A method and system for dynamic security monitoring of devices based on edge computing

Abstract

This application discloses a device dynamic security monitoring method and system based on edge computing. The method performs unified adaptation and parsing of monitoring data from different scenarios at the edge node using a scenario parameter mapping table, and analyzes and transmits the data using only compressed feature packets. It enables rapid risk response at the edge node and in-depth risk analysis in the cloud, achieving the monitoring of devices in multiple different scenarios simultaneously with a unified lightweight architecture while taking into account both local response and global optimization. This is beneficial for unified management of different types of monitoring targets.

Description

Technical Field

[0001] This application relates to the field of intelligent monitoring technology, and in particular to a method and system for dynamic safety monitoring of devices based on edge computing. Background Technology

[0002] Existing safety monitoring systems suffer from problems such as data transmission lag and high power consumption. For example, traditional battery monitoring requires uploading all raw data to the cloud, resulting in high delays in abnormal warnings, and industrial equipment vibration monitoring incurs high data traffic costs due to the large amount of data.

[0003] In addition, existing safety monitoring systems can usually only monitor a single scenario, such as a single battery scenario or an industrial scenario. For example, a system that monitors electric bicycle batteries is difficult to extend to energy storage power stations or new energy vehicle batteries, and it is even more impossible to monitor data such as vibration of industrial equipment.

[0004] For some industrial parks or factories, there are situations where it is necessary to monitor multiple targets simultaneously, such as electric bicycle batteries, new energy vehicle batteries, energy storage power stations, and various industrial production equipment within the park / factory area. If a separate safety monitoring system is built for each type of monitoring target, it will undoubtedly increase the system development cost and subsequent management cost, which is not conducive to the unified management of different types of monitoring targets in the park / factory area.

[0005] Therefore, a more adaptable security monitoring method and system is needed to adapt to different monitoring scenarios while ensuring high monitoring accuracy, high data transmission rate and low data transmission cost.

[0006] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0007] The main objective of this application is to provide a method and system for dynamic security monitoring of devices based on edge computing, wherein the method is as follows.

[0008] To achieve the above objectives, in a first aspect, this application proposes a device dynamic security monitoring method based on edge computing, comprising the following steps:

[0009] Raw monitoring data is collected in parallel in each target scenario. According to the preset scenario parameter mapping table, the raw monitoring data is parsed by protocol to obtain a unified format raw monitoring dataset with scenario identifier.

[0010] According to the scene identifier, extract the original scene features from the unified format original monitoring dataset and compress them to obtain the compressed feature package corresponding to each target scene;

[0011] Assess the current risk level of the compressed feature package and generate graded early warning instructions for each target scenario according to the current risk level;

[0012] Based on the current risk level, assign corresponding data transmission strategies to the graded early warning instructions for each target scenario;

[0013] According to the transmission strategy, the data transmission packet containing target scene metadata, compressed feature packet and graded early warning instruction is sent to the cloud for in-depth processing, and the in-depth processing results from the cloud are received.

[0014] Based on the in-depth processing results, a risk analysis report is generated and visualized. Additionally, tiered early warning commands are sent to the corresponding target devices and the execution feedback from the target devices is received.

[0015] In one embodiment, the target scenarios include electric vehicle battery monitoring scenarios, energy storage power station monitoring scenarios, and industrial machinery monitoring scenarios. The method for collecting raw monitoring data in parallel in each target scenario, and parsing the raw monitoring data according to a preset scenario parameter mapping table to obtain a unified format raw monitoring dataset with scenario identifiers includes:

[0016] Send a handshake frame to the interface module that has pre-integrated interfaces for each target scenario, and obtain an input frame containing sensor data of the target device in each target scenario;

[0017] Call the preset scene parameter mapping table to obtain the correspondence between target devices, protocols and message formats in each target scene, perform protocol parsing on the input frame, and obtain the original scene parameters;

[0018] Each target device is assigned a unique device identifier and a corresponding scene identifier;

[0019] Based on the unique device identifier and scene identifier, the original scene parameters of each target device are encapsulated into multiple JSON format datasets;

[0020] After cleaning all JSON format datasets, including outlier removal and missing value completion, the resulting datasets are used as the original monitoring datasets in the unified format.

[0021] In one embodiment, the method of extracting and compressing original scene features from a uniform-format original monitoring dataset according to scene identifiers to obtain compressed feature packages corresponding to each target scene includes:

[0022] Based on the scene identifier, obtain the target scene corresponding to the JSON format dataset in the unified format original monitoring dataset;

[0023] Based on the type of the target scenario, a preset feature extraction algorithm is matched to the JSON format dataset for feature extraction and feature enhancement to obtain the original scene feature set. Specifically, sliding window smoothing is used to enhance the original scene features of the electric vehicle battery monitoring scenario, trend fitting is used to enhance the original scene features of the energy storage power station monitoring scenario, and short-time Fourier transform is used to enhance the original scene features of the industrial machinery monitoring scenario.

[0024] Obtain the preset feature safety threshold corresponding to each original scene feature in the original scene feature set;

[0025] Based on the difference between each original scene feature and the corresponding preset feature safety threshold, each original scene feature is dynamically compressed to obtain the compressed feature package corresponding to each target scene.

[0026] In one embodiment, the method for assessing the current risk level of the compressed feature packet and generating graded early warning instructions corresponding to each target scenario according to the current risk level includes:

[0027] A lightweight MLP (Multilayer Perceptron) network model is used to process compressed feature packets and to assign feature weights to scene features for each scene.

[0028] The preset risk model corresponding to each scenario is adopted, and the feature package is processed and compressed according to the allocated scenario feature weights to obtain the current risk value corresponding to each scenario. The preset risk model is configured as a prediction model of the collaborative architecture of LSTM long short-term memory network and XGBoost extreme gradient boosting model, and is configured to preset different model parameter configurations and model fusion weights according to the type of target scenario.

[0029] The system calls up a preset risk level table, determines the current risk level for each scenario based on the current risk value, and generates a graded early warning instruction for each scenario. The graded early warning instruction includes equipment control instructions and information push instructions.

[0030] In one embodiment, the lightweight MLP multilayer perceptron network model includes an input layer, a first hidden layer, a second hidden layer, and an output layer. The dimension of the input layer is the sum of the number of target scenes and the number of scene features. The first hidden layer contains 64 neurons, the second hidden layer contains 32 neurons, and the number of neurons in the output layer is the sum of the number of scene features. The method for processing compressed feature packets using the lightweight MLP multilayer perceptron network model and assigning feature weights to the scene features of each scene includes:

[0031] Convert the scene identifier corresponding to the compressed feature package into one-hot encoding;

[0032] Extract scene features from the compressed feature package, and perform Z-score standardization on the scene features to obtain standardized feature values;

[0033] One-hot encoding and standardized feature values ​​are concatenated and input into a lightweight MLP multilayer perceptron network model to obtain the initial feature weights corresponding to each standardized feature value.

[0034] Scene features are filtered according to the initial feature weights and preset weight filtering coefficients to obtain core features and core feature weights.

[0035] In one embodiment, the method of using a preset risk model corresponding to each scenario, processing and compressing feature packets according to the allocated scenario feature weights, and obtaining the current risk value corresponding to each scenario includes:

[0036] Based on the scene identifier and unique device identifier corresponding to each target device in each scenario, extract the core features and obtain the feature time series data of each target device;

[0037] The feature time series data is input into the LSTM long short-term memory network, and the time series risk score of each target device is obtained based on the core feature weights, scene identifiers and unique device identifiers.

[0038] The most recent set of data from the feature time series data is input into the XGBoost extreme gradient boosting model, and the coupling risk score of each target device is obtained based on the core feature weights, scene identifiers and unique device identifiers.

[0039] The temporal risk score and the coupling risk score are weighted and fused to obtain the current risk value of each target device.

[0040] In one embodiment, the method for allocating corresponding data transmission strategies for graded early warning instructions for each target scenario based on the current risk level includes:

[0041] Based on the current risk level, obtain the corresponding preset transmission latency requirements;

[0042] Based on the preset transmission delay requirements, a corresponding preset data transmission strategy is assigned to the graded early warning instructions corresponding to each target scenario. The preset data transmission strategy is configured to pre-match the transmission network selection, bandwidth allocation, slice priority or SLA service level protocol guarantee so that the data transmission process meets the preset transmission delay requirements corresponding to the current risk level.

[0043] In one embodiment, the method for allocating corresponding data transmission strategies for graded early warning instructions for each target scenario based on the current risk level further includes:

[0044] Based on the current risk level, assign corresponding link quality assessment strategies to the graded early warning instructions for each target scenario;

[0045] Based on the link quality assessment strategy, the signal-to-noise ratio, packet loss rate, and transmission delay during data transmission are monitored in real time.

[0046] Based on real-time monitoring results, the transmission network selection, bandwidth allocation, slice priority, or SLA service level agreement guarantee in the preset data transmission strategy are dynamically adjusted to ensure that the data transmission process meets the transmission quality requirements corresponding to the current risk level.

[0047] In one embodiment, a method for performing deep processing on a data transmission packet containing target scene metadata, compressed feature packets, and hierarchical early warning instructions in the cloud to obtain deep processing results includes:

[0048] By decompressing the compressed feature package using the target scene metadata, the decompressed restored feature data is bound to the hierarchical early warning instructions to obtain a deep processing dataset.

[0049] Based on the deep processing dataset, risk tracing is performed on each target device to obtain the risk tracing results for each device.

[0050] Based on the deep processing dataset and the risk tracing results of single devices, multi-scenario aggregation analysis is performed to obtain multi-scenario aggregation analysis results;

[0051] Based on the deep processing dataset, single-device risk tracing results, and multi-scenario aggregation analysis results, the parameters of the MLP multilayer perceptron network model or the preset risk model are optimized to obtain the model parameter optimization package.

[0052] The results of risk tracing for single devices, aggregated analysis results for multiple scenarios, and model parameter optimization packages are integrated as the results of in-depth processing.

[0053] Furthermore, to achieve the above objectives, in a second aspect, this application also proposes a device dynamic security monitoring system based on edge computing, comprising:

[0054] The data acquisition and protocol adaptation module is used to acquire raw monitoring data in parallel in various target scenarios. According to the preset scenario parameter mapping table, the module performs protocol parsing on the raw monitoring data to obtain a unified format raw monitoring dataset with scenario identifiers.

[0055] The edge node preprocessing module is used to extract the original scene features from the unified format original monitoring dataset according to the scene identifier and compress them to obtain the compressed feature package corresponding to each target scene.

[0056] The risk warning module is used to assess the current risk level of the compressed feature package and generate graded warning instructions for each target scenario according to the current risk level.

[0057] The transmission strategy matching module is used to allocate corresponding data transmission strategies for the graded early warning instructions corresponding to each target scenario based on the current risk level.

[0058] The transmission strategy execution module is used to send data transmission packets containing target scene metadata, compressed feature packets and hierarchical early warning instructions to the cloud for deep processing according to the transmission strategy, and to receive the deep processing results from the cloud.

[0059] The monitoring results display module is used to generate risk analysis reports based on in-depth processing results and to visualize them, as well as to send graded early warning instructions to the corresponding target devices and receive execution feedback from the target devices.

[0060] This application provides a device dynamic security monitoring method and system based on edge computing. The method performs unified adaptation and parsing of monitoring data from different scenarios at the edge nodes using a scenario parameter mapping table, and analyzes and transmits the data using only compressed feature packets. It enables rapid risk response at the edge nodes and in-depth risk analysis in the cloud. This achieves the monitoring of devices in multiple different scenarios simultaneously with a unified lightweight architecture, while taking into account both local response and global optimization. This is beneficial for the unified management of different types of monitoring targets. Attached Figure Description

[0061] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0062] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a flowchart illustrating an embodiment of a device dynamic security monitoring method based on edge computing according to this application.

[0064] Figure 2 This is a schematic diagram of the structure of an embodiment of a device dynamic safety monitoring system based on edge computing provided in this application;

[0065] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0066] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments. The components of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0067] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0068] This application provides a device dynamic security monitoring method based on edge computing, referring to... Figure 1 This includes the following steps:

[0069] Step S1: Collect raw monitoring data in parallel in each target scene, and perform protocol parsing on the raw monitoring data according to the preset scene parameter mapping table to obtain a unified format raw monitoring dataset with scene identifiers.

[0070] Step S2: According to the scene identifier, extract the original scene features from the unified format original monitoring dataset and compress them to obtain the compressed feature package corresponding to each target scene;

[0071] Step S3: Assess the current risk level of the compressed feature package and generate graded early warning instructions corresponding to each target scenario according to the current risk level;

[0072] Step S4: Based on the current risk level, assign corresponding data transmission strategies to the graded early warning instructions for each target scenario;

[0073] Step S5: Send the data transmission packet containing the target scene metadata, compressed feature packet and graded early warning instruction to the cloud for deep processing according to the transmission strategy, and receive the deep processing results from the cloud.

[0074] Step S6: Generate a risk analysis report based on the deep processing results and visualize it; send the graded early warning instructions to the corresponding target devices and receive the execution feedback from the target devices.

[0075] Specifically, in this embodiment, the target scenario in step S1 refers to various monitoring scenarios that require equipment monitoring. Based on differences in monitoring data types, protocol types, etc., the monitoring scenarios will be classified. The original monitoring data is the monitoring data directly acquired by the monitoring devices such as sensors that directly monitor the target scenario. For example, monitoring electric bicycle batteries and monitoring new energy vehicle batteries can be uniformly classified as vehicle battery monitoring scenarios. The original monitoring data that needs to be monitored may include battery cell voltage, battery cell temperature, battery SOC, and battery charging current. Monitoring wind turbines, on the other hand, belongs to industrial machinery monitoring scenarios. The original monitoring data that needs to be monitored may include vibration acceleration, motor temperature, bearing speed, and bearing temperature.

[0076] The scene parameter mapping table is used to characterize the correspondence between target devices, protocols, and message formats in various target scenarios, so as to convert the messages with raw monitoring data transmitted by each target device in different protocols into accurate values. For example, for the message 0x03E8 0x012C 0x0064 0x00C8 transmitted by an electric bicycle in CAN protocol, 0x03E8 will be interpreted as battery voltage 1.00V, 0x012C will be interpreted as battery temperature 30.0℃, 0x0064 will be interpreted as battery SOC 100%, and 0x00C8 will be interpreted as battery charging current 2.00A.

[0077] Scene identifiers are used to identify the scene type corresponding to the target device. Of course, a unique device identifier will also be set for the target device to locate each target device. The unique device identifier can also include the scene identifier.

[0078] The data parsed and converted from the message, along with the assigned scene identifier and device unique identifier, can be encapsulated in JSON format as a unified format of raw monitoring dataset. Through the strong structure, strict field definition, and small data size of JSON format, efficient parsing and lightweight transmission can be achieved.

[0079] In step S2, the original scene features can be a single feature such as the change amount / trend of a certain parameter in the original monitoring data, or they can be the combined features of two or more parameters in the original monitoring data, used to determine the potential risks of the target device.

[0080] PCA dimensionality reduction technology and LZW / LZ4 compression technology can be used to process the original scene features, reduce the dimensionality of the original scene features and / or compress the parameters of the original scene features, so as to improve transmission efficiency while retaining key original scene features.

[0081] In step S3, after obtaining the compressed feature package, the first risk prediction can be performed at the edge node using a pre-trained prediction model to obtain the risk level. Then, based on the target device, risk level, and original scene features where the anomaly occurred, the preset instruction table is queried to automatically generate the corresponding graded warning instruction. The warning instruction can include instructions such as execution object, action, and parameters to handle potential and existing risks in a timely manner.

[0082] In step S4, due to the limited computing power of edge nodes, in order to transmit data to the cloud for further in-depth processing while ensuring timeliness, some data transmission strategies will be preset to ensure transmission rate and transmission stability.

[0083] In step S5, data over a period of time is transmitted to the cloud for long-term prediction and monitoring. The cloud can obtain more data for analysis, such as obtaining more accurate analysis results to review the analysis results of edge nodes, or to conduct in-depth risk tracing of single-target devices. Of course, the cloud can also compare its own prediction results with the prediction results of edge nodes and provide optimized parameters for the prediction model of edge nodes.

[0084] The target scenario metadata mainly includes various types of identification data, such as scenario identifier, unique device identifier, data time sequence identifier, transmission / parsing constraint identifier, compression algorithm identifier, verification algorithm identifier, security compliance identifier, timestamp identifier, etc., which are used to ensure the traceability, adaptability, compliance and accuracy of data transmission packets during the transmission process.

[0085] After the above-mentioned in-depth processing, the in-depth processing results output by the cloud will be sent back to the system that executed the method. Then, step S6 will be used to generate a risk analysis report and visualize it, as well as execute graded early warning instructions and receive corresponding feedback, thus achieving a closed loop.

[0086] Furthermore, in an optional implementation, the target scenario type includes electric vehicle battery monitoring scenario, energy storage power station monitoring scenario, and industrial machinery monitoring scenario, and step S1 specifically includes:

[0087] Step S101: Send a handshake frame to the interface module that has pre-integrated interfaces for each target scene, and obtain an input frame containing sensor data of the target device in each target scene.

[0088] Step S102: Call the preset scene parameter mapping table to obtain the correspondence between target devices, protocols and message formats in each target scene, perform protocol parsing on the input frame, and obtain the original scene parameters;

[0089] Step S103: Assign a unique device identifier and a corresponding scene identifier to each target device;

[0090] Step S104: According to the unique device identifier and scene identifier, encapsulate the original scene parameters of each target device into multiple JSON format datasets;

[0091] Step S105: After cleaning all JSON format datasets, including outlier removal and missing value completion, the resulting datasets are used as the unified format original monitoring datasets.

[0092] In this embodiment, three target scenarios are set up: electric vehicle battery monitoring scenario, energy storage power station monitoring scenario, and industrial machinery monitoring scenario, which can be applied to most industrial parks;

[0093] Specifically, for electric vehicle battery monitoring scenarios, the original scenario parameters include battery cell voltage, battery cell temperature, battery SOC, and battery charging current. For energy storage power station monitoring scenarios, the original scenario parameters include string total voltage, string total current, string balance, and individual cell voltage balance difference. For industrial machinery monitoring scenarios, such as wind turbines, the original scenario parameters include vibration acceleration, motor temperature, bearing speed, and bearing temperature.

[0094] The handshake frame is used for protocol identification. For example, the handshake frame is 0x01 for the CAN protocol of electric vehicles, 0x02 for the RS485 protocol of energy storage power stations, and a TCP SYN packet is sent for the Ethernet of wind turbines. At the same time, if no response is received after sending the handshake frame, it can be determined that the interface has failed. The input frame is the message with the original monitoring data mentioned above.

[0095] Specifically, the JSON format dataset for electric vehicles (electric bicycles) is as follows:

[0096] {

[0097] "device_id": "EB-001-2025", / / Unique device identifier (device scene sub-identifier + number + year)

[0098] "scene_type": 1, / / Scene identifier, 1=Electric vehicle, 2=Energy storage, 3=Industrial

[0099] "timestamp": "2025-11-21T09:30:01.456Z", / / UTC timestamp (milliseconds)

[0100] "raw_params": {

[0101] "cell_voltage": 3.75, / / Cell voltage (V)

[0102] "cell_temperature": 32.5, / / Cell temperature (°C)

[0103] "soc": 85, / / Battery SOC (%)

[0104] "charge_current": 2.00, / / Battery charging current (A)

[0105] "string_total_voltage": null, / / Total voltage of the string, set to null if not applicable to this scenario.

[0106] "string_total_current": null, / / Total string current, set to null if not applicable to this scenario.

[0107] "string_balance_rate": null, / / String balance rate; set to null if not applicable to this scenario.

[0108] "cell_voltage_diff": null, / / Cell voltage equalization difference; set to null for parameters not applicable to this scenario.

[0109] "vibration_acceleration": null, / / Vibration acceleration; set to null if not a parameter for this scenario.

[0110] "motor_temperature": null, / / Motor temperature; set to null if not a parameter for this scenario.

[0111] "bearing_speed": null, / / Bearing speed; set to null if not applicable to this scenario.

[0112] "bearing_temperature": null / / Bearing temperature, set to null if not a parameter for this scenario.

[0113] },

[0114] "crc_code": "0x2B4D", / / CRC16 checksum to prevent data tampering

[0115] "interface_status": "normal" / / Interface status (normal / error)

[0116] }

[0117] Outlier removal can be based on the 3σ criterion. First, calculate the historical mean (μ) and standard deviation (σ) of each parameter. Values ​​exceeding the range of [μ-3σ, μ+3σ] are marked as outliers. For short-term missing values, such as within 3 seconds, linear interpolation can be used for completion. For long-term missing values, the historical mean of the same period is used for completion.

[0118] Furthermore, in an alternative implementation, step S2 includes:

[0119] Step S201: According to the scene identifier, obtain the target scene corresponding to the JSON format dataset in the unified format original monitoring dataset;

[0120] Step S202: Based on the type of the target scenario, a preset feature extraction algorithm is matched to the JSON format dataset for feature extraction and feature enhancement to obtain the original scene feature set. Among them, sliding window smoothing is used to enhance the original scene features of the electric vehicle battery monitoring scenario, trend fitting is used to enhance the original scene features of the energy storage power station monitoring scenario, and short-time Fourier transform is used to enhance the original scene features of the industrial machinery monitoring scenario.

[0121] Step S203: Obtain the preset feature security threshold corresponding to each original scene feature in the original scene feature set;

[0122] Step S204: Based on the difference between each original scene feature and the corresponding preset feature security threshold, dynamically compress each original scene feature to obtain the compressed feature package corresponding to each target scene.

[0123] Specifically, this implementation method is an improvement on the previous implementation method. The original scenario parameters are the same. The original scenario features corresponding to the electric vehicle battery monitoring scenario include the battery cell voltage mutation rate, battery charging current change rate, SOC-temperature coupling characteristics, and battery cell voltage-battery cell current coordination characteristics. The original scenario features of the energy storage power station monitoring scenario include string balance trend, cell voltage balance difference trend, total power characteristics, and total voltage fluctuation coefficient. The original scenario features of the industrial machinery monitoring scenario (wind turbine) include bearing characteristic frequency, temperature-vibration coupling characteristics, motor-bearing temperature difference characteristics, and speed-vibration coordination characteristics.

[0124] When performing feature enhancement, for electric vehicle batteries, a sliding window smoothing combined with 3σ outlier secondary filtering is used. The 3σ criterion is used to accurately remove instantaneous noise from the sensor, and the sliding window smoothing filters high-frequency jitter, which can reduce the false alarm rate. At the same time, the fluctuation amplitude of the smoothed feature data is reduced, which makes it easier to accurately identify core features when performing subsequent weight allocation.

[0125] For energy storage power stations, trend fitting can accurately capture the trend of equilibrium degree and the trend of equilibrium difference, thereby reducing the false alarm rate. At the same time, the trend data after linear regression fitting has a high degree of standardization, which is convenient for subsequent steps to make predictions.

[0126] For industrial machinery (fans), short-time Fourier transform can convert the time-domain signal of vibration acceleration into time-frequency characteristics, accurately identify the characteristic frequency of bearing outer ring wear, improve early warning accuracy, and reduce the impact of environmental noise by separating the useful vibration signal from electromagnetic interference noise.

[0127] During dynamic compression, if the difference is small, the dimensionality reduction dimension is increased to retain more details; if the difference is large, the dimensionality reduction dimension is reduced to improve compression efficiency. The threshold for large or small difference is set according to the actual situation. Here, PCA dimensionality reduction technology and LZW / LZ4 compression technology are also used. In addition, after compression is completed, an SHA-256 checksum will be generated for subsequent transmission verification.

[0128] In one optional implementation, step S3 includes:

[0129] Step S301: Use a lightweight MLP multilayer perceptron network model to process the compressed feature package and assign feature weights to the scene features of each scene.

[0130] Step S302: Using the preset risk model corresponding to each scenario, the feature package is processed and compressed according to the allocated scenario feature weights to obtain the current risk value corresponding to each scenario. The preset risk model is configured as a prediction model of LSTM and XGBoost collaborative architecture, and is configured to preset different model parameter configurations and model fusion weights according to the type of target scenario.

[0131] Step S303: Call the preset risk level table, determine the current risk level of each scenario based on the current risk value, and generate a graded early warning instruction for each scenario. The graded early warning instruction includes equipment control instructions and information push instructions.

[0132] Furthermore, the lightweight MLP multilayer perceptron network model includes an input layer, a first hidden layer, a second hidden layer, and an output layer. The dimension of the input layer is the sum of the number of target scenes and the number of scene features. The first hidden layer contains 64 neurons, the second hidden layer contains 32 neurons, and the number of neurons in the output layer is the sum of the number of scene features. Step S301 includes:

[0133] Step S3011: Convert the scene identifier corresponding to the compressed feature package into one-hot encoding;

[0134] Step S3012: Extract scene features from the compressed feature package, perform Z-score standardization on the scene features, and obtain standardized feature values;

[0135] Step S3013: Concatenate the one-hot encoding and the standardized feature values, input them into the lightweight MLP multilayer perceptron network model, and obtain the initial feature weights corresponding to each standardized feature value;

[0136] Step S3014: Filter scene features according to the initial feature weights and preset weight filtering coefficients to obtain core features and core feature weights.

[0137] Specifically, when training the lightweight MLP multilayer perceptron network model, 1000 samples can be prepared for each scene. Core feature values ​​are randomly generated according to normal and abnormal intervals, non-core feature values ​​are randomly generated according to normal intervals, and sample labels are generated according to the set MLP target weight range and superimposed with ±0.02 random noise to generate samples. Adam is used as the optimizer, the learning rate is set to 0.001, the mean squared error of MSE is used as the loss function, the training epochs are set to 100 epochs and an early stopping mechanism is set. If the validation set loss does not decrease after 3 epochs, the training is stopped. At the same time, L2 regularization (λ=0.0001) is added to avoid overfitting.

[0138] To adapt to edge nodes, INT8 quantization can be used to compress the MLP size. The MLP model parameters (weights / biases) are stored in the eMMC of the edge node, further reducing the space occupied. TensorRT (NVIDIA edge node) or OpenVINO (Intel edge node) can be used as the inference engine to reduce inference time.

[0139] By adopting this implementation method, differentiated weights are set for different scenarios, high weights are assigned to core risk features, and the output weights of 0-1 can be directly used for risk value weighting calculation in the future, which significantly improves the accuracy of early warning.

[0140] Furthermore, step S302 includes:

[0141] Step S3021: Extract core features based on the scene identifier and unique device identifier corresponding to each target device in each scene, and obtain the feature time series data of each target device;

[0142] Step S3022: Input the feature time series data into the LSTM long short-term memory network, and obtain the time series risk score of each target device based on the core feature weights, scene identifiers and unique device identifiers;

[0143] Step S3023: Input the most recent set of data from the feature time series data into the XGBoost extreme gradient boosting model, and obtain the coupling risk score of each target device based on the core feature weights, scene identifiers and unique device identifiers.

[0144] Step S3024: Perform weighted fusion of the temporal risk score and the coupling risk score to obtain the current risk value of each target device;

[0145] Specifically, in this embodiment, the feature time series data is obtained by extracting features from the time series data of the target device within the most recent N seconds, sorting them by timestamp to form a time series window for LSTM input, and sorting them by timestamp to use the most recent set of data in the feature time series data as the input of the XGBoost extreme gradient boosting model.

[0146] The LSTM (Long Short-Term Memory) network consists of an input layer, a third hidden layer, a fourth hidden layer, and an output layer. The input layer has the dimension of the number of core features multiplied by the temporal window length. The third hidden layer contains 64 neurons, and the fourth hidden layer contains 32 neurons, both of which use the ReLU activation function. The output layer contains one neuron, which uses the Sigmoid activation function and outputs a temporal risk score of 0-100.

[0147] The XGBoost extreme gradient boosting model is optimized by pruning, with 100 trees, a maximum tree depth of 5, a learning rate of 0.1, and outputs a coupling risk score of 0-100.

[0148] Different weighted combinations can be assigned to different scenarios. For example, for vehicle batteries, the risks are mostly time-series changes (precursors to thermal runaway), so the weight of the LSTM long short-term memory network is increased to 0.65. For energy storage power stations, the risks are mostly a combination of time-series trends and feature coupling (such as poor contact combined with cell aging), so the weights are balanced and all are 0.5. For wind turbines, the risks are mostly triggered by multiple features (such as vibration combined with temperature difference and frequency anomalies), so the weight of the XGBoost extreme gradient boosting model is increased to 0.6.

[0149] Compared to single-model prediction, this implementation method achieves higher prediction accuracy. Furthermore, both models are lightweighted, making them more suitable for edge nodes.

[0150] After obtaining the current risk value, the preset risk level table can be called to determine the current risk level of each scenario based on the current risk value and generate the corresponding graded early warning instructions for each scenario. The equipment control instructions are mainly instructions to control the action of the target equipment, and the information push instructions are mainly instructions to push the current risk to relevant personnel.

[0151] Tiered early warning instructions can be generated by querying a preset instruction table. Based on the scenario type, risk level, and core abnormal characteristics, the instruction table is matched to generate specific operation instructions (including execution object, action, parameters, etc.).

[0152] In one specific implementation, the tiered warning instructions are in structured Protobuf format, which has a higher compression ratio than JSON format, as shown below:

[0153] / / Example of P1 Class Electric Vehicle Commands

[0154] syntax = "proto3";

[0155] message EarlyWarning {

[0156] string device_id = 1; / / Unique device identifier: "EB-001-2025"

[0157] int32 scene_type = 2; / / Scene type: 1

[0158] int32 warning_level = 3; / / Warning level: 1 (P1)

[0159] double risk_value = 4; / / Final risk value: 0.83

[0160] int64 timestamp = 5; / / Instruction generation timestamp: 1732162201456 (milliseconds)

[0161] repeated ControlCommand control_cmds = 6; / / List of device control commands

[0162] repeated NotifyCommand notify_cmds = 7; / / List of push notification commands

[0163] }

[0164] / / Device control commands

[0165] message ControlCommand {

[0166] string cmd_type = 1; / / Command type: "charge_current_down" (reduce charging current)

[0167] double param = 2; / / Command parameter: 1.0 (target current A)

[0168] int32 timeout = 3; / / Instruction validity period: 10 (seconds)

[0169] string target_device = 4; / / Target device: "bms_controller" (BMS controller)

[0170] }

[0171] / / Information push command

[0172] message NotifyCommand {

[0173] string notify_type = 1; / / Push type: "app" (APP push), "sms" (SMS), "call" (voice)

[0174] string receiver = 2; / / Recipient: "phone number and / or email address"

[0175] string content = 3; / / Push notification content: "Electric vehicle EB-001 charging current overcurrent, reduced to 1.0A, please check!"

[0176] }

[0177] In one alternative implementation, step S4 includes:

[0178] Step S401: Obtain the corresponding preset transmission delay requirements based on the current risk level;

[0179] Step S402: According to the preset transmission delay requirements, allocate corresponding preset data transmission strategies to the graded early warning instructions corresponding to each target scenario. The preset data transmission strategy is configured to pre-match transmission network selection, bandwidth allocation, slice priority or SLA service level protocol guarantee so that the data transmission process meets the preset transmission delay requirements corresponding to the current risk level.

[0180] Specifically, the current risk level can be divided into three types: emergency risk, general risk, and no risk. The latency requirement for emergency risk is less than 100ms, the latency requirement for general risk is less than 500ms, and the latency requirement for no risk is less than 1000ms.

[0181] The default data transmission strategy for emergency risks is to use a standalone 5G slice with an SA architecture as the transmission network, with an uplink bandwidth of 10Mbps and a downlink bandwidth of 5Mbps, using the UDP transmission protocol, with the slice priority being the highest (preempting 30% of the bandwidth of non-emergency slices), and the SLA service level agreement promising latency <100ms and packet loss rate <0.1%;

[0182] The default data transmission strategy for general risks is to use the 4G public network as the transmission network, with an uplink bandwidth of 2Mbps, a downlink bandwidth of 1Mbps, a TCP transmission protocol, a QoS service quality level of EF (emergency service), and a bandwidth guarantee of 2Mbps uplink.

[0183] The default data transmission strategy for risk-free scenarios is to use Ethernet as the transmission network, with an uplink bandwidth of 1Mbps and a downlink bandwidth of 0.5Mbps, using the MQTT transmission protocol, and setting the batch transmission window to 00:00-02:00 per day.

[0184] Furthermore, step S4 also includes:

[0185] Step S403: Based on the current risk level, assign corresponding link quality assessment strategies to the graded early warning instructions for each target scenario;

[0186] Step S404: Based on the link quality assessment strategy, monitor the signal-to-noise ratio, packet loss rate, and transmission delay in real time during data transmission.

[0187] Step S405: Based on the real-time monitoring results, dynamically adjust the transmission network selection, bandwidth allocation, slice priority, or SLA service level agreement guarantee in the preset data transmission strategy so that the data transmission process meets the transmission quality requirements corresponding to the current risk level.

[0188] Specifically, the signal-to-noise ratio, packet loss rate, and transmission delay were monitored at frequencies of 10Hz, 5Hz, and 20Hz, respectively.

[0189] For signal-to-noise ratio, the conditions for triggering dynamic adjustment are: emergency risk less than 10dB, general risk less than 8dB, and no risk less than 6dB. After the adjustment is triggered, emergency risk is switched to a higher priority link or signal power enhancement is enabled, general risk is switched to a backup link of the same priority or channel coding optimization is enabled, and no risk reduces the data modulation rate.

[0190] For packet loss rate, the conditions for triggering dynamic adjustment are as follows: emergency risk greater than 0.1%, general risk greater than 1%, and no risk greater than 3%. After the adjustment is triggered, emergency risk is switched to a low packet loss link, or RS (255, 239) FEC encoding is enabled, with 16 bytes of check added for every 239 bytes to correct 8-byte errors. General risk is switched to a low packet loss slice of the same priority, or FEC encoding is enabled and the encoding efficiency is improved from RS (255, 239) to RS (255, 223) to correct 16-byte errors. No risk enables selective retransmission, only retransmitting data packets that have been lost more than 3 times in a row, and assigning a data to be retransmitted an identifier for retransmission during off-peak periods.

[0191] For transmission latency, the conditions for triggering dynamic adjustment are as follows: emergency risk greater than 100ms, general risk less than 500ms, and no risk greater than 1000ms. After the adjustment is triggered, emergency risk switches to a low-latency link or disables unnecessary data compression, general risk switches to a low-latency slice of the same priority or optimizes data encapsulation to reduce JSON field redundancy, and no risk enables batch packet transmission to reduce the number of transmissions. In addition, a high latency indicator is assigned, and retransmission is performed during off-peak periods.

[0192] In one optional implementation, during step S5, a method for performing deep processing on the data transmission packet containing target scene metadata, compressed feature packets, and hierarchical early warning instructions in the cloud to obtain the deep processing result includes:

[0193] Step S501: Decompress the compressed feature package using the target scene metadata, bind the decompressed restored feature data with the hierarchical early warning instructions, and obtain a deep processing dataset.

[0194] Step S502: Based on the deep processing dataset, perform single-device risk tracing for each target device to obtain single-device risk tracing results;

[0195] Step S503: Based on the deep processing dataset and the risk tracing results of a single device, perform multi-scenario aggregation analysis to obtain the multi-scenario aggregation analysis results;

[0196] Step S504: Based on the deep processing dataset, single-device risk tracing results, and multi-scenario aggregation analysis results, optimize the parameters of the MLP multilayer perceptron network model or the preset risk model to obtain the model parameter optimization package.

[0197] Step S505: Integrate the single-device risk tracing results, multi-scenario aggregated analysis results, and model parameter optimization package as the deep processing results;

[0198] Specifically, by extracting scene identifiers, device unique identifiers, compression algorithm identifiers, and verification algorithm identifiers from the target scene metadata, all scene features are decompressed from the compressed feature package to restore them as restored feature data. Then, the restored feature data is bound to the hierarchical early warning instructions through the device unique identifier and timestamp identifier to obtain a deep processing dataset.

[0199] The system calls the safety threshold table of scene features, uses the 3σ criterion and sliding window to detect feature anomalies within a certain period of time (such as one hour), sorts the obtained feature anomalies according to the timestamp, and verifies the causal relationship in combination with the physical logic of the equipment to generate the time sequence link of initial anomaly, anomaly propagation, and early warning trigger. For example, based on the physical logic of the equipment that voltage fluctuations lead to a decrease in the balance degree and then to an increase in the balance difference, the system obtains the time sequence link of voltage fluctuation exceeding the standard at time t2 leading to an increase in the balance difference at time t1, which leads to an early warning.

[0200] Risks can be identified in batches by statistically analyzing the proportion of abnormal features and the frequency of warnings. For example, if the number of abnormal battery occurrences in a certain monitoring area of ​​the park exceeds the standard, the same model and batch of electric vehicle batteries can be located in all monitoring areas of the park based on the model and batch of the electric vehicle battery. Furthermore, interference between different scenarios can be located by calculating the correlation of core features between different scenarios, so as to achieve multi-scenario aggregation analysis.

[0201] By statistically analyzing the accuracy of warning commands in various scenarios and combining them with global feature distribution, the risk warning threshold is adjusted. In addition, accurate fault and false alarm samples are used as incremental data to train MLP models, LSTM long short-term memory networks, or XGBoost extreme gradient boosting models in the cloud to obtain model parameter optimization packages.

[0202] In step S6, the single-device risk tracing results, multi-scenario aggregated analysis results, and model parameter optimization packages included in the deep processing results are filled into the risk analysis report target to obtain the risk analysis report;

[0203] Execution feedback includes execution status feedback, execution result feedback, and exception information feedback, all encapsulated in JSON format and aligned with the data transmission packet fields. For example, execution status feedback includes three execution states: success, failure, and execution in progress, an execution timestamp, and a unique device identifier for the target device, used to quickly determine whether the instruction has been received and executed by the execution end of the target device. Execution result feedback includes key parameters after execution and whether the result meets the standard. Exception information feedback includes error codes, error descriptions, and error levels.

[0204] This application also provides a device dynamic security monitoring system based on edge computing, see below. Figure 2 ,include:

[0205] The data acquisition and protocol adaptation module is used to acquire raw monitoring data in parallel in various target scenarios. According to the preset scenario parameter mapping table, the module performs protocol parsing on the raw monitoring data to obtain a unified format raw monitoring dataset with scenario identifiers.

[0206] The edge node preprocessing module is used to extract the original scene features from the unified format original monitoring dataset according to the scene identifier and compress them to obtain the compressed feature package corresponding to each target scene.

[0207] The risk warning module is used to assess the current risk level of the compressed feature package and generate graded warning instructions for each target scenario according to the current risk level.

[0208] The transmission strategy matching module is used to allocate corresponding data transmission strategies for the graded early warning instructions corresponding to each target scenario based on the current risk level.

[0209] The transmission strategy execution module is used to send data transmission packets containing target scene metadata, compressed feature packets and hierarchical early warning instructions to the cloud for deep processing according to the transmission strategy, and to receive the deep processing results from the cloud.

[0210] The monitoring results display module is used to generate risk analysis reports based on in-depth processing results and to visualize them, as well as to send graded early warning instructions to the corresponding target devices and receive execution feedback from the target devices.

[0211] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. An edge-computing-based device dynamic security monitoring method, characterized in that, The method comprises the following steps: Parallelly collecting original monitoring data in each target scene, performing protocol analysis on the original monitoring data according to a preset scene parameter mapping table, and obtaining a unified format original monitoring data set with a scene identifier; According to the scene identifier, extracting original scene features in the unified format original monitoring data set and compressing the original scene features to obtain a compressed feature package corresponding to each target scene; Evaluating the current risk level of the compressed feature package, and generating a hierarchical early warning instruction corresponding to each target scene according to the current risk level, The method comprises using a lightweight MLP multi-layer perceptron network model to process the compressed feature package and assign feature weights to the scene features of each scene; According to the current risk level, assign a corresponding data transmission strategy to the hierarchical early warning instruction corresponding to each target scene; According to the transmission strategy, send a data transmission package containing target scene metadata, compressed feature packages and hierarchical early warning instructions to the cloud for deep processing, and receive the deep processing result from the cloud; According to the deep processing result, generate a risk analysis report and visually display it, and send the hierarchical early warning instruction to the corresponding target device and receive the execution feedback of the target device; The lightweight MLP multi-layer perceptron network model comprises an input layer, a first hidden layer, a second hidden layer and an output layer, wherein the dimension of the input layer is the sum of the number of target scenes and the number of scene features, the first hidden layer contains 64 neurons, the second hidden layer contains 32 neurons, and the number of neurons in the output layer is the sum of the number of scene features. The method of using a lightweight MLP multi-layer perceptron network model to process compressed feature packages and assign feature weights to scene features of each scene comprises: Convert the scene identifier corresponding to the compressed feature package into a one-hot encoding; Extract the scene features from the compressed feature package, and obtain standardized feature values by standardizing the scene features by Z-score; Concatenate the one-hot encoding and the standardized feature values, input them into the lightweight MLP multi-layer perceptron network model, and obtain initial feature weights corresponding to each standardized feature value; According to the initial feature weights and a preset weight screening coefficient, screen the scene features to obtain core features and core feature weights; In addition, the method for deep processing of the data transmission package containing target scene metadata, compressed feature packages and hierarchical early warning instructions in the cloud to obtain a deep processing result comprises: Decompress the compressed feature package through the target scene metadata, bind the restored feature data obtained by decompression with the hierarchical early warning instruction to obtain a deep processing data set; According to the deep processing data set, perform single-device risk tracing on each target device to obtain a single-device risk tracing result; According to the deep processing data set and the single-device risk tracing result, perform multi-scene aggregation analysis to obtain a multi-scene aggregation analysis result; According to the deep processing data set, the single-device risk tracing result and the multi-scene aggregation analysis result, optimize the parameters of the MLP multi-layer perceptron network model or the preset risk model to obtain a model parameter optimization package; Integrate the single-device risk tracing result, the multi-scene aggregation analysis result and the model parameter optimization package as the deep processing result. 2.The edge computing based device dynamic security monitoring method of claim 1, wherein, The type of the target scene includes an electric vehicle battery monitoring scene, a energy storage power station monitoring scene and an industrial machine monitoring scene, the method for collecting original monitoring data in parallel in each target scene, performing protocol analysis on the original monitoring data according to a preset scene parameter mapping table, and obtaining a unified format original monitoring data set with a scene identifier, comprising: sending a handshake frame to an interface module pre-integrated with interfaces of each target scene, and obtaining an input frame containing sensor data corresponding to a target device in each target scene; calling a preset scene parameter mapping table to obtain a corresponding relationship between a target device, a protocol and a message format in each target scene, performing protocol analysis on the input frame, and obtaining original scene parameters; assigning a unique device identifier and a corresponding scene identifier to each target device; encapsulating the original scene parameters of each target device into a plurality of JSON format data sets according to the unique device identifier and the scene identifier; after data cleaning including outlier removal and missing value completion, all JSON format data sets are used as the unified format original monitoring data set. 3.The edge computing based device dynamic security monitoring method of claim 2, wherein, The method for extracting original scene features in the unified format original monitoring data set and compressing them according to the scene identifier to obtain a compressed feature package corresponding to each target scene, comprising: according to the scene identifier, obtaining a target scene corresponding to a JSON format data set in the unified format original monitoring data set; according to the type of the target scene, matching a preset feature extraction algorithm for the JSON format data set to perform feature extraction and feature enhancement, and obtaining an original scene feature set, wherein the original scene features of the electric vehicle battery monitoring scene are enhanced by using a sliding window smoothing, the original scene features of the energy storage power station monitoring scene are enhanced by using trend fitting, and the original scene features of the industrial machine monitoring scene are enhanced by using short-time Fourier transform; obtaining a preset feature safety threshold corresponding to each original scene feature in the original scene feature set; according to the difference between each original scene feature and the corresponding preset feature safety threshold, respectively compressing each original scene feature to obtain a compressed feature package corresponding to each target scene. 4.The edge computing based device dynamic security monitoring method of claim 2, wherein, The method for evaluating the current risk level of the compressed feature package and generating a hierarchical early warning instruction corresponding to each target scene according to the current risk level, further comprising: using a preset risk model corresponding to each scene to process the compressed feature package according to the assigned scene feature weight, to obtain a current risk value corresponding to each scene, wherein the preset risk model is configured as a prediction model of an LSTM and XGBoost collaborative architecture, and is configured to preset different model parameter configurations and model fusion weights according to the type of the target scene; calling a preset risk level table to determine the current risk level corresponding to each scene according to the current risk value and generate a hierarchical early warning instruction corresponding to each scene, wherein the hierarchical early warning instruction includes a device control instruction and an information push instruction. 5.The edge computing based device dynamic security monitoring method of claim 4, wherein, The method for using a preset risk model corresponding to each scene to process the compressed feature package according to the assigned scene feature weight to obtain a current risk value corresponding to each scene, comprising: According to the scene identification and unique device identification corresponding to each target device in each scene, core features are extracted, and feature time sequence data of each target device is obtained; The feature time sequence data is input into the LSTM long short-term memory network, and the time sequence risk score of each target device is obtained according to the core feature weight, scene identification and unique device identification; The latest group of data in the feature time sequence data is input into the XGBoost extreme gradient boosting model, and the coupling risk score of each target device is obtained according to the core feature weight, scene identification and unique device identification; The time sequence risk score and the coupling risk score are weighted and fused to obtain the current risk value of each target device. 6.The edge computing based device dynamic security monitoring method of claim 1, wherein, The method for assigning corresponding data transmission strategies to the hierarchical early warning instructions corresponding to each target scene according to the current risk level comprises: According to the current risk level, the corresponding preset transmission time delay requirement is obtained; According to the preset transmission time delay requirement, the preset data transmission strategy corresponding to the hierarchical early warning instruction of each target scene is assigned, wherein the preset data transmission strategy is configured to pre-match transmission network selection, bandwidth allocation, slice priority or SLA service level agreement guarantee, so that the data transmission process meets the preset transmission time delay requirement corresponding to the current risk level. 7.The edge computing based device dynamic security monitoring method of claim 6, wherein, The method for assigning corresponding data transmission strategies to the hierarchical early warning instructions corresponding to each target scene according to the current risk level further comprises: According to the current risk level, the corresponding link quality evaluation strategy is assigned to the hierarchical early warning instruction of each target scene; According to the real-time monitoring result, the transmission network selection, bandwidth allocation, slice priority or SLA service level agreement guarantee in the preset data transmission strategy are dynamically adjusted, so that the data transmission process meets the transmission quality requirement corresponding to the current risk level. It comprises:

8. An edge computing based device dynamic security monitoring system, characterized in that, The data acquisition and protocol adaptation module is used for collecting original monitoring data in each target scene in parallel, performing protocol analysis on the original monitoring data according to the preset scene parameter mapping table, and obtaining a unified format original monitoring data set with scene identification; The edge node preprocessing module is used for extracting original scene features in the unified format original monitoring data set according to the scene identification and compressing to obtain compressed feature packages corresponding to each target scene; The risk early warning module is used for evaluating the current risk level of the compressed feature package, and generating hierarchical early warning instructions corresponding to each target scene according to the current risk level, It comprises, using a lightweight MLP multi-layer perceptron network model to process the compressed feature package, and assigning feature weights to the scene features of each scene; The transmission strategy matching module is used for assigning corresponding data transmission strategies to the hierarchical early warning instructions corresponding to each target scene according to the current risk level; The transmission strategy execution module is used for sending data transmission packets containing target scene metadata, compressed feature packages and hierarchical early warning instructions to the cloud for deep processing according to the transmission strategy, and receiving the deep processing result from the cloud; ​ The monitoring result display module is configured to generate a risk analysis report and visually display the report based on the deep processing result, and send a hierarchical early warning instruction to a corresponding target device and receive an execution feedback from the target device. The lightweight MLP network model includes an input layer, a first hidden layer, a second hidden layer, and an output layer, wherein the dimension of the input layer is the sum of the number of target scenes and the number of scene features, the first hidden layer includes 64 neurons, the second hidden layer includes 32 neurons, and the number of neurons of the output layer is the sum of the number of scene features. The method for processing the compressed feature package by using the lightweight MLP network model and allocating feature weights to the scene features of each scene includes the following steps: Converting the scene identifier corresponding to the compressed feature package into one-hot encoding; Extracting scene features from the compressed feature package, and performing Z-score standardization on the scene features to obtain standardized feature values; Splicing the one-hot encoding and the standardized feature values, and inputting the spliced values into the lightweight MLP network model to obtain initial feature weights corresponding to each standardized feature value; According to the initial feature weights and a preset weight screening coefficient, the scene features are screened to obtain core features and core feature weights. In addition, the method for performing deep processing on a data transmission package containing target scene metadata, a compressed feature package, and a hierarchical early warning instruction in the cloud to obtain a deep processing result includes the following steps: Decompressing the compressed feature package through the target scene metadata, binding the restored feature data obtained by the decompression to the hierarchical early warning instruction, and obtaining a deep processing dataset; According to the deep processing dataset, performing single-device risk tracing on each target device to obtain a single-device risk tracing result; According to the deep processing dataset and the single-device risk tracing result, performing multi-scene aggregation analysis to obtain a multi-scene aggregation analysis result; According to the deep processing dataset, the single-device risk tracing result, and the multi-scene aggregation analysis result, performing parameter optimization on the MLP network model or a preset risk model to obtain a model parameter optimization package; Integrating the single-device risk tracing result, the multi-scene aggregation analysis result, and the model parameter optimization package as the deep processing result.

Images