency conditions include the trigger data timing range and the response data timing range:

[0046] The timing range of the trigger data is [T_trigger_start, T_trigger_end], and the timing range of the response data is [T_trigger_end, T_trigger_end + ΔT_max]. At the same time, the response data must be generated after the trigger data timing range ends and within a time not exceeding ΔT_max, where ΔT_max is the preset maximum timing interval threshold.

[0047] The spatiotemporal constraints include distance constraints and region constraints:

[0048] Distance constraint: Obtain the spatial coordinates (X_trigger, Y_trigger) of the trigger data and the spatial coordinates (X_response, Y_response) of the response data. Calculate the actual spherical distance D ≤ D_max between the two coordinates using the Haversine algorithm, where D_max is the preset maximum spatial distance threshold.

[0049] Regional constraints: Both spatial coordinates must fall within the coordinate range of a preset geographical region, where the boundary coordinates of the geographical region must be defined in advance.

[0050] Data attribute constraints, including domain type, business scenario identifier, and sensitivity level:

[0051] The domain type of the triggering data must be exactly the same as the template's preset value.

[0052] The business scenario identifier that triggers the data must be completely consistent with the template's preset value.

[0053] Sensitivity level: The sensitivity level of the trigger data and response data is greater than or equal to the template's preset minimum sensitivity level Lmin.

[0054] As a further aspect of the present invention, the specific steps for filtering two sets based on spatiotemporal coordinates and performing bidirectional uniqueness verification are as follows:

[0055] Extract the standardized spatial coordinates (X_trigger, Y_trigger) of each data point in the trigger data set, and pair them with the coordinates (X_response, Y_response) of each data point in the response data set to form trigger-response data pairs;

[0056] Filtering is performed based on the spatiotemporal constraint type enabled by the template. If distance constraint is enabled, the Haversine algorithm is called to calculate the spherical distance D for each pair of data, and data pairs with D≤Dmax are retained. If regional constraint is enabled, any data pair that is not within the preset geographic region coordinate range is removed.

[0057] Perform bidirectional uniqueness verification: For forward verification, ensure that one trigger data corresponds to a maximum of Rth response data, where Rth is the preset maximum number of associations; for reverse verification, ensure that one response data corresponds to only one trigger data; if the limit is exceeded, only the data pair with the smallest time interval and shortest spatial distance will be retained.

[0058] Cross-domain real-time data analysis methods for technical reconnaissance terminals include:

[0059] S1. In the protocol adaptation interface for public security, communication, and network multi-domain data, a dual-source high-precision timing synchronization mechanism is integrated to generate a globally unified timing stamp, and a protocol-timing deviation threshold mapping table is preset to calibrate real-time monitoring data whose timing deviation exceeds the deviation threshold. The adaptation interface is a dedicated adaptation module for accessing public security video streams, communication signaling, and network logs.

[0060] S2. Use a sliding window to allocate multi-domain raw data with a globally unified time stamp. If the window is full or times out, call the time stamp comparator algorithm to sort the data, generate a time-ordered data queue, and perform two-dimensional standardization on the data to generate basic standardized data. Bind the basic standardized data to time-series and attributes to obtain time-series and attribute dual-label standardized data.

[0061] S3. Based on time-series and attribute-labeled standardized data, construct a dynamic granular time-series hierarchical index and a time-series-spatiotemporal dual-dimensional association engine;

[0062] S4. After receiving the association task, the association engine first loads the target template, then filters out the trigger and response data sets based on the three-element constraints of the template, filters the two sets based on spatiotemporal coordinates and performs bidirectional uniqueness verification, and outputs the verified data pairs in a structured format according to a fixed format.

[0063] This invention provides a cross-domain real-time data analysis system and method for technical reconnaissance terminals, which has the following advantages compared with the prior art:

[0064] (1) This invention effectively solves the problem of large cross-domain time sequence deviation in existing technologies by using a dual-source high-precision time sequence synchronization mechanism in conjunction with a protocol-time sequence deviation threshold mapping table. The NTPv4 and GPS-BeiDou dual-mode time synchronization coordination ensures the consistency of timestamps for multi-domain data, the dynamic calibration mechanism avoids the impact of network fluctuations, and the deviation mapping table controls the accuracy according to protocol differences, ensuring the consistency of cross-domain data time sequence and providing a reliable time reference for subsequent correlation analysis;

[0065] (2) This invention relies on sliding window sorting, multi-dimensional standardization and dynamic granular time-series hierarchical indexing to solve the existing problems of data silos and index inefficiency. Standardized processing unifies the semantics and spatiotemporal benchmarks of multi-domain data fields, eliminates semantic ambiguity and incomparability, and dynamic indexing adapts to differences in data update frequency, avoiding resource waste or insufficient precision at fixed granularity and improving data retrieval efficiency.

[0066] (3) This invention solves the problems of single correlation dimension and poor result adaptation in existing correlation systems by using a time-series-spatiotemporal dual-dimensional correlation engine and a visualization module. The correlation engine, combined with configurable rule templates, achieves accurate correlation, and two-way verification ensures the accuracy of clues. The visualization module supports multi-dimensional retrieval and time-series-spatial linkage display, intuitively presenting the correlation logic and location information, reducing the time for technical investigators to organize clues, and significantly improving the efficiency of case analysis. Attached Figure Description

[0067] Figure 1 This is the system principle block diagram of the present invention;

[0068] Figure 2 A flowchart illustrating the steps involved in constructing a dynamic granular temporal hierarchical index for this invention;

[0069] Figure 3 This is a flowchart of the steps of the present invention. Detailed Implementation

[0070] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0071] Example 1

[0072] like Figure 1 This application provides a cross-domain real-time data analysis system for technical reconnaissance terminals, including:

[0073] The protocol adaptation module integrates a dual-source high-precision timing synchronization mechanism in the protocol adaptation interface for public security, communications, and network multi-domain data (i.e., a dedicated adaptation module for accessing public security video streams, communication signaling, and network logs).

[0074] The specific implementation steps of the dual-source high-precision timing synchronization mechanism are as follows:

[0075] During the protocol adaptation interface startup phase, a periodic synchronization connection is established with the time servers of multiple data sources in public security, communications, and networks through NTPv4 (Network Time Protocol version 4). The synchronization period is set to a preset short period T1, and the reference timestamps of each data source are obtained in real time.

[0076] The interface side uses time difference calculation algorithms, such as Kalman filtering, to continuously correct the deviation between the local clock and the clocks of each data source, ensuring that the time error between the interface clock and the public security video stream server, communication signaling gateway, and network log collector is always ≤ the preset initial error threshold E1.

[0077] The core reason for choosing NTPv4 is that it supports millisecond-level time synchronization accuracy and is compatible with time systems in different domains such as public security and communications. Since different domain data sources may use independent time bases, using NTPv4 can achieve the unification of time bases in multiple domains.

[0078] A GPS-BeiDou dual-mode timing module (as a local hardware clock source) is deployed on the interface side. This module receives satellite timing signals in real time and generates a local hardware reference time. The interface compares the interface time synchronized with NTPv4 with the hardware reference time at a preset short interval T2. If the deviation between the two is greater than the preset compensation threshold E2, a dynamic compensation mechanism is immediately triggered: the timestamp to be output by the interface is corrected by a linear interpolation algorithm to ensure that the timestamp of each access data simultaneously integrates the dual calibration results of NTPv4 network time and hardware clock.

[0079] The introduction of the GPS-BeiDou dual-mode timing module is mainly to make up for the limitations of NTPv4. Because NTPv4 relies on network transmission, the time synchronization accuracy may fluctuate due to network latency and jitter. In contrast, the hardware clock does not rely on the network and can provide a stable and continuous local time reference, ensuring that the timing accuracy is not affected by the network environment.

[0080] For each multi-domain data that has been calibrated in the first two steps, a globally unified time stamp is generated in a fixed format of "standard UTC time + domain type identifier + device unique code";

[0081] For example, the timestamp of public security video stream data is UTC-TIME_GA_DEVICE-X, where UTC-TIME is standard UTC time, GA represents the public security domain, and DEVICE-X is the unique code of the video camera; the timestamp of communication signaling data is UTC-TIME_TEL_DEVICE-Y, where TEL represents the communication domain, and DEVICE-Y is the unique code of the terminal device; the timestamp of network log data is UTC-TIME_NET_DEVICE-Z, where NET represents the network domain, and DEVICE-Z is the unique code of the log collection device.

[0082] At the same time, a protocol-timing deviation threshold mapping table is designed, and the timing deviation of the access data is monitored in real time. If the timing deviation exceeds the deviation threshold, recalibration is automatically triggered. The specific operation steps are as follows:

[0083] When the system starts, it automatically loads the preset protocol-timing deviation threshold mapping table and associates each type of protocol in the mapping table with the corresponding access data link to ensure that the system clearly knows "which type of protocol data is transmitted on a certain data link and which deviation threshold should be applied";

[0084] The protocol-timing deviation threshold mapping table contains three core fields: protocol type (e.g., NetFlow of the network), protocol-specific timing deviation threshold (e.g., threshold Q1 for protocol A, threshold Q2 for protocol B, and Q1 < Q2), and calibration trigger precondition. The calibration trigger precondition is triggered only after N consecutive monitoring exceed the threshold, and N needs to be set according to the actual situation.

[0085] For each data link with a bound protocol, the time-series deviation of the data for that link is calculated in real time using a deviation calculation model according to a preset monitoring period T. The specific operation steps are as follows:

[0086] Extract the dual-source calibrated timestamp and the data source baseline timestamp of the current data in the link;

[0087] The difference between the two is calculated using the absolute deviation algorithm to obtain the current timing deviation D;

[0088] Compare D with the protocol’s specific threshold in the mapping table, and determine whether the calibration triggering preconditions are met: if D > threshold once, record the deviation log; if D > threshold N times consecutively, it is determined that the timing deviation exceeds the standard and triggers the next step of recalibration.

[0089] In multi-domain data transmission, momentary network jitter may cause a single deviation to exceed the limit. If calibration is triggered directly, it will increase the consumption of system resources. If the deviation exceeds the limit N times in a row, it means that the deviation is a persistent problem and needs to be dealt with in time.

[0090] Calculate the average value Davg of N consecutive timing deviations and trigger a graded recalibration. The specific process is as follows:

[0091] If the threshold < Davg ≤ twice the threshold, it indicates a slight exceedance. Only NTPv4 resynchronization needs to be initiated (to quickly correct the deviation caused by the network). That is, the interface re-establishes a synchronization connection with the data source time server of this protocol and re-aligns the reference time.

[0092] Mild exceedances are mostly network-level issues, such as an excessively long NTP synchronization cycle, which can be quickly resolved by simply resynchronizing with NTPv4 without using hardware resources.

[0093] If Davg > twice the threshold, it indicates severe over-limit and the dual-source high-precision time synchronization mechanism needs to be activated. That is, on the basis of NTPv4 synchronization, the local GPS Beidou dual-mode time synchronization module is called to regenerate the local hardware reference time and the timestamp of the link data is calibrated a second time.

[0094] Severe exceedances may be related to hardware clock drift, such as temporary weak GPS module signal, which requires joint calibration to resolve;

[0095] After calibration, the calibration time, deviation before exceeding the limit, deviation after calibration, and calibration method are automatically recorded in the log. At the same time, the deviation of the link is continuously monitored until Davg ≤ the threshold.

[0096] The standard processing module, based on the multi-domain raw data with a unified time stamp, standardizes it using a sliding window sorting method. The specific operation steps are as follows:

[0097] Configure the sliding window based on the update frequency of multi-domain data, such as the fast update frequency of public security video streams and the slow update frequency of network logs:

[0098] The window size is set to TT and can be dynamically adjusted according to the data domain. It is necessary to ensure that the window can cover the complete data segment within a single period.

[0099] The sliding step size is set to SS to avoid missing data, where SS≤TT;

[0100] Start the data access thread to allocate raw data from multiple domains, including public security, communications, and networks, to the corresponding windows according to domain type. For example, public security video streams are accessed through the "video window" and communication signaling is accessed through the "signaling window". Once the window is full or the preset time is reached, the next operation will be automatically triggered.

[0101] For window data that is full or has timed out, the time stamp comparator algorithm is called to perform sorting. The specific process is as follows:

[0102] Extract the global unified time stamp of each data entry in the window, and parse out the core time information, namely the standard UTC time.

[0103] Data is sorted in ascending order by standard UTC time, with earlier time series data first and later time series data last.

[0104] After sorting, a time-ordered data queue is generated, and the queue is marked with a start time stamp T_start and an end time stamp T_end.

[0105] Based on the generated globally unified timestamp, using a time stamp comparator for sorting can avoid the sorting logic confusion caused by the differences in multi-domain data formats. At the same time, the sorted data queue can ensure that subsequent standardization is performed in the order of data occurrence, solving the out-of-order problem of "early data not being processed and late data being processed first" caused by the existing random processing of standardized data.

[0106] For the obtained time-ordered data queue, perform two-dimensional standardization: ① Call the preset multi-domain field mapping dictionary, such as "Device ID" → "Device Identifier" for public security, "Terminal IMSI" → "Device Identifier" for communication, and "IP Address" → "Network Identifier" for network, to unify synonymous fields in different domains into standard field names and eliminate semantic ambiguity; ② Convert the spatial information in the data (such as the local coordinate system of public security video cameras and the custom coordinate system of communication base stations) into the WGS84 coordinate system; ③ Generate basic standardized data, each data entry containing "standard fields + unified spatiotemporal information + original time stamp";

[0107] Field mapping is mainly to break down semantic barriers between multi-domain data. For example, if the public security system uses "device ID" and the communications system uses "IMSI", the system cannot recognize that both refer to "device" during subsequent correlation analysis. After unifying the fields, they can be directly correlated. Spatiotemporal alignment solves the problem of incomparability of cross-domain data. For example, if the public security video shows a device in "coordinate system A (X1,Y1)" and the communications signaling shows that the device is in "coordinate system B (X2,Y2)", it can only be determined whether they are in the same location after unifying them to WGS84.

[0108] For basic standardized data, perform time-series-attribute dual binding. The specific process is as follows:

[0109] Based on the start time stamp T_start and the end time stamp T_end, a time interval is generated in the format of "[T_start,T_end]+data type" and all data within the time interval is bound, such as [80,100]_SIGNAL representing the time segment of signaling data;

[0110] Call the multi-domain data attribute dictionary to label each piece of data with its sensitivity level (e.g., public security video is highly sensitive L3, network logs are medium sensitive L2) and domain type (e.g., GA=public security, TEL=communication, NET=network).

[0111] The final output is standardized data with time-series and attribute dual labels. Each data entry contains "standard fields + unified spatiotemporal information + time series interval + sensitivity level + domain type".

[0112] The index association module constructs a dynamic granular time-series hierarchical index based on time-series and attribute-labeled standardized data.

[0113] After completing the dynamic granularity time-series hierarchical index, we will continue to build a time-series-spatiotemporal dual-dimensional correlation engine. The specific steps are as follows:

[0114] Establish a configurable association rule template library of "unique identifier + scene name + three-element constraint". Each template corresponds to a type of core technical investigation related scene. The three-element constraint includes temporal dependency condition, spatiotemporal constraint condition, and data attribute constraint.

[0115] Timing dependency conditions, including the timing range of triggering data and the timing range of response data:

[0116] Data timing range: Define the time interval for triggering data as [T_trigger_start, T_trigger_end];

[0117] The response data timing range is defined as follows: the response data timing T_response≥T_trigger_end and T_response≤T_trigger_end+ΔT_max. At the same time, the response data must be generated after the trigger data timing range ends and within a time not exceeding ΔT_max, where ΔT_max is the preset maximum timing interval threshold.

[0118] Spatiotemporal constraints, including distance constraints and region constraints:

[0119] Distance constraint: Obtain the spatial coordinates (X_trigger, Y_trigger) of the trigger data and the spatial coordinates (X_response, Y_response) of the response data. The actual spherical distance D ≤ D_max is calculated by the Haversine algorithm, where D_max is the preset maximum spatial distance threshold.

[0120] Regional constraints are used to constrain the spatial coordinates of trigger data and response data. Both must fall within the coordinate range of a preset geographic region, where the boundary coordinates of the geographic region must be defined in advance.

[0121] Data attribute constraints, including domain type, business scenario identifier, and sensitivity level:

[0122] The domain type of the triggering data must be exactly the same as the template's preset value.

[0123] The business scenario identifier must be completely consistent with the template preset value, such as DEVICE_ACTIVATE for device activation and PERSON_CALL for personnel communication.

[0124] Sensitivity level: The sensitivity level of the trigger data and response data must be greater than or equal to the minimum sensitivity level Lmin preset by the template.

[0125] In the results display module, after the association engine receives the association task, it first loads the target template and extracts the clear filtering criteria for trigger data and response data from the three elements of the template: time series range, domain type, business scenario identifier, and sensitivity level.

[0126] The specific operation process for filtering out the trigger or response data set is as follows:

[0127] From the dynamic granular time-series hierarchical index, locate the domain type partition, and then enter the sub-partition identified by the business scenario under that partition;

[0128] Within this sub-partition, traverse all time-series hierarchical units with a sensitivity level ≥ Lmin, and determine whether the time-series interval of each hierarchical unit overlaps with the time-series interval defined in the template. If there is an overlap, it means that the unit contains trigger data.

[0129] Extract the raw data from all overlapping hierarchical units to form a trigger or response data set;

[0130] For example, the trigger timing range of template REL-TPL-001 is [T_trigger_start=90,T_trigger_end=110], and the response timing range is [110,110+C2=140]. The trigger data is filtered as follows: First, the sub-partition of the index "TEL-DEVICE_ACTIVATE" is entered, and the hierarchical units with a sensitivity level ≥2 are [G1_80,G1_100] (timing interval 80-100) and [G1_100,G1_120] (timing interval 100-120). The former overlaps with [90,110], and the latter also overlaps. Therefore, the data from these two units can be extracted to form the trigger data set.

[0131] After obtaining the trigger data set and response data set, precise filtering is performed based on spatiotemporal coordinates. The specific steps are as follows:

[0132] Extract the standardized spatial coordinates (X_trigger, Y_trigger) of each data point in the trigger data set, and pair them with the coordinates (X_response, Y_response) of each data point in the response data set to form trigger-response data pairs;

[0133] Filtering is performed based on the spatiotemporal constraint type enabled by the template. If distance constraints are enabled, the Haversine algorithm is called to calculate the spherical distance D for each pair of data. Data pairs with D ≤ Dmax are retained, and data that do not meet the requirements are removed.

[0134] If regional constraints are enabled, the trigger data coordinates and response data coordinates are verified separately to determine whether both fall within the coordinate range of the preset geographic region, and data pairs that do not meet the requirements are removed.

[0135] After filtering by spatiotemporal constraints, a temporal-spatial dual-matching candidate set is generated, and bidirectional uniqueness verification is performed:

[0136] For positive verification, ensure that one trigger data corresponds to a maximum of Rth response data, where Rth is the preset maximum number of associations, which can be configured according to the actual situation;

[0137] For reverse verification, ensure that one response data corresponds to only one trigger data;

[0138] If the limit is exceeded, only the data pairs with the smallest time interval and the shortest spatial distance will be retained;

[0139] For data pairs that pass verification, output them in a structured format according to the following fixed format: "Template Unique Identifier + Associated Data Pair ID + Triggering Data Meta Information + Response Data Meta Information + Two-Dimensional Matching Result".

[0140] A unique template identifier, such as REL-TPL-001;

[0141] Associated data pairs are uniquely encoded, such as REL-PAIR-001-001;

[0142] Triggering data metadata includes domain type, business scenario marker, time series range, spatial coordinates, and sensitivity level;

[0143] Response data metadata, including domain type, business scenario marker, time series range, spatial coordinates, and sensitivity level;

[0144] The two-dimensional matching results include temporal interval, spatial distance, and whether the constraints are met.

[0145] The structured results are synchronized to the visualization module of the technical investigation terminal, which supports searching by template identifier, associated ID, and time range. The visualization interface displays the association chain from trigger to response on a time axis and marks the corresponding coordinates on the map.

[0146] Example 2

[0147] This embodiment further discloses a method for constructing a dynamic granular temporal hierarchical index based on embodiment 1, such as... Figure 2 As shown, the specific content includes:

[0148] The time-slice cumulative statistics thread is started, and the time axis is divided into independent time slices of fixed length. Each time slice has a duration of H and there is no overlap between time slices. For the obtained time-series-attribute dual-label standardized data, the number of data updates in each time slice is accumulated according to the domain type. The average value of the accumulated counts of K consecutive time slices is taken as Havg. The preset frequency-granularity mapping table is loaded, and the system automatically allocates granularity according to the calculated H. The value of K can be dynamically adjusted according to the data stability. K is increased when the data fluctuation is large and decreased when the fluctuation is small.

[0149] The specific correspondence of the frequency-granularity mapping table is as follows: if Havg≥H0, then fine-grained G1 is matched; if Havg<H0, then coarse-grained G2 is matched. Here, H0 is the number threshold, which needs to be set according to the actual situation.

[0150] For example, if time slice H is 10 units of time, where K is 3, and the communication domain updates 15, 18, and 17 times respectively within 3 time slices, then Havg = (15 + 18 + 17) / 3 = 16 times / time slice; and the network domain updates 3, 4, and 2 times respectively within 3 time slices, then Havg = (3 + 4 + 2) / 3 = 3 times / time slice. If H0 = 10 times / time slice, the communication domain is allocated fine-grained G1 because Havg > H0, and the network domain is allocated coarse-grained G2 because Havg < H0.

[0151] Based on the allocated temporal granularity, the temporal intervals of each domain data, i.e. [T_start, T_end], are divided into hierarchical units: with granularity G as the basic unit, the continuous temporal axis is divided into multiple temporal hierarchical units, such as G1 corresponding to units [H0, H0+G1) and [H0+G1, H0+2G1), and G2 corresponding to units [H0, H0+G2) and [H0+G2, H0+2G2). The temporal interval of each data must fall completely within a certain unit. If it crosses units, it is split into multiple sub-data and assigned to the corresponding units respectively.

[0152] The reason for dividing the data into units by granularity and requiring that all data fall into the unit is to ensure the accurate correspondence between index nodes and data time sequence, and to avoid query ambiguity caused by one piece of data corresponding to multiple index nodes.

[0153] Each index node contains a time-series hierarchical identifier (format: granularity + cell range, such as G1_H0+G1-H0+2G1), spatiotemporal coordinates (normalized WGS84 coordinates (X,Y)), and data attribute labels (sensitivity level + domain type, such as L3_GA), and is stored in partitions according to domain type-granularity. For example, the index node of the public security domain G1 is stored in the "GA-G1" partition, and the index node of the network domain G2 is stored in the "NET-G2" partition.

[0154] Index nodes contain three elements: time sequence, spatiotemporal, and attribute. In subsequent queries, you can directly filter by node without traversing the original data, which greatly improves query efficiency.

[0155] Start the frequency trend monitoring thread and calculate the frequency trend value of each domain data according to the period H' (shorter than the time slice duration H): calculate the slope of the trend line KF by linearly fitting the update times of K' consecutive time slices. If |KF|≥ preset trend threshold Kth, where KF≥Kth indicates that the frequency is continuously increasing and KF≤-Kth indicates that the frequency is continuously decreasing, then trigger granularity adjustment.

[0156] The specific rules for granularity adjustment are as follows:

[0157] When the frequency continues to increase (KF≥Kth), the original granularity G is upgraded to a finer G', i.e. G'<G, and the original layered unit is split into finer units corresponding to G', and the index node identifier is updated. When the frequency continues to decrease (KF≤-Kth), the original granularity G is downgraded to a coarser G'', i.e. G''>G, adjacent G units are merged into G'' units, and redundant nodes are deleted. Here, G' and G'' are the upgraded granularity, and both need to be set according to the actual situation.

[0158] Since data activity is constantly changing, the granularity is dynamically adjusted to adapt to its changing characteristics: for high-frequency data, fine granularity is used to ensure query accuracy, and for low-frequency data, coarse granularity is used to reduce storage consumption, thus solving the problem of efficiency degradation when the fixed granularity changes with data frequency.

[0159] Example 3

[0160] like Figure 3 Cross-domain real-time data analysis methods for technical reconnaissance terminals include:

[0161] S1. In the protocol adaptation interface for public security, communication, and network multi-domain data, a dual-source high-precision timing synchronization mechanism is integrated to generate a globally unified timing stamp, and a protocol-timing deviation threshold mapping table is preset to calibrate real-time monitoring data whose timing deviation exceeds the deviation threshold. The adaptation interface is a dedicated adaptation module for accessing public security video streams, communication signaling, and network logs.

[0162] S2. Use a sliding window to allocate multi-domain raw data with a globally unified time stamp. If the window is full or times out, call the time stamp comparator algorithm to sort the data, generate a time-ordered data queue, and perform two-dimensional standardization on the data to generate basic standardized data. Bind the basic standardized data to time-series and attributes to obtain time-series and attribute dual-label standardized data.

[0163] S3. Based on time-series and attribute-labeled standardized data, construct a dynamic granular time-series hierarchical index and a time-series-spatiotemporal dual-dimensional association engine;

[0164] S4. After receiving the association task, the association engine first loads the target template, then filters out the trigger and response data sets according to the three-element constraints of the template. It filters the two sets based on spatiotemporal coordinates and performs bidirectional uniqueness verification. The data pairs that pass the verification are output in a structured format and the structured results are synchronized to the technical investigation terminal visualization module. It supports searching by template identifier, association ID, and time range. The visualization interface displays the association chain from trigger to response on the time axis and marks the corresponding coordinate positions on the map.

[0165] Some of the data in the above formulas are numerical calculations with dimensions removed, and the contents not described in detail in this specification are all prior art known to those skilled in the art.

[0166] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A cross-domain real-time data analysis system for technical reconnaissance terminals, characterized in that, include: The protocol adaptation module integrates a dual-source high-precision timing synchronization mechanism to generate a globally unified timing stamp in the protocol adaptation interface for public security, communication, and network multi-domain data. It also presets a protocol-timing deviation threshold mapping table to calibrate real-time monitoring data whose timing deviation exceeds the deviation threshold. The adaptation interface is a dedicated adaptation module for accessing public security video streams, communication signaling, and network logs. The standard processing module uses a sliding window to allocate multi-domain raw data with a globally unified time stamp. If the window is full or times out, the time stamp comparator algorithm is called to perform sorting, generate a time-ordered data queue, and perform two-dimensional standardization to generate basic standardized data. The basic standardized data is then bound to time-series and attribute-labeled standardized data. The index association module constructs a dynamic granularity time-series hierarchical index and a time-series-spatiotemporal dual-dimensional association engine based on time-series-attribute dual-label standardized data. The specific operations for constructing the dynamic granularity time-series hierarchical index are as follows: A time-slice cumulative statistics thread is started, dividing the time axis into independent time slices of fixed length, each time slice having a duration of H, with no overlap between time slices; for the obtained time-series-attribute dual-label standardized data, the number of data updates within each time slice is accumulated according to domain type; the average value (Havg) of the accumulated counts for K consecutive time slices is taken, and a preset frequency-granularity mapping table is loaded. The system then calculates H... Automatically allocate granularity; based on the allocated temporal granularity, perform hierarchical partitioning of the temporal intervals [T_start, T_end] of each domain data: using granularity as the basic unit, divide the continuous temporal axis into multiple temporal hierarchical units. The temporal interval of each data point must fall completely within a certain unit. If it crosses units, it is split into multiple sub-data points and assigned to the corresponding units respectively; start the frequency trend monitoring thread and calculate the frequency trend value of each domain data according to the period H': calculate the slope of the trend line KF by linearly fitting the update times of K' consecutive time slices. If |KF|≥ preset trend threshold Kth, then trigger granularity adjustment; In the results display module, after the association engine receives the association task, it first loads the target template, then filters out the trigger and response data sets based on the three-element constraints of the template, filters the two sets based on spatiotemporal coordinates and performs bidirectional uniqueness verification, and outputs the verified data pairs in a structured format.

2. The cross-domain real-time data analysis system for technical investigation terminals according to claim 1, characterized in that, The specific steps for generating a globally unified time stamp using an integrated dual-source high-precision timing synchronization mechanism are as follows: During the protocol adaptation interface startup phase, a periodic synchronization connection is established with the time server of multiple data sources in public security, communications, and networks through NTPv4, and the reference timestamp of each data source is obtained in real time. A GPS and BeiDou dual-mode timing module is deployed on the interface side as a local hardware clock source. The interface time synchronized with NTPv4 is compared with the hardware reference time. If the deviation between the two is greater than the preset compensation threshold, a dynamic compensation mechanism is immediately triggered: the timestamp to be output by the interface is corrected by a linear interpolation algorithm. For each multi-domain data that has been calibrated in the first two steps, a globally unified time stamp is generated in a fixed format of "standard UTC time + domain type identifier + device unique code".

3. The cross-domain real-time data analysis system for technical investigation terminals according to claim 1, characterized in that, The specific steps for calibrating real-time monitoring data whose timing deviation exceeds the deviation threshold are as follows: The time difference D between the current data calibration timestamp and the data source reference timestamp is calculated using the absolute deviation algorithm. Compare D with the specific threshold corresponding to the protocol in the protocol-timing deviation threshold mapping table, and determine whether the calibration triggering preconditions are met: if D > threshold once, record the deviation log; if D > threshold N times consecutively, it is determined that the timing deviation exceeds the standard, and calibration is started. The specific calibration process is as follows: Calculate the average value Davg of N consecutive time series deviations. If the threshold < Davg ≤ twice the threshold, only NTPv4 resynchronization needs to be started, that is, the interface re-establishes a synchronization connection with the data source time server of this protocol and re-aligns the reference time. If Davg > twice the threshold, the dual-source high-precision timing synchronization mechanism needs to be activated. That is, on the basis of NTPv4 synchronization, the local GPS and Beidou dual-mode timing module is called to regenerate the local hardware reference time, and the link data timestamp corresponding to each data link is calibrated a second time. After calibration, the calibration time, deviation before exceeding the limit, deviation after calibration, and calibration method are automatically recorded in the log, while Davg is continuously monitored until Davg ≤ the threshold.

4. The cross-domain real-time data analysis system for technical investigation terminals according to claim 1, characterized in that, The specific steps for performing two-dimensional standardization on a time-ordered data queue are as follows: Call the preset multi-domain field mapping dictionary to unify synonymous fields in different domains into standard field names; Convert the spatial information in the data to the WGS84 coordinate system. Generate basic standardized data, with each data entry containing "standard fields + unified spatiotemporal information + original time stamp".

5. The cross-domain real-time data analysis system for technical reconnaissance terminals according to claim 1, characterized in that, The specific steps for binding basic standardized data with time-series attributes are as follows: Based on the start time stamp T_start and the end time stamp T_end, a time series interval is generated in the format of "[T_start,T_end]+data type", and all data within the time series interval is bound. Call the multi-domain data attribute dictionary to label the sensitivity level and domain type for each data entry; The final output is time-series-attribute dual-label standardized data, with each data entry containing "standard fields + unified spatiotemporal information + time series interval + sensitivity level + domain type".

6. The cross-domain real-time data analysis system for technical reconnaissance terminals according to claim 1, characterized in that, The system includes: the specific correspondence of the frequency-granularity mapping table is as follows: if Havg≥H0, then fine-grained G1 is matched; if Havg<H0, then coarse-grained G2 is matched, where H0 is the frequency threshold; each index node contains a time-series layer identifier, spatiotemporal coordinates, and data attribute labels, and is stored in a partitioned manner according to domain type-granularity. The time-series layer identifier includes granularity and unit range, the spatiotemporal coordinates are standardized WGS84 coordinates, and the data attribute labels include sensitivity level and domain type.

7. The cross-domain real-time data analysis system for technical reconnaissance terminals according to claim 1, characterized in that, The specific rules for granularity adjustment are as follows: If KF≥Kth, upgrade the original granularity G to a finer G', i.e. G'<G, and split the original layered unit into the finer unit corresponding to G', and update the index node identifier; If KF≤-Kth, the original granularity G is downgraded to a coarser G'', i.e. G''>G, adjacent G units are merged into G'' units, and redundant nodes are deleted; Among them, G' and G'' are the upgraded granularity, and both need to be set according to the actual situation.

8. The cross-domain real-time data analysis system for technical reconnaissance terminals according to claim 1, characterized in that, The specific steps for building a time-series-spatiotemporal dual-dimensional correlation engine are as follows: Establish a configurable association rule template library with "unique identifier + scene name + three-element constraints". Each template corresponds to a type of core technical investigation related scene. The three-element constraints include time-series dependency conditions, spatiotemporal constraints, and data attribute constraints. The timing dependency conditions include the trigger data timing range and the response data timing range: The timing range of the trigger data is [T_trigger_start, T_trigger_end], and the timing range of the response data is [T_trigger_end, T_trigger_end + ΔT_max]. At the same time, the response data must be generated after the trigger data timing range ends and within a time not exceeding ΔT_max, where ΔT_max is the preset maximum timing interval threshold. The spatiotemporal constraints include distance constraints and region constraints: Distance constraint: Obtain the spatial coordinates (X_trigger, Y_trigger) of the trigger data and the spatial coordinates (X_response, Y_response) of the response data. Calculate the actual spherical distance D ≤ D_max between the two coordinates using the Haversine algorithm, where D_max is the preset maximum spatial distance threshold. Regional constraints: Both spatial coordinates must fall within the coordinate range of a preset geographical region, where the boundary coordinates of the geographical region must be defined in advance. Data attribute constraints, including domain type, business scenario identifier, and sensitivity level: The domain type of the triggering data must be exactly the same as the template's preset value. The business scenario identifier that triggers the data must be completely consistent with the template's preset value. Sensitivity level: The sensitivity level of the trigger data and response data is greater than or equal to the template's preset minimum sensitivity level Lmin.

9. The cross-domain real-time data analysis system for technical investigation terminals according to claim 1, characterized in that, The specific steps for filtering two sets and performing bidirectional uniqueness verification based on spatiotemporal coordinates are as follows: Extract the standardized spatial coordinates (X_trigger, Y_trigger) of each data point in the trigger data set, and pair them with the coordinates (X_response, Y_response) of each data point in the response data set to form trigger-response data pairs; Filtering is performed based on the spatiotemporal constraint type enabled by the template. If distance constraint is enabled, the Haversine algorithm is called to calculate the spherical distance D for each pair of data, and data pairs with D≤Dmax are retained. If regional constraint is enabled, any data pair that is not within the preset geographic region coordinate range is removed. Perform bidirectional uniqueness verification: For forward verification, ensure that one trigger data corresponds to a maximum of Rth response data, where Rth is the preset maximum number of associations; for reverse verification, ensure that one response data corresponds to only one trigger data; if the limit is exceeded, only the data pair with the smallest time interval and shortest spatial distance will be retained.

10. A cross-domain real-time data analysis method for technical reconnaissance terminals, used to execute the cross-domain real-time data analysis system for technical reconnaissance terminals as described in any one of claims 1-8, characterized in that, include: S1. In the protocol adaptation interface for public security, communication, and network multi-domain data, a dual-source high-precision timing synchronization mechanism is integrated to generate a globally unified timing stamp, and a protocol-timing deviation threshold mapping table is preset to calibrate real-time monitoring data whose timing deviation exceeds the deviation threshold. The adaptation interface is a dedicated adaptation module for accessing public security video streams, communication signaling, and network logs. S2. Use a sliding window to allocate multi-domain raw data with a globally unified time stamp. If the window is full or times out, call the time stamp comparator algorithm to sort the data, generate a time-ordered data queue, and perform two-dimensional standardization on the data to generate basic standardized data. Bind the basic standardized data to time-series and attributes to obtain time-series and attribute dual-label standardized data. S3. Based on the time-series-attribute dual-label standardized data, construct a dynamic granularity time-series hierarchical index and a time-series-spatiotemporal dual-dimensional association engine. The specific operation of constructing the dynamic granularity time-series hierarchical index is as follows: Start the time slice cumulative statistics thread, divide the time axis into independent time slices of fixed length, each time slice having a duration of H, with no overlap between time slices; for the obtained time-series-attribute dual-label standardized data, accumulate the number of data updates within each time slice according to the domain type, take the average value Havg of the cumulative counts for K consecutive time slices, and load the preset frequency-granularity mapping table. The system automatically... Granularity allocation; Based on the allocated temporal granularity, perform hierarchical partitioning on the temporal intervals [T_start, T_end] of each domain data: Using granularity as the basic unit, divide the continuous temporal axis into multiple temporal hierarchical units. The temporal interval of each data point must fall completely within a certain unit. If it crosses units, it is split into multiple sub-data points and assigned to the corresponding units respectively; Start the frequency trend monitoring thread and calculate the frequency trend value of each domain data according to the period H': Calculate the slope of the trend line KF by linearly fitting the update times of K' consecutive time slices. If |KF|≥ the preset trend threshold Kth, then trigger granularity adjustment; S4. After receiving the association task, the association engine first loads the target template, then filters out the trigger and response data sets based on the three-element constraints of the template, filters the two sets based on spatiotemporal coordinates and performs bidirectional uniqueness verification, and outputs the verified data pairs in a structured format according to a fixed format.

Images