A visual method and system based on a big data platform

Abstract

The application relates to the technical field of visual data processing, in particular to a visual method and system based on a big data platform, which comprises the following steps: collecting multi-source heterogeneous data, and performing cleaning and standardization processing on the collected multi-modal data; inputting the data after the cleaning and standardization processing into a stream processing engine to perform real-time calculation, generating summary index data for visualization, wherein the real-time calculation comprises window aggregation and anomaly detection; receiving the summary index data output by the stream processing engine, and performing real-time visual rendering on the summary index data by using a WebGL and Canvas hybrid rendering technology; in the process of visual rendering, the summary index data is analyzed based on a rule engine or a machine learning model, and a corresponding chart type is recommended for rendering output. The accuracy and efficiency of data visualization are improved.

Description

Technical Field

[0001] This application relates to the field of visualization data processing technology, specifically to a visualization method and system based on a big data platform. Background Technology

[0002] In today's big data era, enterprise business data is growing rapidly and its sources are becoming increasingly complex and diverse, widely distributed across various heterogeneous data sources such as business databases, system log files, and IoT sensor data streams. This data encompasses multiple formats, including structured and unstructured data, and suffers from numerous protocol incompatibilities, leading to significant challenges in data integration and the formation of severe data silos. Existing visualization solutions based on big data platforms have the following significant shortcomings in addressing these challenges: First, traditional data processing architectures struggle to support real-time processing demands for hundreds of billions of data points, generally suffering from high latency in streaming data response. When faced with complex queries, such as multi-dimensional drill-down analysis, the lack of sufficient integration of columnar storage and in-memory computing technologies often increases query time several times over, failing to meet the needs of real-time decision-making. Furthermore, in terms of front-end rendering, when dynamically rendering millions of data points, traditional rendering engines are prone to browser blocking and front-end interface lag due to frequent DOM manipulations, resulting in a poor user experience.

[0003] Secondly, when integrating multi-source heterogeneous data, existing technologies generally lack automated real-time anomaly detection and interception mechanisms in the data cleaning process, resulting in low-quality data polluting the data pool, which in turn causes implicit biases in the visualization analysis results, ultimately leading to misjudgments in decision-making. Summary of the Invention

[0004] To address the aforementioned problems, this invention provides a visualization method and system based on a big data platform.

[0005] Firstly, the present invention provides a visualization method based on a big data platform, including: S1. Collect multi-source heterogeneous data and clean and standardize the collected multimodal data; S2. Input the cleaned and standardized data into the stream processing engine for real-time calculation to generate summary indicator data for visualization. The real-time calculation includes window aggregation and anomaly detection. S3. Receive the summary index data output by the stream processing engine, and use WebGL and Canvas hybrid rendering technology to perform real-time visualization rendering of the summary index data; S4. During the visualization rendering process, the summary indicator data is parsed based on the rule engine or machine learning model, and the corresponding chart type is recommended for rendering output.

[0006] As a preferred embodiment of the technical solution of the present invention, after the steps of cleaning and standardizing the collected data, the method further includes: Based on cleaned and standardized data, a multimodal knowledge graph is constructed to achieve semantic associations across data sources; The data processed by the stream processing engine in real time includes the associated data output based on the multimodal knowledge graph.

[0007] By constructing a multimodal knowledge graph, semantic associations across data sources are achieved, enabling data from different sources to complement and verify each other, thus improving data integrity and accuracy. The stream processing engine processes data including the associated data output based on the multimodal knowledge graph, allowing the computation process to fully utilize the relationships between data, reducing unnecessary calculations and improving overall computational efficiency.

[0008] As a preferred embodiment of the technical solution of this invention, a multimodal knowledge graph is constructed based on cleaned and standardized data to achieve semantic association across data sources. Specific steps include: S111. Vectorize the multimodal data, wherein the multimodal data includes text data, image data, and entity fields in structured data; specific steps include: After cleaning and standardization, the BERT model is used to convert the text data into text semantic vectors. The cleaned and standardized image data is converted into image feature vectors using the CLIP model; For entity fields in structured data, word embedding technology is used to convert them into entity vectors; S112. Based on the cosine similarity algorithm, calculate the similarity between entity vectors from different data sources; if the similarity value exceeds the predefined association threshold, create semantic association edges between the corresponding entities. S113. Store entities and their semantic association edges in a graph database in a graph structure to form a multimodal knowledge graph; and provide a unified graph query interface to support complex association queries based on entity attributes; The data processed by the stream processing engine in real-time computation includes the associated data output based on the multimodal knowledge graph, specifically: When processing the data stream, the stream processing engine calls the graph query interface to query and obtain information about other data source entities associated with the entities in the current data stream in real time. The associated information is then concatenated with the original data stream as an additional dimension field and sent to the subsequent window aggregation and anomaly detection unit for processing.

[0009] By vectorizing multimodal data and calculating the similarity between entity vectors using the cosine similarity algorithm, accurate semantic associations are achieved, improving the accuracy and reliability of data association. Entities and their semantic association edges are stored in a graph database in a graph structure, and a unified graph query interface is provided to support complex association queries based on entity attributes, improving the efficiency and flexibility of data query.

[0010] When processing data streams, the stream processing engine can query and retrieve information about other data source entities related to entities in the current data stream in real time, enriching the data dimensions of real-time processing and improving the comprehensiveness and accuracy of data analysis. By concatenating this related information as an additional dimension field with the original data stream, the window aggregation and anomaly detection units can perform in-depth analysis based on richer data, improving the reliability of the analysis results.

[0011] As a preferred embodiment of the technical solution of the present invention, step S2 includes: S21. The cleaned and standardized data stream is accessed through a message queue, and a dynamic backpressure mechanism is used to adjust the data ingestion rate; the cleaned and standardized data stream includes additional dimension data associated with a multimodal knowledge graph; this effectively prevents system overload and ensures the stability and reliability of data ingestion.

[0012] S22. Define an event time window for the incoming data stream; defining an event time window for the data stream enables data processing to be based on the actual time of the event, improving the timeliness and accuracy of data processing.

[0013] S23. The data within the time window is grouped according to predefined dimensions, and aggregation operations are performed in parallel to generate the summary index data; the aggregation operations include at least one of the following: counting, summing, averaging, finding the maximum value, and finding the minimum value; this improves data processing efficiency and meets the needs of real-time analysis of large-scale data.

[0014] S24. Perform real-time anomaly detection on the summary indicator data or the original data in the window based on predefined rules or machine learning models, and mark the identified abnormal data.

[0015] As a preferred embodiment of the technical solution of the present invention, step S23 specifically includes: S231. Parse the pattern of data records within the time window, extract the values ​​of predefined dimension fields, and combine the values ​​of the dimension fields into group keys; S232. Based on the hash value of the grouping key, distribute the data records within the time window to multiple parallel computing task instances of the stream processing engine to ensure that data with the same grouping key are distributed to the same computing task instance. S233. Each parallel computing task instance maintains an aggregation state in its memory for each group key it receives, and performs incremental aggregation operations on the data values ​​sent to that group key. Performing incremental aggregation on data under the same group key ensures the accuracy of the results, avoids repeated processing errors, and improves the reliability of data analysis.

[0016] S234. At the end of the window, each parallel computing task instance outputs the final aggregate state of all grouping keys maintained in its memory as the summary metric data. This output of the final aggregate state of all grouping keys maintained by each parallel computing task instance at the end of the window provides a flexible data output method, meeting the data analysis needs of different business scenarios.

[0017] As a preferred embodiment of the technical solution of the present invention, step S24 specifically includes: S241. According to the requirements of the pre-configured anomaly detection rules or model, extract the corresponding feature data from the data stream; for rule-based detection, extract the values ​​of specific fields or the summary index data; for machine learning model-based detection, construct a feature vector for model input from the original data stream or summary index data. S242. Execute the multimodal detection strategy; including: Rule-based pattern detection: The feature data is compared in real time with a pre-configured static threshold or a dynamic threshold calculated based on historical statistics of a sliding window. If the data exceeds the threshold range, a preliminary abnormal event is generated. Machine learning pattern detection: The feature vector is input into a pre-trained anomaly detection model for analysis, and the model outputs anomaly scores or labels; the anomaly detection model includes an isolated forest algorithm model or a long short-term memory network model. S243. For the preliminary abnormal events generated by rule pattern detection or the abnormal scores output by machine learning pattern detection, make a final abnormal determination according to the predefined judgment rules; for the data records or data streams that are finally determined to be abnormal, add abnormal type, confidence level and timestamp mark and output them.

[0018] By combining rule-based pattern detection and machine learning pattern detection, a multimodal anomaly detection strategy was implemented, improving the accuracy of anomaly detection and reducing false positives and false negatives. Based on the requirements of pre-configured anomaly detection rules or models, corresponding feature data is flexibly extracted. Whether it's numerical values ​​of specific fields or summary indicator data, both can be effectively processed, improving the adaptability and flexibility of anomaly detection. Predefined judgment rules provide clear standards for the final anomaly determination, ensuring the objectivity and consistency of anomaly judgment and avoiding judgment errors caused by human factors. For data records or data streams ultimately determined to be anomalous, anomaly type, confidence level, and timestamp are appended to the output, providing rich anomaly information and strong support for subsequent data analysis and decision-making.

[0019] As a preferred embodiment of the technical solution of the present invention, step S3 includes: S31. Based on the type of the summary indicator data, the data volume, and the type of chart to be presented, select WebGL rendering, Canvas 2D rendering, or a hybrid rendering strategy; among them, for time series data and geospatial data with a data volume exceeding the first preset threshold or requiring a three-dimensional effect, WebGL rendering is preferred; for conventional charts with a data volume below the second preset threshold and mainly using two-dimensional interactive controls, Canvas 2D rendering is used. S32. Convert the summary metric data output by the stream processing engine into graphics element data that the rendering engine can recognize; for WebGL rendering, convert the data into a structured array containing vertex positions, colors, and sizes; for Canvas 2D rendering, convert the data into parameters required by the drawing API. S33. When using WebGL rendering, the converted graphics element data is created and stored in the GPU's vertex buffer object. By writing GLSL shader programs, vertex transformation and fragment shading calculations are executed in parallel in the GPU to achieve batch drawing of large-scale data points. When using Canvas 2D rendering, the Canvas 2D context interface is called to draw graphics. S34. Within the same visualization view, WebGL is used to render the underlying large-scale data layer, while Canvas 2D is used to render the upper interactive control layer. Finally, the rendering results of the two layers are combined using off-screen rendering technology to output the final image to the display device. S35. For the incremental summary index data continuously output by the stream processing engine, a difference comparison algorithm is used to identify the changed data parts, and only the graphic elements affected by the changed data are locally updated and redrawn.

[0020] Based on the type, volume, and chart type of the summary metrics data, a flexible selection of WebGL rendering, Canvas 2D rendering, or a hybrid rendering strategy is adopted, improving the adaptability and flexibility of rendering. When using WebGL rendering, the GPU performs vertex transformation and fragment shading calculations in parallel, enabling batch rendering of large-scale data points, significantly improving rendering efficiency and meeting real-time visualization requirements. Within the same visualization view, WebGL is used to render the underlying large-scale data layer, while Canvas 2D is used to render the upper interactive control layer. The final image is then synthesized using off-screen rendering technology, optimizing visual effects and improving user experience. For continuously outputting incremental summary metrics data, a difference comparison algorithm is used to identify the changed data portions, and only the graphic elements affected by the changed data are locally updated and redrawn, reducing bandwidth consumption and improving data transmission efficiency.

[0021] As a preferred embodiment of the technical solution of the present invention, step S4 includes: S41. Extract features for chart recommendation from the summary indicator data, wherein the features include one or more of the following: number of data dimensions, number of measures, data type, existence of time field, existence of geographic information field, and statistical features of data distribution. S42. Execute a multi-modal recommendation strategy; including: Rule Engine Mode: Matches extracted features with a predefined rule base; the rule base defines the mapping relationship between features and chart types, for example: if a geographic information field exists, a map chart is recommended; if a time field and a metric field exist, a line chart or bar chart is recommended. Machine learning mode: The extracted feature vectors are input into a pre-trained chart recommendation model for inference, and the model outputs the recommended chart type and recommendation confidence; the chart recommendation model is a classification model trained using historical chart usage data and corresponding data features as training samples. S43. For the recommendation results output by the rule engine mode and the recommendation results output by the machine learning mode, the final chart type is selected according to the predefined decision-making strategy; when the output results of the two modes conflict, the result with higher recommendation confidence is selected first. S44. Based on the final determined chart type, call the corresponding chart rendering template or configuration, bind the summary indicator data to the chart data source, and trigger the rendering engine to draw and output the final graphic.

[0022] Features for chart recommendation are extracted from summary metric data, including the number of data dimensions, the number of metrics, and data types, providing comprehensive data support for chart recommendation. A multi-modal recommendation strategy is implemented, including a rule engine mode and a machine learning mode, combining the advantages of both to improve the accuracy and diversity of chart recommendations. Predefined decision-making strategies provide clear criteria for the final chart type selection, ensuring objectivity and consistency and avoiding selection errors caused by human factors. Based on the final determined chart type, the corresponding chart rendering template or configuration is invoked, the summary metric data is bound to the chart data source, and the rendering engine is triggered to draw and output the final graph, achieving efficient data visualization output and meeting real-time decision-making needs.

[0023] Secondly, the present invention also provides a visualization system based on a big data platform for implementing the method described in the first aspect, comprising: The data access and processing module is used to collect multi-source heterogeneous data and to clean and standardize the collected data. The real-time computing module is used to input the cleaned and standardized data into the stream processing engine for real-time computing, generating summary indicator data for visualization. The real-time computing includes window aggregation and anomaly detection. The visualization rendering module is used to receive the summary index data output by the stream processing engine and perform real-time visualization rendering of the summary index data using WebGL and Canvas hybrid rendering technology. The intelligent recommendation module is used to parse the summary indicator data based on a rule engine or machine learning model during the visualization rendering process, and recommend corresponding chart types for rendering output.

[0024] As can be seen from the above technical solutions, this application has the following advantages: by collecting heterogeneous data from multiple sources and performing cleaning and standardization processing, it effectively integrates data scattered in heterogeneous sources such as databases, logs, and sensors, solves the problem of data silos in traditional methods, and improves the availability and consistency of data.

[0025] By leveraging a stream processing engine for real-time computation, including window aggregation and anomaly detection, data processing efficiency is significantly improved, meeting the needs of real-time analysis on a scale of hundreds of billions of data points and solving the performance bottleneck of real-time processing in traditional architectures.

[0026] By employing a hybrid rendering technology combining WebGL and Canvas, real-time visualization rendering of large-scale data points is achieved, avoiding the front-end lag issues caused by frequent DOM operations when traditional rendering engines dynamically render millions of data points, thus improving the user experience.

[0027] The summary indicator data is parsed based on rule engines or machine learning models, and the corresponding chart types are automatically recommended, which improves the accuracy and efficiency of data visualization. Attached Figure Description

[0028] To more clearly illustrate the technical solution of this application, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart illustrating the method provided in an embodiment of the present invention.

[0030] Figure 2 A block diagram of a system provided in an embodiment of the present invention. Detailed Implementation

[0031] To make the purpose, features, and advantages of this application more apparent and understandable, specific embodiments and accompanying drawings will be used to clearly and completely describe the technical solution protected by this application. Obviously, the embodiments described below are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] Unless otherwise defined, all technical and scientific terms used in this application have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used in this application and in the specification of this invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0033] like Figure 1 As shown, this embodiment of the invention provides a visualization method based on a big data platform, including: S1. Collect multi-source heterogeneous data and clean and standardize the collected multimodal data; In this step, a distributed crawler cluster and a multi-protocol adapter are used to achieve heterogeneous data access: Structured data: Directly connect to business databases such as MySQL and Oracle through an ORM framework to collect financial transaction records or industrial production reports; call third-party system data, such as supply chain logistics data, through RESTful APIs.

[0034] Unstructured data: Customer review text from web pages is collected using a Selenium headless browser, accessed via an IoT protocol converter to connect to industrial sensor log streams, and customer service recording files are processed through a speech-to-text interface.

[0035] It integrates protocol parsing modules such as HTTP / 1.1 / 2.0, WebSocket, and gRPC. Among them, gRPC is used to separate control signaling and data streams, improving transmission efficiency in high-concurrency scenarios.

[0036] Preprocessing is performed through a lightweight ETL pipeline at the edge computing layer: Convert the timestamp to a standardized format (e.g., 2025-07-24T12:30:45Z), unify the numerical units, and force the character encoding to UTF-8.

[0037] The Z-score algorithm is used to identify outliers that exceed the 3σ range, and context filling is used for null fields.

[0038] Filter duplicate records based on data hash value.

[0039] S02. Based on the cleaned and standardized data, construct a multimodal knowledge graph to achieve semantic association across data sources; the processing steps in this step are as follows: Text data is converted into 768-dimensional semantic vectors using the BERT-base model; Image data is converted into 512-dimensional feature vectors using the CLIP model; Structured entities are converted into 200-dimensional entity vectors using Word2Vec word embedding technology.

[0040] The similarity of entity vectors is calculated using the cosine similarity algorithm, with a preset association threshold of 0.8. For example, in a financial scenario, if the entity vector similarity between "Account A" and "Transaction Order B" is 0.85, then an association edge is created between the two.

[0041] Entities and associated edges are stored in the JanusGraph graph database, which provides a unified query interface (supporting the Gremlin query language) and can perform complex relational queries such as "querying all abnormal transactions related to account A".

[0042] When processing the data stream, the stream processing engine calls the graph query interface to query and obtain information about other data source entities associated with the entities in the current data stream in real time. The associated information is then concatenated with the original data stream as an additional dimension field and sent to the subsequent window aggregation and anomaly detection unit for processing.

[0043] S2. Input the cleaned and standardized data into the stream processing engine for real-time calculation to generate summary indicator data for visualization. The real-time calculation includes window aggregation and anomaly detection. In this embodiment of the invention, Apache Flink is used as the stream processing engine to perform window aggregation and anomaly detection: The pre-processed data stream is accessed via a Kafka message queue, and a dynamic backpressure mechanism is used to adjust the data ingestion rate. When the backlog of data in a Kafka partition exceeds 100,000 records, the ingestion rate is automatically reduced to avoid system overload.

[0044] Enable Flink's Checkpoint mechanism to ensure exactly-once semantics in data processing and prevent duplicate calculations of financial transaction data.

[0045] Define the time window based on the business scenario: In the financial real-time monitoring scenario, a 1-minute rolling window is used to output a summary of transaction amounts every 60 seconds; in the industrial equipment early warning scenario, a 5-minute sliding window (sliding step size of 1 minute) is used to continuously monitor the trend of equipment status changes.

[0046] Parallel computation grouped by predefined dimensions: Extract "Account Type + Transaction Region" (financial scenario) or "Equipment Type + Workshop Number" (industrial scenario) as grouping keys; Data is distributed to 16 parallel computing task instances based on the group key hash value to ensure that the same group of data is processed centrally. Each task instance maintains the aggregate state in memory and performs operations such as counting, summing, and averaging. When the window ends, it outputs summary metrics data, such as "Total credit card transaction amount in a certain region: 5 million yuan, number of transactions: 2000".

[0047] A dual-mode detection strategy combining rules and machine learning is adopted: Rule detection extracts features such as "single transaction amount > 1 million yuan" and "equipment temperature > 80℃"; machine learning detection constructs 128-dimensional feature vectors such as "trading volatility in the last 5 minutes" and "temperature change slope" from the original data.

[0048] By comparing static thresholds (such as the transaction amount limit) with dynamic thresholds (the 3σ limit calculated based on a sliding window), a preliminary abnormal event is generated if the threshold is exceeded.

[0049] The Isolation Forest model performs unsupervised outlier detection on transaction data to identify abnormally large transactions; The LSTM network models the time-series data of device temperature, and marks it as an anomaly if the prediction deviation exceeds a preset threshold.

[0050] The rule detection results (with a fixed confidence level of 0.9) are weighted and fused with the model output scores (such as the isolated forest anomaly score > 0.85). Data that is determined to be abnormal will be output with additional labels such as equipment overheating and timestamps.

[0051] S3. Receive the summary index data output by the stream processing engine, and use WebGL and Canvas hybrid rendering technology to perform real-time visualization rendering of the summary index data; Enable WebGL rendering when the data volume exceeds 1 million records or when 3D display is required. For example, when rendering the internal structure and temperature distribution of a device, leverage the parallel computing capabilities of the GPU to improve efficiency. When the data volume is less than 100,000 records, Canvas 2D rendering is used to draw conventional charts such as line charts and bar charts; The bottom layer uses WebGL to render large-scale data layers, while the upper layer uses Canvas 2D to render interactive controls.

[0052] WebGL rendering converts summary index data into a structured array containing vertex coordinates, color, and size; Canvas2D rendering converts it into the parameters required by APIs such as fillRect() and strokeLine(). WebGL performs vertex transformations and fragment shading on the GPU through the GLSL shader program, enabling batch drawing of millions of data points and maintaining a rendering frame rate of over 30fps. Off-screen rendering technology is used to composite WebGL layers with Canvas 2D layers, avoiding performance loss when layers are overlaid.

[0053] For continuously outputting incremental data, a difference comparison algorithm is used to identify the changed parts, and only the changed areas are redrawn, such as the abnormal temperature pointer on an industrial dashboard, reducing bandwidth consumption and ensuring smooth visualization on the large screen.

[0054] S4. During the visualization rendering process, the summary indicator data is parsed based on the rule engine or machine learning model, and the corresponding chart type is recommended for rendering output.

[0055] In some embodiments, step S2 includes: S21. The cleaned and standardized data stream is accessed through a message queue, and a dynamic backpressure mechanism is used to adjust the data ingestion rate; this effectively prevents system overload and ensures the stability and reliability of data ingestion.

[0056] S22. Define an event time window for the incoming data stream; defining an event time window for the data stream enables data processing to be based on the actual time of the event, improving the timeliness and accuracy of data processing.

[0057] S23. The data within the time window is grouped according to predefined dimensions, and aggregation operations are performed in parallel to generate the summary index data; the aggregation operations include at least one of the following: counting, summing, averaging, finding the maximum value, and finding the minimum value; this improves data processing efficiency and meets the needs of real-time analysis of large-scale data.

[0058] S24. Perform real-time anomaly detection on the summary indicator data or the original data in the window based on predefined rules or machine learning models, and mark the identified abnormal data.

[0059] In some embodiments, step S23 specifically includes: S231. Parse the pattern of data records within the time window, extract the values ​​of predefined dimension fields, and combine the values ​​of the dimension fields into group keys; S232. Based on the hash value of the grouping key, distribute the data records within the time window to multiple parallel computing task instances of the stream processing engine to ensure that data with the same grouping key are distributed to the same computing task instance. S233. Each parallel computing task instance maintains an aggregation state in its memory for each group key it receives, and performs incremental aggregation operations on the data values ​​sent to that group key. Performing incremental aggregation on data under the same group key ensures the accuracy of the results, avoids repeated processing errors, and improves the reliability of data analysis.

[0060] S234. At the end of the window, each parallel computing task instance outputs the final aggregate state of all grouping keys maintained in its memory as the summary metric data. This output of the final aggregate state of all grouping keys maintained by each parallel computing task instance at the end of the window provides a flexible data output method, meeting the data analysis needs of different business scenarios.

[0061] In some embodiments, step S24 specifically includes: S241. According to the requirements of the pre-configured anomaly detection rules or model, extract the corresponding feature data from the data stream; for rule-based detection, extract the values ​​of specific fields or the summary index data; for machine learning model-based detection, construct a feature vector for model input from the original data stream or summary index data. S242. Execute the multimodal detection strategy; including: Rule-based pattern detection: The feature data is compared in real time with a pre-configured static threshold or a dynamic threshold calculated based on historical statistics of a sliding window. If the data exceeds the threshold range, a preliminary abnormal event is generated. Machine learning pattern detection: The feature vector is input into a pre-trained anomaly detection model for analysis, and the model outputs anomaly scores or labels; the anomaly detection model includes an isolated forest algorithm model or a long short-term memory network model. S243. For the preliminary abnormal events generated by rule pattern detection or the abnormal scores output by machine learning pattern detection, make a final abnormal determination according to the predefined judgment rules; for the data records or data streams that are finally determined to be abnormal, add abnormal type, confidence level and timestamp mark and output them.

[0062] In some embodiments, step S3 includes: S31. Based on the type of the summary indicator data, the data volume, and the type of chart to be presented, select WebGL rendering, Canvas 2D rendering, or a hybrid rendering strategy; wherein, for time-series data or geospatial data with a data volume exceeding the first preset threshold or requiring a three-dimensional effect, WebGL rendering is preferred; for conventional charts with a data volume below the second preset threshold and mainly using two-dimensional interactive controls, Canvas 2D rendering is used; in this embodiment of the invention, the first preset threshold is 1 million data entries, and the second preset threshold is 100,000 data entries.

[0063] S32. Convert the summary metric data output by the stream processing engine into graphics element data that the rendering engine can recognize; for WebGL rendering, convert the data into a structured array containing vertex positions, colors, and sizes; for Canvas 2D rendering, convert the data into parameters required by the drawing API. S33. When using WebGL rendering, the converted graphics element data is created and stored in the GPU's vertex buffer object. By writing GLSL shader programs, vertex transformation and fragment shading calculations are executed in parallel in the GPU to achieve batch drawing of large-scale data points. When using Canvas 2D rendering, the Canvas 2D context interface is called to draw graphics. S34. Within the same visualization view, WebGL is used to render the underlying large-scale data layer, while Canvas 2D is used to render the upper interactive control layer. Finally, the rendering results of the two layers are combined using off-screen rendering technology to output the final image to the display device. S35. For the incremental summary index data continuously output by the stream processing engine, a difference comparison algorithm is used to identify the changed data parts, and only the graphic elements affected by the changed data are locally updated and redrawn.

[0064] In some embodiments, step S4 includes: S41. Extract features for chart recommendation from the summary indicator data, wherein the features include one or more of the following: number of data dimensions, number of measures, data type, existence of time field, existence of geographic information field, and statistical features of data distribution. S42. Execute a multi-modal recommendation strategy; including: Rule Engine Mode: Matches extracted features with a predefined rule base; the rule base defines the mapping relationship between features and chart types, for example: if a geographic information field exists, a map chart is recommended; if a time field and a metric field exist, a line chart or bar chart is recommended. Machine learning mode: The extracted feature vectors are input into a pre-trained chart recommendation model for inference, and the model outputs the recommended chart type and recommendation confidence; the chart recommendation model is a classification model trained using historical chart usage data and corresponding data features as training samples. S43. For the recommendation results output by the rule engine mode and the recommendation results output by the machine learning mode, the final chart type is selected according to the predefined decision-making strategy; when the output results of the two modes conflict, the result with higher recommendation confidence is selected first. S44. Based on the final determined chart type, call the corresponding chart rendering template or configuration, bind the summary indicator data to the chart data source, and trigger the rendering engine to draw and output the final graphic.

[0065] like Figure 2 As shown, this embodiment of the invention also provides a visualization system based on a big data platform, used to implement the methods described in the above embodiments, including: The data access and processing module is used to collect multi-source heterogeneous data and to clean and standardize the collected data. In this embodiment of the invention, a distributed crawler cluster and an AI semantic parsing engine are used to achieve unified collection and intelligent integration of multi-source heterogeneous data. The collection layer relies on a Kubernetes containerized platform to build a dynamically scalable crawler cluster, with a custom scheduler enabling elastic scaling of nodes. At the protocol access level, a multi-protocol adapter design is adopted, supporting mainstream protocols such as HTTP / 1.1 / 2.0 and WebSocket, and using gRPC to separate control signaling from data stream transmission. Anti-crawling bypass mechanisms integrate automatic proxy IP pool rotation (supporting residential / data center proxy types), Selenium headless browser dynamic rendering, and an AI-driven CAPTCHA recognition module to ensure the feasibility of complex data collection. Data collection adopts a hybrid parallel architecture: structured data is obtained by directly connecting to the database or calling a RESTful API through an ORM framework; unstructured data is processed using an NLP parsing engine, while an IoT protocol converter is deployed to interface with sensor log streams. At the edge computing level, a lightweight ETL pipeline is deployed for data pre-cleaning, including JSON standardization, outlier filtering, and feature extraction to reduce transmission load. The parsing layer utilizes models such as BERT and CLIP to semantically vectorize text and images, extract entity relationships, and constructs a multimodal knowledge graph by matching field associations across data sources using cosine similarity. This process (first, preprocessing the text or image (e.g., word segmentation, standardization) converts it into numerical vector representations; then, calculating the ratio of the dot product to the modulus product of two vectors, i.e., the cosine similarity value (range -1 to 1); finally, determining the matching degree based on a similarity threshold, with values ​​closer to 1 indicating greater consistency and higher relevance) solves the problem of semantic fragmentation in heterogeneous data. The storage layer adopts a layered data lake architecture (raw layer, cleaning layer, service layer), storing data using Delta Lake / Apache Iceberg, supporting ACID transactions and time travel queries, and ensuring version backtracking and data consistency. The core process of data lineage tracing implemented by the governance layer through Apache Atlas can be divided into four steps: First, metadata is automatically collected through predefined Hooks (such as Hive, Kafka) or Bridge components to build an entity relationship network stored in JanusGraph; second, differential privacy technology is used to add Gaussian noise to sensitive fields (such as user IDs) to ensure that the lineage can still be traced after data anonymization; third, the RBAC model is integrated to achieve field-level access control (such as allowing compliance departments to query anonymized data) through permission linkage between Atlas and Ranger; finally, data collection events are monitored in real time based on Kafka, and quality rules (such as null value rate threshold alarms) are triggered through Solr indexes, forming a four-in-one governance closed loop of "lineage-privacy-permission-monitoring".The entire solution breaks through the limitations of traditional web crawler field definitions, achieving high-throughput collection of hundreds of millions of data points, multimodal semantic association, and secure and controllable asset integration, providing enterprises with a highly consistent analytical foundation.

[0066] The real-time computing module is used to input the cleaned and standardized data into the stream processing engine for real-time computing, generating summary indicator data for visualization. The real-time computing includes window aggregation and anomaly detection. In this embodiment of the invention, a hybrid computing engine and a real-time anomaly detection model are constructed, combined with a high-performance caching mechanism, to achieve streaming data processing, data quality monitoring, and query acceleration. In the Apache Flink-based stream processing system, the data preprocessing process first accesses the raw data stream through a Kafka / Pulsar consumer component. A dynamic backpressure mechanism is used to adjust the data ingestion rate to prevent system overload, while a checkpoint mechanism is used for fault recovery to ensure exactly-once semantics of data processing. The lightweight ETL module built into the access layer performs the following core preprocessing steps: (1) Field parsing: Extract structured fields using regular expressions or predefined schemas (such as JSON / Protobuf parsers), and use a recursive parsing strategy when processing nested data structures; (2) Format standardization: unify timestamp format (such as ISO 8601), numerical units (such as unifying to millisecond precision) and character encoding (UTF-8 forced conversion) to eliminate heterogeneity of multi-source data; (3) Anomaly detection: Outliers are identified in real time based on sliding window statistics (such as Z-score or IQR), and data exceeding the threshold are marked and diverted to the repair pipeline; (4) Handling of null values: A context-aware filling strategy is adopted, using linear interpolation for time series data and filling categorical variables with the nearest non-null value; (5) Data Augmentation: External dimension tables (such as device metadata databases) are associated through topological dependency graphs to supplement entity association attributes. The preprocessed data stream is then serialized and optimized (e.g., Apache Avro) before entering the event time window calculation engine, and finally output to the downstream analysis module.

[0067] The entire process utilizes Flink's StateBackend to persist the processing state.

[0068] The visualization rendering module is used to receive the summary index data output by the stream processing engine and perform real-time visualization rendering of the summary index data using WebGL and Canvas hybrid rendering technology. It's important to note that the core of the visualization rendering utilizes a rendering engine to achieve millisecond-level loading of tens of millions of data points, combined with incremental transmission technology to reduce network load. Based on a massively multi-scale rendering engine, and incorporating incremental transmission optimization and an intelligent chart recommendation model, a low-latency, highly interactive real-time data visualization platform is constructed. The rendering layer is based on a hybrid WebGL and Canvas rendering technology, achieving millisecond-level loading of tens of millions of data points for time-series data and geographic information. It overcomes browser performance bottlenecks through data chunking, progressive rendering, and GPU parallel computing (such as CUDA), supporting high-density rendering scenarios such as dynamic scaling and multi-layer overlay. The transport layer employs incremental encoding (Delta Encoding) and data compression (such as Snappy / GZIP), synchronously changing only data segments and differential hash values, reducing network transmission load, and combining this with WebSocket long connections to ensure stable transmission of real-time data streams.

[0069] The intelligent recommendation module is used to parse the summary indicator data based on a rule engine or machine learning model during the visualization rendering process, and recommend corresponding chart types for rendering output.

[0070] In some embodiments, the data access and processing module further includes: The multimodal knowledge graph construction unit is used to build a multimodal knowledge graph based on cleaned and standardized data to achieve semantic associations across data sources. Specifically, for cleaned and standardized text data, the BERT model is used to convert it into text semantic vectors; for cleaned and standardized image data, the CLIP model is used to convert it into image feature vectors; for entity fields in structured data, word embedding technology is used to convert them into entity vectors; based on the cosine similarity algorithm, the similarity between entity vectors from different data sources is calculated; if the similarity value exceeds a predefined association threshold, a semantic association edge is created between the corresponding entities; the entities and their semantic association edges are stored in a graph database in the form of a graph structure to form a multimodal knowledge graph; and a unified graph query interface is provided to support complex association queries based on entity attributes. The real-time computing module processes data including the associated data output based on the multimodal knowledge graph. Specifically: When processing the data stream, the stream processing engine calls the graph query interface to query and obtain information about other data source entities associated with the entities in the current data stream in real time. The associated information is then concatenated with the original data stream as an additional dimension field and sent to the subsequent window aggregation and anomaly detection unit for processing.

[0071] In some embodiments, the real-time computing module includes: The data access unit is used to access the data stream through a message queue and to adjust the data ingestion rate using a dynamic backpressure mechanism. The window processing unit is used to define event time windows for the data stream; The aggregation calculation unit is used to group data within a time window according to predefined dimensions and perform aggregation operations in parallel to generate summary indicator data; The anomaly detection unit is used to perform real-time anomaly detection on the summary indicator data or the raw data within the window based on predefined rules or machine learning models, and to mark the abnormal data.

[0072] In some embodiments, the aggregation calculation unit specifically includes: Grouping key generation sub-units are used to parse the pattern of data records, extract the values ​​of dimension fields, and combine them into grouping keys; The data distribution subunit is used to distribute data to multiple parallel computing task instances based on the hash value of the grouping key; Local aggregation subunits are used to maintain the aggregation state and perform incremental aggregation operations in each computing task instance; The result output sub-cell is used to output the final aggregation state of all grouping keys as summary index data at the end of the window.

[0073] In some embodiments, the anomaly detection unit specifically includes: The feature extraction subunit is used to extract the feature data or feature vectors required by the rules or model from the data stream. The multimodal detection subunit is used to perform rule-based pattern detection and machine learning pattern detection; The decision and labeling subunit is used to make the final anomaly determination on the detection results and to add anomaly type, confidence level and timestamp labels to the abnormal data before outputting them.

[0074] In some embodiments, the visualization rendering module includes: The rendering strategy decision unit is used to select WebGL, Canvas 2D, or a hybrid rendering strategy based on the type, scale, and chart type of the summary indicator data. The data transformation unit is used to convert summary indicator data into graphical element data that can be recognized by the rendering engine; The rendering execution unit is used to perform graphics drawing using WebGL or Canvas 2D technologies; The compositing unit is used to composite WebGL layers with Canvas 2D layers into the final image; The incremental update unit is used to perform local redrawing based on incremental data using a difference comparison algorithm.

[0075] In some embodiments, the intelligent recommendation module includes: The feature extraction unit is used to extract chart recommendation features from the summary indicator data; A multi-modal recommendation unit is used to perform recommendation based on both rule engine and machine learning modes. The decision-making unit is used to resolve conflicts in the recommendation results and select the final chart type; The chart generation unit is used to bind data according to the final chart type and trigger rendering output.

[0076] In some embodiments, the system further includes: The security and control module is used to implement data access control based on the RBAC model and to protect sensitive data by combining dynamic de-identification technology. The decision support module is used to provide real-time alarms, root cause analysis, and repair suggestion push functions based on the output of the real-time computing module.

[0077] In this embodiment of the invention, an integrated engine for streaming processing and intelligent quality inspection is constructed to achieve real-time data processing, quality monitoring, and query acceleration. The system supports millisecond-level data access and window analysis through a stream computing core, integrating rule-based and AI-driven dual-mode anomaly detection: the system accesses real-time data streams via Kafka / Pulsar, utilizes Apache Flink for millisecond-level window calculation, and a dynamic backpressure mechanism ensures stability in high-throughput scenarios. At the anomaly detection layer, a multimodal fusion strategy is adopted: 1) Threshold alarms set dynamic thresholds (based on the 3σ principle or IQR detection using sliding window statistics) for key indicators (such as CPU utilization and response latency) to trigger primary alarms; 2) In the machine learning model, the isolated forest performs unsupervised anomaly detection on high-dimensional features (such as request volume and error code distribution), quickly locating outliers by randomly dividing the subspace, while the LSTM network analyzes temporal features (such as log sequences and performance index fluctuations) to capture periodic anomaly patterns. The detection results are weighted and fused using a Bayesian network to calculate the final confidence level to filter false positives. Finally, abnormal data and root cause analysis (based on dependency graphs generated by GNN) are pushed to the visualization platform in real time, displayed in the form of heatmaps and topology maps, along with remediation suggestions (such as index optimization and thread pool expansion), forming a closed-loop management system from data collection to operational decision-making. Simultaneously, a Redis cluster is used to cache intermediate calculation results and frequently queried results, reducing redundant calculations and database pressure.

[0078] The data collected, parsed, and processed includes various data types. After field parsing, format standardization (e.g., unifying to JSON / CSV), and deduplication, it forms tabular data conforming to schema specifications, facilitating direct import into analysis engines or visualization tools. Based on this, statistical indicators (such as mean and outlier thresholds) calculated using time windows (e.g., a 1-minute rolling window) are provided for use in real-time monitoring panels. Node-edge relationship data (such as collaborative processing nodes) generated by the element analysis module is used to render interactive charts such as topology maps and heatmaps.

[0079] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A visualization method based on a big data platform, characterized in that, Includes the following steps: S1. Collect multi-source heterogeneous data and clean and standardize the collected multimodal data; Based on cleaned and standardized data, a multimodal knowledge graph is constructed to achieve semantic associations across data sources; specifically including: S111. Vectorize the multimodal data, which includes text data, image data, and entity fields in structured data; the specific steps include: converting the cleaned and standardized text data into text semantic vectors using the BERT model; converting the cleaned and standardized image data into image feature vectors using the CLIP model; and converting the entity fields in structured data into entity vectors using word embedding technology. S112. Based on the cosine similarity algorithm, calculate the similarity between entity vectors from different data sources; if the similarity value exceeds the predefined association threshold, create semantic association edges between the corresponding entities. S113. Store entities and their semantic association edges in a graph database in a graph structure to form a multimodal knowledge graph; and provide a unified multimodal knowledge graph query interface to support complex association queries based on entity attributes; S2. The cleaned and standardized data is input into the stream processing engine for real-time calculation to generate summary indicator data for visualization. The real-time calculation includes window aggregation and anomaly detection. The data processed by the stream processing engine in real-time calculation includes the associated data output based on the multimodal knowledge graph. Specifically, when processing the data stream, the stream processing engine calls the multimodal knowledge graph query interface to query and obtain information about other data source entities associated with the entities in the current data stream in real time. The associated information about other data source entities is then concatenated with the original data stream as an additional dimension field and sent to the subsequent window aggregation and anomaly detection units for processing. S3. Receive the summary index data output by the stream processing engine, and use WebGL and Canvas hybrid rendering technology to perform real-time visualization rendering of the summary index data; S4. During the visualization rendering process, the summary indicator data is parsed based on the rule engine or machine learning model, and the corresponding chart type is recommended for rendering output.

2. The visualization method based on a big data platform according to claim 1, characterized in that, The steps in S2 include: S21. The cleaned and standardized data stream is accessed through a message queue, and a dynamic backpressure mechanism is used to adjust the data ingestion rate; the cleaned and standardized data stream includes additional dimension data associated with a multimodal knowledge graph. S22. Define the event time window for the incoming data stream; S23. The data within the time window is grouped according to predefined dimensions, and aggregation operations are performed in parallel to generate the summary index data; the aggregation operations include at least one of the following: counting, summing, averaging, finding the maximum value, and finding the minimum value. S24. Perform real-time anomaly detection on the summary indicator data or the original data in the window based on predefined rules or machine learning models, and mark the identified abnormal data.

3. The visualization method based on a big data platform according to claim 2, characterized in that, The specific steps in S23 include: S231. Parse the pattern of data records within the time window, extract the values ​​of predefined dimension fields, and combine the values ​​of the dimension fields into group keys; S232. Based on the hash value of the grouping key, distribute the data records within the time window to multiple parallel computing task instances of the stream processing engine to ensure that data with the same grouping key are distributed to the same computing task instance. S233. Each parallel computing task instance maintains an aggregation state in its memory for each group key it receives, and performs incremental aggregation operations on the data values ​​sent to that group key. S234. At the end of the window, each parallel computing task instance outputs the final aggregation state of all grouping keys maintained in its memory as the summary metric data.

4. The visualization method based on a big data platform according to claim 3, characterized in that, The steps in S24 specifically include: S241. According to the requirements of the pre-configured anomaly detection rules or model, extract the corresponding feature data from the data stream; for rule-based detection, extract the values ​​of specific fields or the summary index data; for machine learning model-based detection, construct a feature vector for model input from the original data stream or summary index data. S242. Execute the multimodal detection strategy; including: Rule-based pattern detection: The feature data is compared in real time with a pre-configured static threshold or a dynamic threshold calculated based on historical statistics of a sliding window. If the data exceeds the threshold range, a preliminary abnormal event is generated. Machine learning pattern detection: The feature vector is input into a pre-trained anomaly detection model for analysis, and the model outputs anomaly scores or labels; the anomaly detection model includes an isolated forest algorithm model or a long short-term memory network model. S243. For the preliminary abnormal events generated by rule pattern detection or the abnormal scores output by machine learning pattern detection, make a final abnormal determination according to the predefined judgment rules; for the data records or data streams that are finally determined to be abnormal, add abnormal type, confidence level and timestamp mark and output them.

5. The visualization method based on a big data platform according to claim 4, characterized in that, The steps in S3 include: S31. Based on the type of the summary indicator data, the data volume, and the type of chart to be presented, select WebGL rendering, Canvas 2D rendering, or a hybrid rendering strategy; among them, for time series data and geospatial data with a data volume exceeding the first preset threshold or requiring a three-dimensional effect, WebGL rendering is preferred; for conventional charts with a data volume below the second preset threshold and mainly using two-dimensional interactive controls, Canvas 2D rendering is used. S32. Convert the summary metric data output by the stream processing engine into graphics element data that the rendering engine can recognize; for WebGL rendering, convert the data into a structured array containing vertex positions, colors, and sizes; for Canvas 2D rendering, convert the data into parameters required by the drawing API. S33. When using WebGL rendering, the converted graphics element data is created and stored in the GPU's vertex buffer object. By writing GLSL shader programs, vertex transformation and fragment shading calculations are executed in parallel in the GPU to achieve batch drawing of large-scale data points. When using Canvas 2D rendering, the Canvas 2D context interface is called to draw graphics. S34. Within the same visualization view, WebGL is used to render the underlying large-scale data layer, while Canvas2D is used to render the upper interactive control layer. Finally, the rendering results of the two layers are combined using off-screen rendering technology to output the final image to the display device. S35. For the incremental summary index data continuously output by the stream processing engine, a difference comparison algorithm is used to identify the changed data parts, and only the graphic elements affected by the changed data are locally updated and redrawn.

6. The visualization method based on a big data platform according to claim 5, characterized in that, The steps in S4 include: S41. Extract features for chart recommendation from the summary indicator data, wherein the features include one or more of the following: number of data dimensions, number of measures, data type, existence of time field, existence of geographic information field, and statistical features of data distribution. S42. Execute a multi-modal recommendation strategy; including: Rule Engine Mode: Matches extracted features with a predefined rule base; the rule base defines the mapping relationship between features and chart types; Machine learning mode: The extracted feature vectors are input into a pre-trained chart recommendation model for inference, and the model outputs the recommended chart type and recommendation confidence; the chart recommendation model is a classification model trained using historical chart usage data and corresponding data features as training samples. S43. For the recommendation results output by the rule engine mode and the recommendation results output by the machine learning mode, the final chart type is selected according to the predefined decision-making strategy; when the output results of the two modes conflict, the result with higher recommendation confidence is selected first. S44. Based on the final determined chart type, call the corresponding chart rendering template or configuration, bind the summary indicator data to the chart data source, and trigger the rendering engine to draw and output the final graphic.

7. A visualization system based on a big data platform, used to implement the method according to any one of claims 1 to 6, characterized in that, include: The data access and processing module is used to collect multi-source heterogeneous data and to clean and standardize the collected data. The real-time computing module is used to input the cleaned and standardized data into the stream processing engine for real-time computing, generating summary indicator data for visualization. The real-time computing includes window aggregation and anomaly detection. The visualization rendering module is used to receive the summary index data output by the stream processing engine and perform real-time visualization rendering of the summary index data using WebGL and Canvas hybrid rendering technology. The intelligent recommendation module is used to parse the summary indicator data based on a rule engine or machine learning model during the visualization rendering process, and recommend corresponding chart types for rendering output.

Images