Intelligent analysis and identification method for resident travel characteristics based on multi-source data fusion

Abstract

The application discloses a kind of based on multi-source data fusion's resident travel feature intelligent analysis and identification method, comprising: processing original multi-source event stream, obtains short window event sequence and event metadata table;Based on short window event sequence, infer transient mode conversion and intention switching, generate transient inference data;Estimate the time of arrival in satellite navigation-free area and perform door zone elastic alignment, generate spatio-temporal alignment data;Fusion transient inference data, spatio-temporal alignment data and event metadata table, construct similar keeping signature and apply signature domain differential privacy, obtain signature domain differential privacy signature and privacy budget account book;Perform federated security aggregation, output family similarity analysis result.The application realizes high availability similarity analysis under the premise of protecting user privacy by high-precision spatio-temporal alignment and signature domain privacy technology.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of traffic flow analysis, and in particular to a method for intelligent analysis and identification of resident travel characteristics based on multi-source data fusion. BACKGROUND

[0002] The daily travel behavior of residents is the micro foundation of the dynamic evolution of urban transportation systems. In-depth understanding and analysis of resident travel characteristics, especially for families as a unit, has important research significance and application value for optimizing public transportation resource allocation, developing fine urban planning strategies, and providing collaborative personal travel MaaS. By analyzing the similarity between family members in terms of travel mode selection, spatio-temporal path, transfer node, etc., decision support can be provided for traffic demand management, family package ticket design, and collaborative scheduling of shared travel tools.

[0003] Currently, the analysis of resident travel behavior has developed from traditional travel log surveys to the use of various urban big data for mining. For example, AFC (Automatic Fare Collection) data is used to extract passenger travel OD (Origin-Destination) and transfer information; GPS (Global Positioning System) trajectory data from vehicles or smartphones are used to identify travel purposes and transportation modes through map matching and machine learning models; or cellular network signaling data is used to estimate regional population flow. In terms of data fusion, some studies have attempted to associate AFC data with Wi-Fi probe data on a centralized server in order to build a more complete travel chain. In terms of privacy protection, existing technologies usually use data desensitization, k-anonymity, or aggregate statistics before data release.

[0004] However, there are still some problems when existing technologies attempt to fuse multi-source heterogeneous data (such as AFC, shared bicycle IoT, Wi-Fi probe, cellular network, etc.) for family member travel similarity analysis. These problems include the conflict between data utility and privacy protection, and the difficulty of accurate spatio-temporal alignment of multi-source data in complex scenarios.

[0005] Existing methods are difficult to accurately estimate the second-level time of train arrival and passenger exit based on sparse and asynchronous observations (such as inertia mode, cellular handover, and station passenger flow count). The lack of spatio-temporal reference and uncertainty can lead to significant errors in subsequent elastic registration (such as aligning Wi-Fi passenger flow peaks with train door opening times), especially error accumulation, which can incorrectly associate or miss real cross-source events (such as exit and unlocking of a shared bicycle), and excessive errors can make similarity analysis relying on accurate timing unreliable.

[0006] In addition, in order to perform accurate similarity calculation, fine-grained event co-occurrence, sequence and repetition patterns across multiple data sources need to be captured, which often requires the central server to converge user's original, highly sensitive heterogeneous event sequences, bringing the risk of privacy leakage. Using traditional privacy protection methods, such as applying strong differential privacy noise at the data collection end (such as original trajectories or timestamps), although the original data is protected, the noise will seriously destroy the subtle timing structure and cross-source correlation contained in the data, resulting in distortion of feature extraction (such as transfer mode, stay time), and the meaningful similarity cannot be calculated, that is, excessive protection leads to loss of utility. SUMMARY

[0007] The object of the application is to provide a resident travel feature intelligent analysis and identification method based on multi-source data fusion, so as to solve at least one of the above technical problems.

[0008] The technical scheme is a resident travel feature intelligent analysis and identification method based on multi-source data fusion, comprising:

[0009] Processing the original multi-source event stream to obtain a short window event sequence and an event metadata table;

[0010] Based on the short window event sequence, instantaneous modal transition and intention switching are inferred, and instantaneous inference data is generated;

[0011] Based on the short window event sequence, the arrival time in the area without satellite navigation is estimated and the door area elastic alignment is performed, and the spatio-temporal alignment data is generated;

[0012] Fusion of instantaneous inference data, spatio-temporal alignment data and event metadata table, construction of similarity preserving signature and application of signature domain differential privacy, obtaining signature domain differential privacy signature and privacy budget account book;

[0013] Based on the signature domain differential privacy signature and the privacy budget account book, federal security aggregation is performed, and the family similarity analysis result is output.

[0014] Optionally, the instantaneous inference data includes a high-value event Token sequence, a confidence degree and an alignment residual error vector;

[0015] The spatio-temporal alignment data includes a time alignment label, a scene Token sequence and an alignment residual error statistic;

[0016] The family similarity analysis result includes a family similarity matrix, a Top-k similar member pair list and a privacy and reliability evaluation report.

[0017] Optionally, the step of fusing the instantaneous inference data, the spatio-temporal alignment data and the event metadata table to construct the similarity preserving signature comprises:

[0018] According to the time alignment label, the high-value event Token sequence and the scene Token sequence are mapped to a uniform time domain grid to construct a serialized event matrix;

[0019] The co-occurrence, sequence and repetition patterns of the serialized event matrix are counted to encode the original feature vector;

[0020] According to the confidence and alignment residual vector, alignment residual statistics and event metadata table, the feature weight is calculated, the original feature vector is weighted, and the weighted feature vector is generated;

[0021] A composite similarity kernel that integrates n-gram, sequential relationship and time position is constructed, and the weighted feature vector is mapped into a similarity-preserving signature using random Fourier feature approximation or Count-Sketch compression technology.

[0022] Optionally, the steps of applying signature domain differential privacy to obtain a signature domain differential privacy signature and a privacy budget ledger include:

[0023] According to the weighted feature vector, the feature importance of different semantic groups in the similarity-preserving signature is evaluated;

[0024] Based on the feature importance, the differential privacy budget is adaptively allocated to the semantic groups to determine the group budget;

[0025] Combined with the group budget and the precomputed feature sensitivity vector, noise is injected into the similarity-preserving signature to obtain a signature domain differential privacy signature;

[0026] The budget accounting mechanism is used to synthesize the group budget across rounds to generate a privacy budget ledger.

[0027] Optionally, based on the short window event sequence, the arrival time in the area without satellite navigation is estimated and the door zone elastic alignment is performed to generate the spatio-temporal alignment data, the steps include:

[0028] The state space observation is constructed from the short window event sequence, including inertial mode observation, cell switching observation and platform side passenger flow observation;

[0029] Particle filtering or interacting multiple model filtering is used to fuse the inertial mode observation, cell switching observation and platform side passenger flow observation to estimate the train arrival time, generate the time alignment label and ETA confidence interval statistics;

[0030] The door opening identified from the short window event sequence is taken as the main time base to perform elastic registration on the platform side passenger flow event to generate the aligned event sequence and registration residual statistics;

[0031] The scene features of the aligned event sequence are extracted to generate the scene Token sequence, and the ETA confidence interval statistics and registration residual statistics are aggregated into alignment residual statistics.

[0032] Optionally, the step of performing elastic registration of the platform-side crowd events with the door-opening event identified from the short-window event sequence as the master time base, to generate the aligned event sequence and registration residual statistics, includes:

[0033] constructing an alignment cost configuration function that fuses the observation time difference cost, the probe delay prior cost, and the monotonicity constraint cost;

[0034] solving the alignment cost configuration function using a constrained dynamic time warping or Soft-DTW algorithm to obtain an elastic registration path;

[0035] smoothing the elastic registration path and verifying its consistency with the time alignment labels to generate the aligned event sequence;

[0036] calculating point-wise registration errors based on the elastic registration path and modeling to form the registration residual statistics.

[0037] Optionally, the step of inferring the instantaneous modality transition and the intention switch based on the short-window event sequence, to generate the instantaneous inference data, includes:

[0038] performing cross-source time alignment on the multi-source events in the short-window event sequence using weighted robust regression and piecewise affine mapping to generate the aligned event sequence and the window-level alignment residual;

[0039] constructing an event time sequence fingerprint of the aligned event sequence;

[0040] comparing the event time sequence fingerprint with preset hypotheses using multi-hypothesis likelihood matching to generate transition decision labels and likelihood scores;

[0041] starting a Bayesian switching state machine to determine the travel intention when a sudden weather event trigger is detected, to generate intention switch labels and intention switch probabilities;

[0042] fusing the transition decision labels, the likelihood scores, the intention switch labels, the intention switch probabilities, and the window-level alignment residual to encode a high-value event Token sequence, and calibrating the confidence and the alignment residual vector.

[0043] Optionally, the step of performing cross-source time alignment using weighted robust regression and piecewise affine mapping includes:

[0044] calculating the time weighting configuration based on the device categories in the window-level observation sub-sequences and the historical alignment errors;

[0045] performing change point detection on the window-level observation sub-sequences to identify scanning period mutations and divide the sub-sequences;

[0046] In each sub-segment, apply the time alignment configuration and fit the time alignment parameters by robust regression based on Huber loss or τ-estimation, combined with RANSAC-like outlier rejection;

[0047] Map the window-level observation subsequences to the master time base using the time alignment parameters, generate the aligned event sequence and window-level alignment residuals.

[0048] Optionally, the step of generating the conversion decision label and the likelihood score using multi-hypothesis likelihood matching includes:

[0049] Based on the window-level observation subsequences and the pre-stored geofence information, filter the candidate parking stall set;

[0050] For each candidate parking stall in the candidate parking stall set, construct a decomposed likelihood function, which combines the time interval factor, the sequential pattern factor, the spatial consistency factor from the event temporal fingerprint, and the time alignment residual penalty factor based on the window-level alignment residuals, to form a likelihood factor table;

[0051] Based on the candidate parking stall set and the likelihood factor table, expand the multi-hypothesis tree and perform pruning, retaining the N-best branches;

[0052] Perform maximum a posteriori selection, compare the best branch score in the N-best branches with the baseline score of the unconverted hypothesis, and output the conversion decision label and the likelihood score.

[0053] Optionally, the step of performing federated secure aggregation based on the signature domain differential privacy signature and the privacy budget ledger to output the household similarity analysis result includes:

[0054] Generate a random mask vector that sums to zero at the aggregation end from the participant end side;

[0055] Apply the random mask vector to the signature domain differential privacy signature to generate a masked signature and send it to the aggregation end;

[0056] The aggregation end performs a masked inner product calculation on the masked signature, and solves the similar entry table through the mask cancellation protocol;

[0057] Select a Top-k similar member pair list based on the similarity entry table, and assemble a household similarity matrix;

[0058] Integrate the household similarity matrix, the Top-k similar member pair list, the privacy budget ledger, and the similarity entry table to generate a privacy and reliability evaluation report.

[0059] Beneficial effects, the present application solves the problem that privacy protection and analysis utility are difficult to consider in multi-source sensitive data fusion analysis, and through high-precision space-time alignment and signature domain privacy technology, high usability similarity analysis under the premise of protecting user privacy is realized. BRIEF DESCRIPTION OF DRAWINGS

[0060] Figure 1 It is a process schematic diagram of a resident travel feature intelligent analysis and recognition method based on multi-source data fusion.

[0061] Figure 2 It is a process schematic diagram of constructing similarity preserving signature.

[0062] Figure 3 It is a process schematic diagram of generating space-time alignment data.

[0063] Figure 4 It is a process schematic diagram of generating instantaneous inference data. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical scheme and advantages of the present application more clear, the present application will be further described in detail below with specific examples. It should be noted that the specific examples described here are only used to explain the present application, and are not used to limit the protection scope of the present application.

[0065] Example one, a resident travel feature intelligent analysis and recognition method based on multi-source data fusion is provided, as shown in Figure 1 The steps include:

[0066] Step one, processing the original multi-source event stream to obtain short window event sequence and event metadata table.

[0067] Specifically, the original multi-source event stream exemplarily includes but is not limited to: AFC (automatic fare collection system) outbound event, shared bicycle Internet of Things unlocking log, appearance and disappearance event of station Wi-Fi or Bluetooth probe, subway door opening and closing input and output event, vehicle-mounted passenger flow counting sequence, cellular network cell switching event, and minute-level rainfall or radar prediction event. Processing the event stream specifically refers to cutting, aligning and standardizing the original records with different sampling rates and different time bases based on unified time axis and geographic reference (such as station and parking pile geographic fence information).

[0068] The short window event sequence is a time slice indexed by user, family member or anonymous device, and the length of the time window can be adjusted according to the specific application scenario. For example, in a preferred scenario, for the transfer behavior analysis from outbound to unlocking, the window can be set to 15-30 seconds; when analyzing the influence of sudden weather on travel intention, the window can be set to 5-10 minutes.

[0069] The event metadata table contains data quality labels and field criteria for post-processing data, which are used for filtering and weighting in subsequent steps.

[0070] Step two, based on short window event sequences, infer instantaneous modal transition and intention switching, and generate instantaneous inference data.

[0071] Without uploading the original trajectory, event-level inference is performed on the user's behavior in the key decision window (such as the above-mentioned outbound-unlocking window or sudden weather window). Specifically, it includes aligning the time of cross-source events, identifying whether the user has completed modal transition (for example, successfully switching from subway to shared bicycle), and identifying the switching of their travel intention (for example, continue, delay or cancel) under predetermined triggers (such as sudden weather).

[0072] Instantaneous inference data is a discrete and semantic representation of inference conclusions, and the specific form will be described in detail in Example Two, which may include high-value event Token sequences, confidence and alignment residual vectors.

[0073] Step three, based on short window event sequences, estimate the arrival time in satellite navigation-free areas and perform door zone elastic alignment to generate spatio-temporal alignment data.

[0074] Specifically, using other observation information in the short window event sequence (such as inertial mode observation, cell switching density, etc.), the second-level arrival time of the train entering the station is estimated. And take the time when the door opens as the main time base, the crowd events on the platform side (such as Wi-Fi / Bluetooth probe count) are elastically registered to extract scene features that are strongly related to the door opening interval.

[0075] Spatio-temporal alignment data is the result of time series correction and scene discrimination, and its specific form will be described in detail in Example Three, which may include time alignment labels, scene Token sequences, and alignment residual statistics.

[0076] Step four, fuse instantaneous inference data, spatio-temporal alignment data, and event metadata table, construct similarity-preserving signatures and apply signature domain differential privacy, obtain signature domain differential privacy signatures and privacy budget account book.

[0077] Map the user's high-dimensional, sparse event sequence into a low-dimensional mathematical signature (i.e. similarity-preserving signature) that retains key travel patterns (such as co-occurrence, sequence, repetition), and apply differential privacy protection on this signature.

[0078] Compared with directly adding noise to the original trajectory data, this method can preserve the structure information used for similarity calculation to the greatest extent while making the original trajectory irreversible, while consuming less privacy budget.

[0079] The specific implementation of this step will be described in detail in Embodiment Four, including how to construct the serialized event matrix, how to calculate the feature weight, how to map using the random Fourier feature RFF or Count-Sketch technology, and how to adaptively allocate the differential privacy budget.

[0080] Step five, perform federated secure aggregation based on the signed domain differential privacy signature and the privacy budget ledger, and output the family similarity analysis result.

[0081] Without revealing the original trajectory of one party or the un-noised signature, the travel pattern similarity between family members is securely calculated by the aggregation end (such as a server). Specifically, a secure aggregation protocol (such as based on secure masking) is used, so that the aggregation end can only get the final aggregated result (such as the inner product of similarity), and cannot reverse the privacy signature of a single member. Family members are broad, which can be relatives, can be roommates, and can be in the same building or even the same community.

[0082] The family similarity analysis result is the final output of the whole process, which can include the family similarity matrix, the Top-k similar member pair list, and the report of privacy and reliability evaluation.

[0083] In this scheme, the clustering is based on family rather than individual or neighboring crowd, because family is the real travel decision unit, and members often form stable patterns such as pick-up and on-the-way, with stronger and more interpretable signals. Clustering by family as the granularity can reduce the risk of re-identification based on individual trajectory, and is closer to the landing scenario of services.

[0084] The method of proving similarity preservation is to extract the structure of order, co-occurrence and repetition as signature without uploading the original trajectory, and implement the privacy mechanism in the signature space, which not only preserves the similarity relationship but also gives the upper bound of distortion; through federated aggregation, the calculation is completed, realizing the minimum disclosure and auditability; it is robust to time drift and sampling asynchrony, and adaptively allocates noise according to importance, improving effectiveness under fixed privacy budget.

[0085] The output result is used for family carpooling and transfer optimization, school drop-off area and time period management, shared bicycle and micro-circulation deployment, delay or cancellation suggestion in sudden scenarios such as rainstorm; under the same privacy budget, higher consistency correlation, more stable similarity ranking and lower re-identification risk are obtained, and a report containing privacy accounting and robustness evaluation is formed to support the precise implementation of services.

[0086] Embodiment Two, detailed description of the specific process of generating instantaneous inference data, which preferably includes high-value event Token sequence and confidence and alignment residual vector.

[0087] Specifically, based on the short window event sequence, the instantaneous modal transition and intention switching are inferred, and the step of generating instantaneous inference data is as shown in Figure 4 includes the following steps:

[0088] Firstly, the weighted robust regression and segmented affine mapping are used for the multi-source events in the short window event sequence to perform cross-source time alignment to generate the aligned event sequence and window-level alignment residual.

[0089] Since the event timestamps from different devices (such as AFC, Internet of Things car lock, Wi-Fi probe) are not synchronized and delayed, they must be mapped to a unified master time base (for example, based on the AFC outbound event time) before subsequent sequence pattern analysis.

[0090] In a preferred implementation, according to the device categories (such as Internet of Things car lock, Wi-Fi probe, Bluetooth probe) in the window-level observation subsequence, the historical alignment error is counted to calculate the time alignment weighting configuration.

[0091] Further, in order to cope with the mutation of device scanning period (such as probe restart or strategy change), the change point detection (such as using CUMSUM or BoCPD algorithm) is performed on the window-level observation subsequence to identify the scanning period mutation and divide the subsegments.

[0092] In each subsegment, the time alignment weighting configuration is applied, the robust regression based on Huber loss or τ-estimation is used, and the RANSAC type outlier rejection is combined to fit the affine mapping parameters of the subsegment, that is, the time alignment parameters.

[0093] Specifically, the robust regression is to solve the parameters a and b in the affine mapping t = a · t + b, and the objective function can be represented as: min （ak,bk） ∑ j w cls (j)·ρ(a k ·t dev (j)+b k -t AFC (j))。

[0094] Where t AFC (j) is the event time of the master time base (such as AFC); t dev (j) is the event time of the device to be aligned (such as Internet of Things or probe); w cls (j) is the weight determined according to the device category; ρ is the robust loss function, such as Huber loss; a k and b k are the affine mapping parameters of the kth subsegment.

[0095] On this basis, the solved time alignment parameters a kb k Map the window-level observation subsequences to the master time base, generate the aligned event sequences, and merge the fitting residuals of each sub-segment to obtain the window-level aligned residuals (e.g. including root mean square (RMS), P90 quantile, etc.).

[0096] Second, construct the event timing fingerprint of the aligned event sequence.

[0097] The event timing fingerprint is a structured feature vector used to describe the arrive->stay->unlock micro-sequence behavior. Preferably, the fingerprint is spliced from multiple components:

[0098] 1) Time interval features: e.g. calculate the time difference Δ1 between the IoT unlock time and the AFC exit time, the time difference Δ2 between the probe last appearance time and the AFC exit time.

[0099] 2) Sequential pattern features: perform n-gram statistics on the aligned event label sequence (e.g. [AFC out ,probe in ,probe out ,IoT unlock ].

[0100] 3) Spatial consistency features: generate spatial consistency components based on the actual distance between the station and the bike rack geofence and the walkable time.

[0101] Third, use multi-hypothesis likelihood matching to compare the event timing fingerprint with the pre-set hypotheses (a set of modal transition hypotheses) to generate the transition decision label and the likelihood score.

[0102] Use the fingerprint constructed in the previous step to determine whether the user has truly completed the modal transition. The pre-set hypotheses at least include: H1 = complete modal transition (i.e. unlock a certain bike after exiting the station), and H0 = no transition or just passing by.

[0103] Specifically, based on the window-level observation subsequence (e.g. AFC exit location) and the pre-stored geofence information, filter out one or more spatially accessible candidate bike rack sets.

[0104] For each candidate bike rack c in the candidate bike rack set, construct a decomposition likelihood function that fuses multiple factors from the event timing fingerprint (including time interval factors, sequential pattern factors, spatial consistency factors), and the time alignment residual penalty factor based on the window-level aligned residuals, to form a likelihood factor table.

[0105] Exemplarily, the decomposition likelihood function L(H1|c) can be represented as: L(H1|c)=L time ·L order ·L space ·Lres .

[0106] where L time is the likelihood based on time interval factors in the fingerprints (e.g. Δ1, Δ2); L order is the likelihood based on sequential pattern n-gram factors in the fingerprints; L space is the likelihood based on spatial consistency factors; L res is a temporal residual penalty factor, which can be expressed as exp(-λ·RMS(Rm)), where Rm is the root mean square of the window-level alignment residual, and λ is a penalty coefficient.

[0107] In the presence of multiple candidate vehicle stops, based on the candidate vehicle stop set and the likelihood factor table, the multi-hypothesis tree can be expanded and pruned to retain N-best branches (e.g. N=58080).

[0108] On this basis, the maximum a posteriori selection (MAP) is performed to compare the best branch score in the N-best branches with the baseline score of the non-transition hypothesis H0. If the score of the best H1 hypothesis is significantly better than H0, the transition decision label is output as transition, otherwise as non-transition; at the same time, the normalized likelihood score is output.

[0109] Step 4, when a sudden weather event trigger is monitored, a Bayesian switching state machine is started to determine the travel intention, and an intention switching label and an intention switching probability are generated.

[0110] This step is a parallel intention inference branch. Specifically, weather data (e.g. minute-level rainfall or radar forecast events) in the window-level observation subsequence is read. When it is monitored that, for example, the near-field rainfall intensity or the radar echo exceeds a preset threshold within a predetermined time window (e.g. 5-minute window), the state machine is triggered.

[0111] The state machine is preferably a Bayesian switching state machine, and the states S can include: S1=continue travel, S2=delay travel, S3=cancel travel. The transition probability matrix of the state machine can depend on the current rainfall intensity r and the individual's recent behavior prior π (e.g. whether the individual still completed the transfer on the last three rainy days). Through a forward update algorithm, the travel intention is determined, and an intention switching label and an intention switching probability are output.

[0112] Step 5, the transition decision label, the likelihood score, the intention switching label, the intention switching probability, and the window-level alignment residual are fused to encode a high-value event Token sequence, and the confidence and the alignment residual vector are calibrated.

[0113] Perform Tokenization to convert the transition decision tags and intent switch tags into discrete, semantic, high-value event Token sequences. For example: MX_SUCCESS (transfer success), MX_FAIL (transfer failure), INTENT_DELAY (intent delay), INTENT_CANCEL (intent cancellation).

[0114] Fuse the confidence and alignment residual vector. Specifically, the confidence can be based on the likelihood score, penalized by the window-level alignment residual Rm (i.e., the worse the alignment, the lower the confidence), and dynamically adjusted by the intent switch probability.

[0115] In an optional implementation, the high-value event Token sequence further includes high-value time Tokens for characterizing key time relationships. The high-value time Token is a semantic label obtained by discretizing continuous time intervals and relative time positions, used to emphasize time features with high information quantity for travel mode discrimination.

[0116] For example, take the outbound time t _out and the bike unlock time t _unlock , calculate the time interval Δ _t =t _unlock -t _out , and encode different time relationships into different time Tokens according to preset time intervals:

[0117] When 0 seconds ≤ Δ _t <30 seconds, encode the time relationship as T_OUT2UNLOCK_0_30S.

[0118] When 30 seconds ≤ Δ _t <120 seconds, encode the time relationship as T_OUT2UNLOCK_30_120S.

[0119] When Δ _t ≥ 120 seconds, encode the time relationship as T_OUT2UNLOCK_GE_120S.

[0120] For another example, on a time axis with the door opening time as the main basis, calculate the flow peak time t _peak relative to the door opening time t gate , the offset Δ _t_peak =t _peak -t gate , and generate the corresponding time Token according to different offset intervals:

[0121] When 0 seconds ≤ Δ _t_peak ≤ 5 seconds, encode the offset relationship as T_GATEPEAK_0_5S.

[0122] when 5 seconds < Δ _t_peak ≤ 15 seconds, the offset relationship is encoded as T_GATEPEAK_5_15S;

[0123] when Δ _t_peak > 15 seconds, the offset relationship is encoded as T_GATEPEAK_GT_15S.

[0124] In practical applications, the high-value time Token, the modal conversion Token (such as MX_SUCCESS, MX_FAIL), and the travel intention Token (such as INTENT_DELAY, INTENT_CANCEL) jointly constitute a high-value event Token sequence in the short time window, which is used for subsequent construction of a serialized event matrix and generation of a similarity-preserving signature.

[0125] Preferably, in order to make the confidence score closer to the true probability, a reserved validation dataset can also be used to perform equiprobability calibration on the fused score, for example, using isotonic regression or Platt scaling. The final obtained vector is the confidence and alignment residual vector.

[0126] The extracted event order n-gram is described as follows: that is, the aligned event stream is discretized into ordered event words, including, for example, outbound, probe entering the fence, probe leaving the fence, and unlocking success. The occurrence frequency and relative order mode of continuous fragments of length two or three are counted: a two-fragment example: outbound -> probe entering, probe entering -> unlocking; a three-fragment example: outbound -> probe entering -> unlocking, outbound -> probe entering -> probe leaving. These order modes can directly reflect whether the logic of the first and the second is reasonable. The counted result is the order mode component, which is combined into the event timing fingerprint.

[0127] Embodiment three: a detailed description of the specific process of generating spatio-temporal alignment data, which preferably includes a time alignment label, a scene Token sequence, and alignment residual statistics.

[0128] Specifically, based on the short window event sequence, the arrival time at the satellite navigation-free area is estimated, and the gate area elastic alignment is performed, and the steps of generating the spatio-temporal alignment data are as shown in Figure 3 , which include the following steps:

[0129] First, the state space observation is constructed from the short window event sequence, including inertial mode observation, cell switching observation, and station side people flow observation.

[0130] This step is mainly performed in the area where the satellite navigation signal is missing or severely drifting (for example, the last few hundred meters before the subway train enters the station).

[0131] Specifically, the inertial mode observation does not refer to raw inertial measurement unit (IMU) data, but is preferably obtained by extracting a preset template matching score of deceleration-constant speed-approaching station micro-vibration from acceleration and angular velocity segments in a short window event sequence to determine the running state of the train.

[0132] The cellular handover observation, specifically, can be the change in the cell handover density and signal residence time of the cellular network per unit time (e.g., per second). When the train is approaching the station at high speed, the handover density usually increases.

[0133] The platform side people flow observation is preferably obtained by performing time derivative and inflection point detection on the device count time sequence collected by the Wi-Fi or Bluetooth probe deployed on the platform side to capture the transient change in the people flow aggregation pattern caused by the train about to arrive.

[0134] The above three observations are encapsulated as a state space observation sequence, and are combined with the track geometry, typical deceleration of the train, etc. as model prior parameters to be input into the next step.

[0135] In the second step, particle filtering or interacting multiple model filtering is used to fuse the inertial mode observation, cellular handover observation, and platform side people flow observation to estimate the train arrival time, generate time-aligned labels, and calculate the ETA confidence interval statistics.

[0136] In this embodiment, the state vector x is defined to include [track relative position, train speed]. The transition model can use a constant acceleration model or a speed random walk model, and the observation model corresponds to the nonlinear function relationship between the three types of observations (template matching score, handover density, and people flow inflection point) and the state vector x constructed in the previous step.

[0137] In one implementation, the particle filtering (PF) algorithm can be used. Specifically, N particles (i.e., state hypotheses) are initialized, the particles are predicted according to the transition model, the particle weights are calculated according to the likelihood of the three types of observations, and resampling is performed. Preferably, to avoid particle degeneration, the number of effective particles N eff When N eff is lower than a preset threshold (e.g., N / 2), system noise annealing or systematic resampling is triggered.

[0138] A more preferred implementation can use the interacting multiple model (IMM) filtering. For example, three parallel motion models can be preset: (1) constant acceleration (braking) model; (2) constant speed model; and (3) approaching station (speed random walk) model. The interacting multiple model (IMM) algorithm switches between the three models through a Markov transition probability matrix and probabilistically weights and fuses the estimation results of different models to obtain a more robust hybrid model estimate.

[0139] Based on this, using the door opening event as the observation anchor point, the expected distribution of the train arrival time is extracted from the filtered state estimate (whether PF or IMM), time alignment labels are generated (e.g., mapped to standard time grid points and marked with the number of seconds since the door opened), and the consistency between the filtered residual and the observation is accumulated to obtain the ETA confidence interval statistics.

[0140] The third step is to use the door opening edge identified from the short window event sequence as the main time base to perform flexible registration of the passenger flow events on the platform side, and generate the aligned event sequence and registration residual statistics.

[0141] The platform-side passenger flow events (such as Wi-Fi / Bluetooth counting sequences) and vehicle passenger flow events (such as vehicle passenger flow counting sequences APC) are precisely aligned with the door opening time as a reference.

[0142] Specifically, an alignment cost configuration function is constructed that integrates the observation time difference cost, the prior cost of detection delay, and the monotonicity constraint cost.

[0143] For example, the cost configuration function C can be expressed as:

[0144] C=α·|t wifi -t gate |+β·|t apc -t gate |+γ·D delay +μ·D monotone +ν·D sparse .

[0145] Where: t wifi and t apc These are the timestamps of the Wi-Fi counting sequence and the APC (Action Passenger Flow) sequence to be aligned, respectively; t gate The door opening edge timestamp serves as the primary time base; α and β are the cost weighting coefficients for the observation time difference; D delay It is a penalty term used to penalize alignment paths that violate prior knowledge of device (e.g., Wi-Fi probe) detection delays; D monotone It is a constraint term used to ensure that the alignment path must be time-monotonic; D sparse It is a sparse regularization term used to suppress unnecessary stretching or compression; γ, μ, ν are their respective cost coefficients.

[0146] In one alternative implementation, the penalty terms in the alignment cost configuration function can be defined in the following form. Assume the elastic registration path consists of several matching points, each matching point being defined by a pair of indices (i... _l ,j _l ) indicates that i _l j is the index of the Wi-Fi or passenger flow event in the original sequence._l For the index on the master time base, the corresponding timestamps are t wifi (i _l ) and t gate (j _l ) respectively.

[0147] 1) Delay penalty D delay : Determine the reasonable delay interval [d _min , d _max ] of the Wi-Fi probe relative to the real people flow event in advance. For each matching point on the path, calculate the delay d _l = t wifi (i _l )-t gate (j _l ). When d _l falls within the interval [d _min , d _max ], no delay penalty is generated; when d _l is less than d _min or greater than d _max , the penalty is calculated according to the amount of exceeding the interval, and preferably the square of the exceeding amount can be used as the penalty strength. In this way, D delay can be defined as the cumulative sum of the delay penalties of all matching points, used to constrain the overall alignment result to be within the experience range of the probe delay.

[0148] 2) Monotonicity constraint penalty D monotone : To suppress the occurrence of obvious back jumps in the time mapping, the master time base increment of adjacent matching points is constrained. Let the master time base time difference corresponding to the adjacent two points be Δ _t_l =t gate (j _l+1 )-t gate (j _l ). A minimum allowed step size Δ _t_min (e.g. not less than zero or not less than a positive minimum time step) can be set. When Δ _t_l is less than Δ _t_min , it is considered to violate the monotonicity requirement, and a monotonicity penalty is generated for the step, and preferably the square of (Δ _t_min -Δ _t_l ) can also be used as the penalty value. D monotone can be defined as the sum of the penalties of all steps that violate the monotonicity, used to encourage the alignment path to be monotonically forward in the master time base as a whole.

[0149] 3) Sparse regularization penalty D sparse : To avoid excessive stretching or compression of the alignment path, encourage the path to be as close to the diagonal as possible, and count the steps that deviate from the diagonal. Let the step length of the adjacent two points in the index space be (Δ _i_l , Δ_j_l )=(i _l+1 -i _l ,j _l+1 -j _l When the step size is (1,1), the path is considered to advance diagonally in unit steps, and no sparsity penalty is incurred; when the step size is not equal to (1,1), there is considered to be an off-diagonal step size, and a penalty can be recorded for that step. sparse It can be defined as the sum of the number of off-diagonal steps along the path. This can be achieved by increasing or decreasing D. sparse The weights can be adjusted to either enhance or weaken the suppression of off-diagonal step lengths, thus striking a trade-off between alignment accuracy and path smoothness.

[0150] By setting D in the total alignment cost function delay D monotone D sparse By configuring different weight coefficients, a balance can be struck between the degree of detection delay conformity, time mapping monotonicity, and path smoothness according to the actual scenario, resulting in a gate region elastic alignment result that takes into account both physical rationality and registration accuracy.

[0151] The alignment cost configuration function is solved by using constrained dynamic time warping or Soft-DTW algorithm to obtain the elastic registration path.

[0152] In one alternative implementation, inertial mode observations are obtained through template matching. Specifically, acceleration and angular velocity sequences related to train operation are extracted from short-window event sequences. After degravity removal, filtering, and resampling, normalized inertial signals are obtained. Inertial templates for deceleration, constant speed, and station entry micro-vibration stages are pre-constructed based on historical labeled data. During operation, the inertial signals within the target time window are divided into sliding windows of fixed length, and normalized cross-correlation or Soft-DTW matching scores are calculated with each template. The matching scores obtained for each stage are combined to form an inertial mode observation vector, which is used as part of the state-space observation input filter to estimate the train arrival time.

[0153] In a preferred implementation, a constrained dynamic time warping algorithm is employed. To improve computational efficiency and reduce singular matching, a constraint is preferably introduced, for example, setting a Sakoe-Chiba bandwidth w. The bandwidth w restricts the search space of the DTW algorithm to a fixed width around the diagonal, limiting the maximum allowable offset between two time series.

[0154] In another alternative implementation, the Soft-DTW algorithm can be employed. Soft-DTW replaces the hard minimization operator in DTW with a soft minimization operator, providing a differentiable DTW loss value, facilitating gradient backpropagation when needed (e.g., in an end-to-end neural network).

[0155] Further, the elastic registration path is smoothed and verified for consistency with the time-alignment label, generating an aligned event sequence.

[0156] After obtaining the elastic registration path, preferably, a one-step neighborhood smoothing operation (e.g., using moving average or Gaussian smoothing) is performed on the path to avoid possible sawtooth or jump in the original DTW path. The smoothed path is verified for consistency with the time-alignment label generated from the estimated arrival time (e.g., the aligned peak should not be earlier than the estimated arrival time). If there is a significant boundary crossing or conflict, it can be rolled back and the bandwidth w in the previous step is reduced to re-solve. After verification, the original platform-side passenger flow events (such as Wi-Fi count sequence and APC sequence) are resampled or interpolated according to the smoothed path, mapped onto the time axis with the door opening as the main time base, generating an aligned event sequence.

[0157] On this basis, the point-by-point registration error is calculated based on the elastic registration path, and the registration residual statistics are modeled.

[0158] Specifically, based on the difference between the original timestamp and the timestamp after mapping with the elastic registration path, the point-by-point registration error is calculated. These errors are statistically modeled, such as calculating their root mean square RMS, P90 quantile, etc., to form the registration residual statistics.

[0159] In the fourth step, the scene features of the aligned event sequence are extracted, the scene Token sequence is generated, and the ETA confidence interval statistics and the registration residual statistics are aggregated into alignment residual statistics.

[0160] From the aligned event sequence (i.e., the passenger flow sequence aligned to the door opening time base) generated in the previous step, key scene features are extracted.

[0161] Exemplarily, the scene features include but are not limited to:

[0162] Peak time features: for example, the time of the passenger boarding (e.g., Wi-Fi count rising) peak (relative to the door opening time), the time of the passenger alighting (e.g., APC count falling) peak.

[0163] Net flow features: for example, the size of the peak of net passenger flow (boarding - alighting).

[0164] Morphological features: e.g. rising edge slope, falling edge slope, peak width (peak duration), and area under curve (total passenger flow).

[0165] Asymmetry features: e.g. ratio of rising edge slope to falling edge slope.

[0166] Further, discretize the continuous feature values according to pre-defined thresholds or morphological rules, and encode them into a sequence of semanticized scenario Tokens. For example:

[0167] GATE_PEAK_UP (indicating a clear peak of boarding passengers); NETFLOW_HIGH (indicating a high peak of net inflow); ASYM_UP>DOWN (indicating a rising edge slope greater than a falling edge slope, i.e. passengers are concentrated on boarding); PEAK_DELAY_5S (indicating a peak of boarding passengers appearing 5 seconds after the door opening).

[0168] On this basis, aggregate the ETA confidence interval statistics (reflecting the uncertainty of the arrival time estimate) and the registration residual statistics (reflecting the size of the elastic alignment residual) to form a comprehensive alignment residual statistics, which is used for feature weighting, i.e. the weight of events with high arrival time estimate uncertainty or large elastic alignment residual will be reduced in subsequent analysis.

[0169] Embodiment four, describes a similar signature construction and signature domain differential privacy implementation.

[0170] Fusion of instantaneous inference data, spatio-temporal alignment data and event metadata table, construct a similarity-preserving signature, as shown in Figure 2 The steps include:

[0171] First, according to the time alignment label, map the high-value event Token sequence and the scenario Token sequence to a unified time domain grid to construct a serialized event matrix.

[0172] Specifically, read the high-value event Token sequence (e.g. MX_SUCCESS (transfer success) and the like), the time alignment label and the scenario Token sequence (e.g. GATE_PEAK_UP (clear peak of boarding passengers) and the like), and the event metadata table.

[0173] According to the time alignment label (e.g. in seconds of time grid with door opening time as t=0), map the above two types of Token sequences to a unified time domain grid to construct a serialized event matrix X. The dimension of the matrix X can be T x V, where T is the number of time grids covered by the short window, and V is the size of the vocabulary of all high-value Tokens and scenario Tokens. The value of the matrix X(t,v) can be the Token v The number of times or Boolean value appearing at time t.

[0174] For missing or abnormal values in the matrix, they can be interpolated or suppressed according to the data quality labels in the event metadata table, for example, setting zero for the missing time slice (quality label is low) and marking in the parallel quality bitmap.

[0175] Secondly, co-occurrence, precedence and rhythm patterns of the serialized event matrix are counted to form the original feature vector.

[0176] Structured features are extracted from the serialized event matrix X to capture the user's travel patterns, and the original feature vector F is formed by splicing raw .

[0177] Specifically, the encoding preferably includes:

[0178] a) Co-occurrence pattern: count the number of co-occurrences of different tokens in the same time bin and the normalized frequency. For example, the frequency of MX_SUCCESS (transfer success) and NETFLOW_HIGH (net flow peak) appearing at the same time.

[0179] b) Precedence pattern: preferably, skip-gram counting is used to count the frequency of occurrence of directed token pairs (e.g., Token i appears k steps before Token j , k≤w) with a skip distance not exceeding a preset window w, to capture the order relationship between events.

[0180] c) Repetition and rhythm pattern: count the repetition period, peak width or peak area of key tokens (e.g., MX_SUCCESS or GATE_PEAK_UP) in multiple short windows.

[0181] d) Position information: preferably, the time bin is added with a sine position encoding, and the absolute or relative time position information of the event occurrence is encoded into the feature vector.

[0182] Thirdly, according to the confidence and alignment residual vector, alignment residual statistics and event metadata table, the feature weight is calculated, the original feature vector is weighted, and the weighted feature vector is generated.

[0183] The F raw generated in the previous step is weighted to suppress the contribution of low-quality, low-confidence features and enhance the contribution of high-quality features.

[0184] Specifically, the confidence and alignment residual vector C m , the alignment residual statistics R t and the event metadata table M are read. A feature weight vector W raw with the same dimension as F f is calculated.

[0185] Exemplarily, the weight W f may be a product of multiple factors, e.g. W f = w c · w r · w q .

[0186] where: w c is a confidence weight calculated based on the confidence c in C m . For example, w c = sigmoid(a w · (c - c0)); c is the confidence score; c0 is the confidence baseline; a w is the scaling coefficient. w c makes the feature weight of low-confidence Token (e.g. confidence of MX_SUCCESS is only 0.3) lower.

[0187] w r is a residual penalty calculated based on the residual quantile value r in R t . For example, w r = 1 / (1 + b w · r); r is the residual value (e.g. ETA uncertainty or DTW registration residual); b w is the penalty coefficient. w r makes the feature weight of high-residual (e.g. inaccurate arrival estimation) scenario Token lower.

[0188] w q is a decay coefficient (e.g. 0.1 or 1.0) set based on the low-quality flag bit in metadata table M.

[0189] The weight vector W f is Hadamard multiplied (i.e. element-wise multiplication) with the original feature vector F raw , and optionally normalized (e.g. L2 normalization), to get the weighted feature vector F w .

[0190] Meanwhile, a per-dimension feature sensitivity vector Af is calculated according to the upper bound of each dimension of the feature (e.g. n-gram count is at most 5) and the normalization method. The Af vector defines the maximum amount of change that each dimension in F w may have when individual user data changes, which is an important basis for subsequent differential privacy noise scaling.

[0191] Fourthly, a composite similarity kernel that integrates n-gram, sequential relationship and temporal position is constructed, and a random Fourier feature approximation or Count-Sketch compression technique is adopted to map the weighted feature vector into a similarity-preserving signature.

[0192] This step will be performed in high-dimensional F. w Complex similarity calculations in the signature space are transformed into simple inner product calculations in the low-dimensional signature space.

[0193] Define the composite similarity kernel K(F) w,i ,F w,j ), used to measure two weighted feature vectors F w,i and F w,j The similarity between them. Preferably, the composite kernel K can be a weighted sum of multiple sub-kernels: K = α k ·K ngram +β k ·K order +γ k ·K time .

[0194] Where: K ngram It is a linear or polynomial kernel corresponding to the co-occurrence features of n-grams; K order It is the kernel corresponding to the skip-gram order relation (e.g., a second-order polynomial kernel); K time It corresponds to the Gaussian radial basis function (RBF) kernel for sine and cosine position coding; α k ,β k ,γ k These are kernel coefficients selected through cross-validation.

[0195] Directly calculating high-dimensional nonlinear kernel matrices is computationally expensive and detrimental to privacy protection. This embodiment employs an approximation technique to weight the eigenvector F. w The mapping is to a low-dimensional similarity-preserving signature (SPS).

[0196] In a preferred implementation, for K... time The nonlinear kernel (such as the Gaussian radial basis function RBF kernel) is approximated using the stochastic Fourier characteristic function RFF. Specifically, the sampled d time Given a random frequency vector Ω and a random bias b (sampled from the Fourier transform corresponding to the RBF kernel), the weighted eigenvector F w The mapping component z on this kernel time It can be approximated as:

[0197] z time =sqrt{2 / d time}·cos(Ω·F w +b); z time With other nuclei (e.g., K) ngram The components of the linear mapping are spliced ​​together to form a high-dimensional but linear signature SPS0.

[0198] In another optional implementation, or after RFF, to further control the dimensionality of the signature and the communication overhead, Count-Sketch (or Count-Min Sketch) compression technique can be employed next. Specifically, the high-dimensional signature SPS0(or directly the high-order expansion of F w ) is compressed to a d sig -dimensional vector, i.e., a similarity-preserving signature SPS, using k independent hash functions. The Count-Sketch technique can approximately preserve the inner product between vectors after compression, i.e., i j 0,i 0,j ≈ K(F w,i , F w,j ).

[0199] By employing techniques such as RFF or Count-Sketch, the complex, non-linear sequence similarity is approximately converted into the inner product or cosine similarity between low-dimensional SPS signature vectors, achieving similarity preservation. As shown in the theoretical analysis, when the dimensionality d time of RFF is large enough (e.g., related to ε -2 , where ε is the approximation error), it can be guaranteed that the distance in the signature domain is highly consistent with the distance in the original kernel space.

[0200] Step 5: Apply signature domain differential privacy to obtain a signature domain differentially private signature and a privacy budget ledger.

[0201] Noise is injected based on the similarity-preserving signature SPS to achieve differential privacy protection.

[0202] Specifically, the feature importance of different semantic groups in the similarity-preserving signature is evaluated based on the weighted feature vector.

[0203] That is, the d sig dimensions of the similarity-preserving signature SPS are divided into several semantic groups according to their sources (which correspond to which original features in the weighted feature vector F w ). For example, they can be divided into: an instantaneous transfer group (features from Token such as MX_SUCCESS), an intent group (features from Token such as INTENT_DELAY), a gate area scene group (features from Token such as GATE_PEAK_UP), and a location encoding group.

[0204] The feature importance s g of the semantic groups is evaluated. In one preferred implementation, the feature weight vector W f ​​​, calculate the average feature weight corresponding to each semantic group g as the feature importance s of the group g =mean(W f in group g).

[0205] Further, based on the feature importance, the differential privacy budget is adaptively allocated to the semantic groups, and the group budget is determined.

[0206] The feature importance s g of a group is higher, less noise should be allocated, that is, a larger share of the differential privacy budget should be allocated. Specifically, s g is normalized to obtain the budget allocation proportion p g of each group. g =s g / ∑s total . Given the total privacy budget ε g of the current query, the group budget ε g allocated to the semantic group g is ε total ·p g . ε g =ε total ×(s g / Σs g ).

[0207] Further, combined with the group budget and the pre-computed feature sensitivity vector, noise is injected to the similarity preserving signature to obtain a signature domain differential privacy signature.

[0208] Preferably, a Gaussian mechanism is used to achieve (ε, δ)-differential privacy. To the k-th dimension component SPS k of the similarity preserving signature SPS (assuming it belongs to the semantic group g, and its sensitivity is Δf k , which comes from the Δf vector), a Gaussian noise N(0, σ k 2 ) with mean 0 is added.

[0209] The scaling formula of the noise standard deviation σ k is exemplarily σ k =(sqrt(2ln(1.25 / δ g ) )Δf k ) / ε g ;

[0210] Where: Δf k is the L2 sensitivity of the k-th dimension feature; ε g and δ g are the privacy parameters allocated to the group g (the sum of δ g of all groups is δ total ).

[0211] After performing this operation on all dimensions of SPS, the signature domain differential privacy signature SPS is obtained dp .

[0212] In the signature domain, the self-adaptive noise adding method based on feature importance is adopted, which can better preserve the signal-to-noise ratio of important features (such as the instantaneous transfer group) under the same ε total privacy constraint, and obtain higher accuracy in subsequent similarity calculation. Theoretical analysis shows that the upper bound of the distortion of the similarity is directly related to the noise variance σ 2 , and the method minimizes the distortion of the key features by optimizing the allocation of σ k .

[0213] On this basis, a budget accounting mechanism is used to synthesize the group budget across rounds and generate a privacy budget ledger.

[0214] Since users may participate in queries multiple times (for example, once a day), the privacy budget consumption across rounds must be accumulated. Preferably, an advanced budget accounting mechanism such as Rényi differential privacy (RDP) or moment accounting is used instead of the traditional linear superposition. Rényi differential privacy (RDP) or moment accounting can provide a tighter privacy bound for multiple combinations of Gaussian mechanisms by tracking the Rényi entropy or moment generating function of the privacy loss random variable. The final privacy budget ledger ε log records the cumulative budget consumption ε total and δ total of each member and each semantic group, which is used for compliance auditing.

[0215] In an optional implementation, the similarity-preserving signature is segmented and spliced by semantic groups during construction, so that different semantic groups correspond to fixed signature dimension intervals. Specifically, the weighted feature vector can be divided into sub-vectors such as instantaneous transfer group, intention group, door area scene group, and time position group according to semantics, and sub-signatures are obtained by corresponding kernel mapping, and then spliced into an overall signature vector in a predetermined order. For example, it can be agreed that the first to d1 dimensions of the signature vector are the instantaneous transfer group, the d1+1 to d1+d2 dimensions are the intention group, and so on.

[0216] A mapping table of dimensions to semantic groups is maintained on the terminal side, which is used to quickly aggregate the signature dimensions corresponding to each semantic group when calculating the group importance and allocating differential privacy budget, and to apply uniform budget and noise configuration to the dimensions within the group. The mapping relationship is only used locally and does not upload with the signature, thereby avoiding the leakage of internal feature grouping details.

[0217] Further, as a preferred implementation, in order to ensure that the signature domain differential privacy signature SPS dpof the signature vector, a quality control step is preferably performed. Specifically, since the injected Gaussian noise can cause the norm (i.e. length) of the signature vector to inflate, after the noise is injected, the SPS dp is executed once with a norm constraint and renormalization, e.g. projected into a ball of preset radius R and unitized. The renormalization can also be based on a known noise variance σ k 2 The expected cosine similarity distortion upper bound caused by this round of noise injection is estimated. If the distortion upper bound exceeds a preset availability threshold, a group budget reallocation (under the total budget ε total is triggered and the noise injection is re-executed to strike a balance between privacy and availability.

[0218] Embodiment Five, detailed description of the specific process of implementing federated secure aggregation and outputting the family similarity analysis result, which preferably includes the family similarity matrix, the Top-k similar member pair list and the privacy and reliability evaluation report.

[0219] Specifically, based on the signature domain differential privacy signature and the privacy budget ledger, the federated secure aggregation is performed to output the family similarity analysis result, including the following steps:

[0220] First, a random mask vector that sums to zero at the aggregation end is generated at the participant end side.

[0221] This step is performed on multiple participant end sides (e.g. mobile devices of multiple members) within a family. Before the start of an aggregation session, a session key negotiation is preferably performed between each active participant end side to establish a secure channel.

[0222] An important feature of implementing secure aggregation is to sum to zero at the aggregation end. For example, for any pair of members (i, j) that need to calculate similarity, member i can locally generate a high-dimensional random mask vector R ij , while member j locally generates its counterpart mask R ji , and ensures that R ij + R ji = 0 (i.e. opposite vectors). In more complex (e.g. more than 2-party) secure aggregation protocols, the generation and distribution of masks can be coordinated by the aggregation end, or negotiated between participants through secret sharing, etc. to ensure that the mask vectors uploaded by all participants can be offset at the aggregation end (or when calculating the inner product), so that the aggregation end cannot solve the mask of a single member.

[0223] Further, to enhance the security and robustness of the aggregation process, a one-time counter or timestamp can be preferably introduced and signed or hashed together with the mask, to prevent replay attacks. Meanwhile, the system can maintain a list of active members for the current round of the session, and for members who drop offline in the middle of the session, their pre-generated mask shares can be recycled by the protocol or replaced by pre-generated secondary masks, to ensure the correctness of the aggregation result.

[0224] Secondly, the random mask vector is applied to the signed domain differential privacy signature to generate a masked signature and send it to the aggregation end.

[0225] Specifically, each participant i adds (e.g. vector addition) the signed domain differential privacy signature SPS dp (i) generated in embodiment four to all mask vectors assigned to (or generated by) the member, to generate a masked signature SPS masked (i). For example, SPS masked (i)=SPS dp (i)+∑ j≠i R ij .

[0226] The participant i only sends the masked signature SPS masked (i) to the aggregation end. The original signed domain differential privacy signature SPS dp (i) and the random seed or session key used to generate the mask are both kept locally at the end side and are not uploaded to the aggregation end.

[0227] Thirdly, the aggregation end performs a masked inner product calculation on the masked signature, and calculates the similar entry table through the mask cancellation protocol.

[0228] After receiving all the active participants' masked signatures, the aggregation end (e.g. cloud server) performs a masked inner product calculation on the member pair (i, j) that needs to be calculated for similarity.

[0229] Specifically, the aggregation end calculates the masked inner product Inner masked (i,j)=<SPS masked (i), SPS masked (j)>.

[0230] Due to the design of the mask (e.g. R ij +R ji =0), when the aggregation end calculates the inner product, in addition to the target value <SPS dp (i), SPS dp (j)> in the expansion term, it also contains a large number of mask terms generated by the cross multiplication of SPS dp and R, and the cross multiplication of R and R.

[0231] Mask cancellation protocol, that is, the aggregator does not acquire a single R ij Under the premise of protocol coordination (e.g., requiring the end side to send back certain necessary mask cancellation terms that do not reveal privacy), or by utilizing the algebraic structure of the mask itself, non-target mask terms can be removed from the inner product of the mask. masked Eliminate from (i,j) to calculate (or approximately calculate) the true, unmasked inner product. <SPS dp (i),SPS dp (j)>.

[0232] The calculated inner product (or the cosine similarity obtained by normalizing it) constitutes the similarity entry list.

[0233] Preferably, in order to avoid loss of floating-point precision when aggregating a large number of vectors, the aggregator can use numerical stabilization techniques such as the Kahan summation algorithm or high-precision accumulation when performing summation calculations.

[0234] An optional privacy enhancement measure is that after the similarity entry table is computed, the aggregator can apply differential privacy post-processing (e.g., Laplace noise or Gaussian noise) to it, and the privacy budget consumed should be separately recorded in the aggregation layer partition of the privacy budget ledger.

[0235] The fourth step is to select the Top-k similar member pairs based on the similarity entry table and assemble the family similarity matrix.

[0236] Based on the similarity entry table calculated in the previous step (i.e., the similarity scores of all member pairs (i,j), the aggregation end sorts each member i in descending order of similarity score, selects the other members in the top k positions, and forms a Top-k similar member pair list.

[0237] Meanwhile, the aggregation end can assemble the similarity scores of all member pairs into an N×N (N is the number of family members) symmetric matrix according to the member index, that is, the family similarity matrix (the diagonal can be set to 1 or 0, and missing entries are filled with 0 or default value).

[0238] Preferably, if there are ties in similarity when selecting the Top-k (e.g., members j and l have the same similarity score as member i), a stable breaking strategy can be adopted. For example, members who share more common high-value event tokens with member i (statistical information can be calculated together in the secure aggregation) can be prioritized, or members who have interacted more frequently recently can be prioritized.

[0239] The fifth step involves combining the family similarity matrix, the Top-k similar member pair list, the privacy budget ledger, and the similarity entry table to generate a privacy and reliability assessment report.

[0240] The report is an auditable proof provided to the user or (possible) regulator, to demonstrate the performance of the method in terms of privacy compliance and result reliability.

[0241] Preferably, the report specifically includes, but is not limited to, the following:

[0242] a) Privacy accounting and budget synthesis: Synthesize the privacy budget consumption of all historical sessions, using mechanisms such as RDP or the accountant, to give the total privacy budget consumed by each member log , and total and total . Preferably, the system can set a budget threshold gate, when the cumulative budget total of a certain member exceeds the threshold, automatically limit its participation in subsequent Top-k presentation or aggregation calculation.

[0243] b) Reliability and consistency sampling: For a very small part of the verification sample pairs that obtain explicit consent from the user, the system can calculate the plaintext approximate baseline similarity (e.g. based on the statistical features uploaded by the user with high aggregation or very low resolution) on the end side (or in the trusted execution environment), and calculate the consistency correlation coefficient

[0244] c) Distortion analysis and evaluation: According to the upper bound of noise variance or distortion evaluation results, estimate the expected deviation range of the cosine similarity of this calculation, and include it in the report.

[0245] d) Compliance list: The report explicitly states that the whole process (especially the aggregation end) does not touch the original trajectory data, the unmasked feature vector, the unmasked similarity preserving signature, does not store the session key or the random mask of individual members, strictly in line with the principles of minimizing data disclosure and privacy design.

[0246] In an optional implementation, federated secure aggregation can also support the case where a participant drops out in the middle. Before aggregation, the aggregation end first determines the list of active members in the current round, and records it in the protocol; in the masked signature upload stage, if the data of a certain member is not received within the preset time window, mark this member as a dropped member, and perform secure aggregation based only on the masked signatures of the remaining active members.

[0247] To avoid the bias introduced by the residual mask of the offline member, a robust security aggregation protocol for offline members can be used, such as simple secret sharing of the mask vector in the session initialization phase, so that when a member is offline, the aggregation end can recover and offset the mask sum related to the offline member by collecting part of the active member's sub-mask, so as to ensure that the aggregation result only reflects the similarity between the current active members. When the offline rate of a certain round exceeds the preset threshold, the aggregation result of this round can be marked as low reliability or directly reinitiated a new round of aggregation to ensure the stability and credibility of the family similarity analysis result.

[0248] Embodiment six, detailed description of similarity preserving signature construction and signature domain differential privacy steps, and the calculation process of applying signature domain differential privacy.

[0249] This embodiment assumes that the steps before the signature mapping (such as random Fourier feature RFF or Count-Sketch) have been completed, and focuses on how to adaptively allocate privacy budget and inject noise.

[0250] Collect scene data, including:

[0251] Similarity preserving signature SPS: assuming that after mapping, a similarity preserving signature SPS with dimension d dig =6 (has been normalized) is obtained. SPS = [0.50, 0.80, -0.20, 0.10, 0.90, 0.30].

[0252] Semantic grouping and feature importance s g : Assuming that the 6 dimensions of SPS have been divided into 3 semantic groups, and the feature importance s f of each group is evaluated according to the feature weight vector W g , as follows:

[0253] Group G1 (instant transfer group): contains components SPS1, SPS2. s G1 =0.8 (high importance).

[0254] Group G2 (door area scene group): contains components SPS3, SPS4. s G2 =0.5 (medium importance).

[0255] Group G3 (position encoding group): contains components SPS5, SPS6. s G3 =0.2 (low importance).

[0256] Feature sensitivity Δf: assuming that the L2 feature sensitivity Δf k of all dimensions has been calculated according to the normalization method, and is 1.0.

[0257] Privacy budget (Global): Set the total privacy budget ε for this round of queries total = 1.0, total distortion probability δ total = 10 -5 .

[0258] Adaptive group budget allocation, including the following steps:

[0259] Calculate the total importance S total = s G1 + s G2 + s G3 = 0.8 + 0.5 + 0.2 = 1.5.

[0260] Calculate the budget allocation proportion p of each group g = s g / S total : p G1 = 0.8 / 1.5 ≈ 0.533; p G2 = 0.5 / 1.5 ≈ 0.333; p G3 = 0.2 / 1.5 ≈ 0.133;

[0261] Determine the group budget ε g = ε total · p g : ε G1 = 1.0 · 0.533 = 0.533 (important group, allocate more budget, target noise smaller); ε G2 = 1.0 · 0.333 = 0.333; ε G3 = 1.0 · 0.133 = 0.133 (secondary group, allocate less budget, allow larger noise).

[0262] Noise scaling and injection, including the following steps:

[0263] Assume δ total is equally allocated to the three groups, i.e. δ g = δ G1 = δ G2 = δ G3 = (10 -5 ) / 3 ≈ 3.33 × 10 -6 .

[0264] Using the Gaussian mechanism, calculate the standard deviation σ k of the injected noise. Its scaling formula σ k = (sqrt{2·ln(1.25 / δ g )}·Δf k ) / ε g .

[0265] Calculate the public multiplier term C = sqrt{2·ln(1.25 / δg )}.

[0266] C≈sqrt{2·ln(1.25 / (3.33×10 -6 ))}≈sqrt{2·ln(375375)}

[0267] ≈sqrt{2·12.836}≈sqrt{25.672}≈5.067.

[0268] Due to Δf k =1.0, the formula simplifies to σ g =C / ε g ≈5.067 / ε g .

[0269] Calculate the standard deviation of the noise to be injected for each group:

[0270] σ G1 =5.067 / ε G1 ≈5.067 / 0.533≈9.507;

[0271] σ G2 =5.067 / ε G2 ≈5.067 / 0.333≈15.216; σ G3 =5.067 / ε G3 ≈5.067 / 0.133≈38.100;

[0272] Highest importance (s) G1 Group G1, with a noise standard deviation of ≈9.5, was controlled to be the lowest (mean squared = 0.8); while the group with the lowest importance (mean squared = 0.8) had its noise standard deviation controlled to be the lowest (mean squared = 0.8). G3 Group G3, with a noise standard deviation of approximately 38.1, has the largest noise standard deviation (ε = 0.2). This achieves adaptive, non-uniform noise distribution while maintaining the same total privacy budget ε. total Under the premise of protecting the signal-to-noise ratio of important semantic features.

[0273] Noise injection: from the corresponding Gaussian distribution N(0,σ) g 2 The sampling noise vector is Noise=[N1,N2,N3,N4,N5,N6].

[0274] N1, N2 are derived from N(0, 9.507). 2 Sampling. N3, N4 are sampled from N(0, 15.216). 2 Sampling. N5, N6 are sampled from N(0, 38, 100). 2 )sampling.

[0275] Assume (for example only) the noise vector obtained from a single random sample:

[0276] Noise≈[0.85,-1.10,2.50,-4.00,15.00,-20.00].

[0277] Obtain Signature Domain Differential Privacy Signature (SPS) dp =SPS+Noise:

[0278] Signature Domain Differential Privacy Signature (SPS) dp ≈[1.35,-0.30,2.30,-3.90,15.90,-19.70];

[0279] Optionally, SPS can be used. dp Perform norm constraints or normalization again.

[0280] Using a budgetary accounting mechanism, the ε consumed in this round will be... total =1.0,δ total =10 -5 and ε of each group g ,δ g Record in the privacy budget ledger ε log Preferably, Rayleigh Differential Privacy RDP or the Matrix Accountant mechanism is used to synthesize the historical budget.

[0281] According to one aspect of this application, similarity-preserving signature mapping can also specifically be:

[0282] Obtain the weighted feature vector F w By maximizing the correlation coefficient between signature domain similarity and plaintext baseline similarity by leaving out the validation set, coefficients α / β / γ are selected, and L2 regularization is applied to avoid single-kernel dominance. The kernel coefficient configuration K is then obtained. cfg .

[0283] Obtain the weighted feature vector F w With kernel coefficient configuration K cfg K related to time and location time Using Random Fourier Features (RFF): Sample d time Each frequency vector and its bias form a time-mapping vector (explicit eigenvector) Φ. time (F w ); for n-gram co-occurrence kernel K ngram (i.e., the linear or polynomial kernel corresponding to the n-gram co-occurrence feature) and the skip-gram order relation kernel K order Construct linear and second-order mappings respectively. Concatenate them to obtain the similarity-preserving signature SPS0 (a high-dimensional but linear signature). Record the RFF random seed locally, without uploading metadata.

[0284] Obtain the similarity signature SPS0, and apply Count-Sketch compression to d.sig Vi (signature dimension), control the hash collision rate within a set threshold, estimate the inner product error upper bound, and obtain the similarity preserving signature SPS and the compression configuration CSk (hash seed only locally saved).

[0285] Obtain the similarity preserving signature SPS (low-dimensional similarity preserving signature), perform norm normalization and quantization bit width selection, make the communication byte number meet the end-side budget, and obtain the normalized similarity preserving signature SPS (still named SPS, for direct use of signature domain differential privacy adaptive noise allocation).

[0286] According to an aspect of the present application, the signature domain differential privacy adaptive noise allocation can be specifically:

[0287] Obtain the normalized similarity preserving signature SPS and the feature weight vector W f and the feature sensitivity vector Δf, divide the groups according to semantics (instant transfer group, intention group, door area scene group, location coding group), calculate the group importance s g =mean(W f ingroup g), normalized to group weight p g , given the total budget ε total , calculate the group privacy budget ε g =ε total ·p g , form the group budget table Egroup.

[0288] Obtain the group budget table Egroup and the feature sensitivity vector Δf, set the distortion probability upper bound δ g and the per-dimension noise standard deviation σ k =sqrt(2·ln(1.25 / δ g ))·Δf k / ε g , inject Gaussian noise to the similarity preserving signature SPS per dimension, and obtain the signature domain differential privacy signature SPS dp and the per-dimension noise record. Wherein, Δf k is the k-th dimension feature sensitivity.

[0289] According to the signature domain differential privacy signature SPS dp and the current round group ε g / δ g , use the Relational Differential Privacy RDP or accountant to perform cross-round synthesis, generate a privacy budget account book ε log , which is used to record the cumulative privacy budget ε and the cumulative distortion probability upper bound δ, and the round index.

[0290] Based on the signature domain differential privacy signature SPS dp and the privacy budget account book ε log, according to the noise variance and the unitized constraint estimate the expected deviation upper bound of cosine similarity, such as more than the threshold in the fixed total privacy budget epsilon total Inner redistribution group privacy budget epsilon g And noise scaling and dimension-by-dimension addition. Finally determine the signature field differential privacy signature SPS dp And privacy budget account book epsilon log .

[0291] According to an aspect of the application, the instantaneous modal conversion, specifically:

[0292] Read the candidate window output by the previous step, the time-aligned event sequence after time unification, and the pre-configured station and pile geographic fence. According to the outbound location and the walkable threshold, all piles are filtered to obtain the candidate pile set that is reachable in time and space. The set is used for the next step of likelihood construction and multi-hypothesis evaluation.

[0293] Read the event timing fingerprint output by the previous step, the window-level time alignment residual, and the candidate pile set obtained in the previous step. For each candidate pile, four types of factors are calculated: time consistency factor (given by the statistical probability of key time interval), event order consistency factor (given by the statistical probability of event order segment), spatial consistency factor (given by the walkable and spatial matching degree), and time residual penalty factor (the greater the alignment residual, the stronger the penalty). Multiply the four types of factors to get the overall likelihood score of each candidate pile, forming a likelihood factor table. The table is used for subsequent multi-hypothesis expansion and maximum a posteriori selection.

[0294] Read the likelihood factor table and the candidate pile set, and expand the multi-hypothesis search tree with the candidate pile as the node. Prioritize the top several branches with high scores, and prune branches with scores below the threshold. Get the hypothesis set for decision and the branch score table for the next step of comparison and conflict resolution.

[0295] Read the hypothesis set and branch score table, and compare the best hypothesis that has completed conversion with the baseline hypothesis that has not completed conversion. If the best hypothesis that has completed conversion is significantly better than the baseline hypothesis that has not completed conversion, and does not conflict with other windows of the same period, output the decision that the conversion has been completed; otherwise, output the decision that the conversion has not been completed. At the same time, give the standardized likelihood score (value from 0 to 1) for subsequent confidence fusion.

[0296] Read the likelihood score of the historical window and the corresponding artificial labeled true value, train a monotonic calibration model (such as isotonic regression or calibration based on a logical function), and map the likelihood score to a probability.

[0297] According to an aspect of the application, the process of feature weighting can be:

[0298] Read the original feature vector, confidence and alignment residual vector, alignment residual statistics, event metadata table, calculate the dimension-by-dimension weight. The dimension-by-dimension weight is obtained by fusing three factors:

[0299] The confidence factor comes from the confidence and alignment residual vector;

[0300] The residual factor comes from the alignment residual statistics;

[0301] The quality position factor comes from the event metadata table;

[0302] After nonlinear mapping and normalization of the three factors, multiply or weighted addition is performed to form the dimension-by-dimension weight.

[0303] Read the original feature vector, perform quantile truncation and normalization processing to suppress extreme values and unify the dimension; on this basis, evaluate the feature sensitivity of each dimension, that is, the upper bound of the maximum impact of the feature in the allowed change range on the signature component, and form a feature sensitivity vector accordingly.

[0304] Read the feature weight vector, apply smoothing regularization to the weight of each dimension in the same semantic group to avoid extreme amplification of a single dimension; at the same time, perform inter-group scale correction to make the overall weight of different semantic groups in a comparable range, and obtain the feature weight vector.

[0305] The method of the present application does not add noise at the original data end, but extracts high-level features and constructs a similar preservation signature first, and then applies adaptive differential privacy in the low-dimensional signature domain, that is, according to the feature importance, the privacy budget is allocated, and less noise is applied to important features, solving the problem of loss of utility caused by excessive protection. Through federal security aggregation and random masking technology, the similarity is safely calculated without converging the original text of the privacy signature, solving the privacy leakage risk brought by centralized analysis.

[0306] The method of the present application fuses multi-source sparse data such as inertial mode, cellular switching, and station flow observation in the global navigation satellite system (GNSS) missing area, and optimally adopts interactive multi-model filtering to accurately estimate the second-level arrival time. Based on high-precision time, elastic registration means such as constrained DTW are used to align the flow events, solving the problems of cross-source event (such as outbound-unlocking) association error and analysis failure caused by the lack of space-time base column.

[0307] The above describes the preferred embodiments of the present application in detail, but the present application is not limited to the specific details in the above embodiments, and various equivalent transformations can be made to the technical solutions of the present application within the technical concept range of the present application, and these equivalent transformations all belong to the protection range of the present application.

Claims

1. A method for intelligent analysis and identification of residents' travel characteristics based on multi-source data fusion, characterized in that, include: Process the raw multi-source event stream to obtain the short-window event sequence and event metadata table; Based on short-window event sequences, instantaneous modal transitions and intent switching are inferred, and instantaneous inference data is generated; Based on short-window event sequences, the arrival time in satellite-free areas is estimated, and gate zone elastic alignment is performed to generate spatiotemporal aligned data. By integrating instantaneous inference data, spatiotemporal aligned data, and event metadata tables, a similarity-preserving signature is constructed, and differential privacy of the signature domain is applied to obtain a differential privacy signature of the signature domain and a privacy budget ledger. Federal security aggregation is performed based on differential privacy signatures and privacy budget ledgers in the signature domain, and the results of family similarity analysis are output. The instantaneous inference data includes high-value event token sequences, confidence levels, and aligned residual vectors. Spatiotemporal alignment data includes time alignment labels, scene token sequences, and alignment residual statistics; The family similarity analysis results include a family similarity matrix, a list of top-k similar member pairs, and a privacy and reliability assessment report; By integrating instantaneous inference data, spatiotemporal aligned data, and event metadata tables, a similarity-preserving signature is constructed, including: Based on time alignment tags, high-value event token sequences and scene token sequences are mapped to a unified temporal raster to construct a serialized event matrix; The co-occurrence, sequence, and repetition patterns of the statistically sequenced event matrix are encoded to form the original feature vector; Based on the confidence level, alignment residual vector, alignment residual statistics, and event metadata table, the feature weights are calculated, and the original feature vectors are weighted to generate weighted feature vectors. A composite similarity kernel integrating n-gram, sequential relationship and temporal position is constructed, and the weighted feature vector is mapped to a similarity-preserving signature by using random Fourier feature approximation or Count-Sketch compression technology. Apply differential privacy to the signature domain to obtain differential privacy signatures and a privacy budget ledger, including: Based on the weighted feature vector, the feature importance of different semantic groups in similarity-preserving signatures is evaluated; Based on feature importance, differential privacy budgets are adaptively allocated to semantic groups to determine the group budget; By combining the group budget with the pre-computed feature sensitivity vector, noise is injected into the similarity-preserving signature to obtain the signature domain differential privacy signature. A budgetary accounting mechanism is used to synthesize group budgets across rounds, generating a privacy budget ledger.

2. The method according to claim 1, characterized in that, Generate spatiotemporally aligned data, including: State-space observations are constructed from short-window event sequences, including inertial mode observations, cellular switching observations, and platform-side pedestrian flow observations. By employing particle filtering or interactive multi-model filtering and fusing the above three observations, the train arrival time is estimated, and time-aligned labels and ETA confidence interval statistics are generated. Using the door opening edge identified from the short window event sequence as the main time base, the platform-side passenger flow events are flexibly registered to generate the aligned event sequence and registration residual statistics. The scene features of the aligned event sequence are extracted, a scene token sequence is generated, and the ETA confidence interval statistics and registration residual statistics are aggregated into alignment residual statistics.

3. The method according to claim 2, characterized in that, Using the door opening edge identified from the short-window event sequence as the primary time base, flexible registration is performed on the platform-side passenger flow events to generate aligned event sequences and registration residual statistics, including: Construct an alignment cost configuration function that integrates the observation time difference cost, the prior cost of detection delay, and the monotonicity constraint cost; Solve the alignment cost configuration function to obtain the flexible registration path; Smooth the flexible registration path and verify its consistency with the time alignment label to generate the aligned event sequence; Based on the calculation of point-by-point registration error using the flexible registration path, a registration residual statistics model is formed.

4. The method according to claim 1, characterized in that, Generate instantaneous inference data, including: For multi-source events in a short-window event sequence, weighted robust regression and piecewise affine mapping are used to perform cross-source temporal alignment, generating an aligned event sequence and window-level aligned residuals. Construct event sequence fingerprints for aligned event sequences; A multi-hypothesis likelihood matching method is used to compare the event time fingerprint with the preset hypothesis and generate a transition judgment label and likelihood score. When a sudden weather event is detected, the Bayesian switching state machine is activated to determine the travel intention and generate an intention switching label and the intention switching probability. The transformation judgment label, likelihood score, intent switching label, intent switching probability and window-level alignment residual are integrated to encode and generate a high-value event token sequence, and the confidence and alignment residual vector are calibrated.

5. The method according to claim 4, characterized in that, Generate the alignment event sequence and window-level alignment residual, including: Based on the device categories in the window-level observation subsequence, the historical alignment error is statistically analyzed, and the time-weighted configuration is calculated. Perform change point detection on window-level observation subsequences to identify abrupt changes in the scan cycle and divide them into sub-segments; Within each segment of the segment division, a time-weighted configuration is applied, and robust regression based on Huber loss or τ-estimation is used, combined with RANSAC outlier removal, to fit the time-weighted parameters. The window-level observation subsequence is mapped to the main time base by applying the time synchronization parameter, generating an aligned event sequence and a window-level aligned residual.

6. The method according to claim 5, characterized in that, Generate transformation decision labels and likelihood scores, including: Based on window-level observation subsequences and pre-stored geofence information, candidate vehicle-to-pile sets are filtered. For candidate vehicle-pile sets, a decomposed likelihood function is constructed, which integrates the time interval factor, sequential pattern factor, spatial consistency factor from event time sequence fingerprints, and time residual penalty factor based on window-level aligned residuals to form a likelihood factor table. Based on the candidate vehicle-pile set and the likelihood factor table, the multiple hypothesis tree is expanded and pruning is performed to retain the N-best branch; Perform maximum a posteriori selection, compare the best branch score in the N-best branches with the baseline score of the untransformed hypothesis, and output the transformation decision label and likelihood score.

7. The method according to claim 1, characterized in that, Output the family similarity analysis results, including: A random mask vector that sums to zero at the aggregation end is generated by the participating party's end; A random mask vector is applied to the differential privacy signature in the signature field to generate a masked signature and send it to the aggregation end. The aggregation end performs masked inner product calculation on the masked signature and calculates the similar entry table through the mask cancellation protocol; Based on the similarity entry list, a list of top-k similar member pairs is selected, and a family similarity matrix is ​​assembled. By combining the family similarity matrix, the list of top-k similar member pairs, the privacy budget ledger, and the similarity entry table, a privacy and reliability assessment report is generated.

Images