Event correlation analysis and early warning system of security information management platform

Abstract

The invention discloses an event association analysis and early warning system for a security information management platform, and the system comprises an event identifier generation module, an event feature association module, an abnormal event discrimination module, an early warning response execution module, and an early warning triggering module, a data storage module and a behavior verification module. The event identifier generation module determines the association importance in combination with the event emergency level, the type label and the occurrence frequency, and generates a unique identifier; the event feature association module integrates initial, stage and continued feature acquisition values, and compares the values with a reference to form a result; the abnormal event judgment module determines an abnormal monitoring quantity by analyzing a state and the like, and identifies abnormal associated information; and the early warning response execution module optimizes a response path based on a multi-dimensional model in combination with the association importance and historical data. The system improves event identification accuracy, feature association comprehensiveness and the like, and is suitable for security and protection information management.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security event correlation early warning, in particular to an event correlation analysis and early warning system of a security information management platform. BACKGROUND

[0002] With the acceleration of urbanization and the increasing demand for social security, security information management platforms play a crucial role in maintaining public safety and preventing emergencies. However, in the current security management scenario, the frequency of various events is increasing, and the types of events are becoming more complex and diverse, extending from traditional single events such as theft and intrusion to complex events such as group gathering and cyber attacks, which puts higher requirements on the rapid response and accurate early warning of events.

[0003] In the event processing process of existing security systems, there are often problems such as event identification confusion and loose feature correlation. Due to the lack of a unified event identification generation mechanism, different types and different emergency levels of events are often given similar identifications, leading to confusion in event tracing and correlation analysis, reducing processing efficiency; the collection of event features is mostly limited to the initial state, ignoring the stage features in the event development process and the continuation features with subsequent events, making it difficult to effectively mine the correlation between events and easily leading to missed or mistaken situations.

[0004] The abnormal event discrimination method is relatively single, mostly relying on single-dimensional feature parameters for judgment, and it is difficult to comprehensively consider factors such as event identification analysis state and delay duration, resulting in low accuracy of abnormal event recognition. In addition, the adjustment of the early warning response path lacks scientificity, often based on experience for manual intervention, and cannot dynamically optimize the response path according to the correlation importance of the event, historical processing data, etc., causing resource waste or delayed response.

[0005] In terms of data storage, the existing system does not prioritize event data, and a large amount of redundant data is mixed with critical data, increasing the difficulty of data retrieval and hindering event tracing and review. Moreover, the event behavior legitimacy verification mechanism is missing, which may lead to fake event information mixed into the system, interfering with normal security management processes. The existence of these problems makes it difficult for the event correlation analysis capability and early warning response efficiency of the security information management platform to meet the actual application requirements, and a system that can achieve accurate event identification, multi-dimensional feature correlation, intelligent abnormal discrimination, and dynamic early warning response is needed to solve the above difficulties. SUMMARY

[0006] In order to overcome the above technical defects, the present application provides an event correlation analysis and early warning system of a security information management platform.

[0007] To solve the above problems, the present invention is implemented according to the following technical solution:

[0008] In a first aspect, the present invention provides an event correlation analysis and early warning system for a security information management platform, comprising:

[0009] The data collection module is used to collect real-time environmental data through a heterogeneous sensor network deployed in the physical monitoring area, and to preprocess the environmental data to generate standardized security management events.

[0010] The event identifier generation module is used to generate a unique event identifier for each security management event, and calculate the correlation importance of the event based on the event's urgency level, type label, and historical frequency of occurrence through a dynamic weighted algorithm.

[0011] The event feature association module is used to construct the feature evolution sequence of an event and compare the feature evolution sequence with a pre-trained standard event development chain in real time; the standard event development chain is a digital representation of the normal development pattern of an event constructed based on historical normal event data through a time-series machine learning model.

[0012] The abnormal event discrimination module is used to make anomaly discrimination by comprehensively considering the parsing anomalies of event identifiers and the feature deviations of event evolution. Specifically, it calculates the identifier anomaly quantity by monitoring the device status, timeliness, and content integrity of event identifier parsing; it quantifies the feature deviation degree by calculating the angle between the feature vector space of the current event evolution sequence and the standard event development chain; when either the identifier anomaly quantity or the feature deviation degree exceeds its corresponding dynamic threshold, it generates abnormal event association information.

[0013] The early warning response execution module is used to drive the multi-dimensional early warning response model to output and execute the optimal response path based on the correlation importance and the correlation information of the abnormal event.

[0014] In conjunction with the first aspect, the present invention provides a first specific implementation of the first aspect. Specifically, the process by which the event identifier generation module generates a unique event identifier for each security management event and calculates the correlation importance includes:

[0015] The historical occurrence frequency of an event is determined based on the proportion of unprocessed events in the total number of events.

[0016] The event's urgency level attribute, type label attribute, and historical occurrence frequency are evaluated, and the event's correlation importance is determined using a dynamic weighted algorithm.

[0017] Based on the importance of the integrated events, a unique event identifier is generated for each event according to the selection of encoding rules, capacity adaptation, and security level. The encoding rules include timestamp, event type encoding, and geolocation encoding, and the security level selection dynamically adjusts the encryption strength of the identifier based on the importance of the integrated events.

[0018] In conjunction with the first aspect, the present invention provides a second specific implementation of the first aspect. Specifically, the process by which the event feature association module constructs a feature evolution sequence and compares it with a standard event development chain includes:

[0019] Determine the initial features based on the feature parameters of the start and end points in the current event node;

[0020] The stage characteristics are determined based on the characteristic parameters of each fixed time interval during the development of the event and the characteristic parameters before the event occurs;

[0021] Determine the associated features based on the characteristic parameters of the termination point of the current event node and the start point of the subsequent node;

[0022] The initial features, the stage features, and the associated features are integrated to form the feature evolution sequence;

[0023] The feature evolution sequence is compared with the pre-trained standard event evolution chain, and the similarity is quantified by calculating the angle between the feature vector spaces to form the feature comparison result.

[0024] In conjunction with the first aspect, the present invention provides a third specific implementation of the first aspect. Specifically, the process by which the abnormal event discrimination module calculates the anomaly quantity includes:

[0025] Obtain the parsing status, parsing delay duration, and parsing content details of the event identifier parsing device during the event process;

[0026] Based on the parsing status, the parsing location information in the parsing content details, and the parsing content details, the parsing status weight value, the location information matching value, and the content completeness value are determined respectively;

[0027] The parsing status weight value, parsing delay duration, location information matching value, and content integrity value are evaluated to determine the anomaly quantity.

[0028] In conjunction with the first aspect, the present invention provides a fourth specific implementation of the first aspect. Specifically, the process by which the early warning response execution module drives the multi-dimensional early warning response model to output and execute the optimal response path includes:

[0029] Obtain the historical characteristics of the association importance of the event and the historical anomaly monitoring volume of the processing path;

[0030] The multi-dimensional early warning response model is constructed with the optimization objectives of reducing response resource consumption and shortening response time. The model integrates the correlation importance, the historical feature correlation results, and the historical anomaly monitoring volume to determine the comprehensive optimization objective of the multi-dimensional early warning response model.

[0031] Based on the comprehensive optimization objective, the optimal response path is determined.

[0032] In conjunction with the first aspect, the present invention provides a fifth specific implementation of the first aspect, specifically, the process of constructing the comprehensive optimization objective includes:

[0033] The primary optimization direction is to reduce response resource consumption, and the secondary optimization direction is to shorten response time.

[0034] The importance of the association is used as the first weighting factor, the historical feature association results are used as the second weighting factor, and the historical anomaly monitoring volume is used as the third weighting factor.

[0035] By integrating various optimization directions and weighting factors, a comprehensive optimization objective for the multi-dimensional early warning response model is formed.

[0036] In conjunction with the first aspect, the present invention provides a sixth specific embodiment of the first aspect, specifically, further including an event warning triggering module for generating warning information before an abnormal event occurs; specifically:

[0037] Obtain the correlation results of historical event features and the correlation set of current event features, integrate the feature change trends within the preset warning time window, and determine the warning threshold for abnormal events;

[0038] The current event feature association set is compared with the abnormal event warning threshold. If the warning conditions are met, an abnormal event warning message is generated and sent to the management terminal.

[0039] In conjunction with the first aspect, the present invention provides a seventh specific embodiment of the first aspect, specifically, further including an event data storage module for storing key data information during the event process; specifically:

[0040] Based on the importance of the association between events, data storage priorities are determined;

[0041] The event identifiers generated by the event identifier generation module, the feature parameters obtained by the event feature association module, and the event anomaly monitoring quantities determined by the anomaly event discrimination module are classified and stored in different storage media according to the data storage priority to form a traceable event data archive.

[0042] The highest priority data is stored on high-speed storage devices, while the low priority data is stored on low-cost storage devices.

[0043] In conjunction with the first aspect, the present invention provides an eighth specific implementation of the first aspect, specifically, the process by which the early warning response execution module adjusts the current processing path includes:

[0044] Obtain the node load status, response latency data, and bandwidth utilization of the current processing path;

[0045] By integrating the correlation importance, the historical feature correlation results, and the historical anomaly monitoring data, the adjustment priority of each candidate path is determined;

[0046] The load balancing and response stability of candidate paths are evaluated sequentially according to the adjustment priority, and the path with the best load balancing and satisfactory response stability is selected as the optimal response path.

[0047] In conjunction with the first aspect, the present invention provides a ninth specific implementation of the first aspect, specifically, further including an event behavior verification module for verifying the legality of event behavior; specifically:

[0048] Obtain the event identifier generated by the event identifier generation module and extract the verification field from it;

[0049] The verification field is compared with a preset legal identifier library. If a match is found, the event behavior is marked as legal. If a match fails, the event behavior is marked as having a risk of forgery, and the forgery risk information is fed back to the abnormal event discrimination module.

[0050] Compared with the prior art, the beneficial effects of the present invention are:

[0051] In terms of event identifier generation, the system determines the importance of an event by combining its urgency level, type label, and frequency of occurrence, and generates a unique event identifier accordingly, ensuring the uniqueness and relevance of the identifier. This approach avoids the event confusion caused by the chaotic identifiers of traditional methods, making event classification, retrieval, and tracing more efficient. Furthermore, the targeted selection of encoding rules, capacity adaptation, and security levels enhances the adaptability and security of the identifiers, laying a solid foundation for subsequent event processing.

[0052] The event feature association module integrates initial features, stage features, and ongoing features to form a comprehensive set of event feature associations, which are then compared with a benchmark to obtain the association results, breaking through the limitations of traditional methods that only focus on initial features. This multi-dimensional feature collection and association analysis can more accurately capture the development trend of events and their correlation with other events, providing rich feature evidence for the identification of abnormal events and improving the depth and accuracy of event analysis.

[0053] The anomaly detection module comprehensively considers factors such as event identifier parsing status, delay duration, and content details to determine the anomaly quantity, and combines this with a baseline value to judge the anomaly situation, realizing multi-dimensional monitoring of event anomaly states. This approach not only improves the accuracy of anomaly event identification and reduces the probability of missed and false positives, but also allows for the rapid location of related information of anomaly events through anomaly monitoring quantities, providing a clear direction for subsequent early warning responses.

[0054] The early warning response execution module utilizes a multi-dimensional early warning response model, dynamically adjusting the response path based on correlation importance, historical feature correlation results, and historical anomaly monitoring data to ensure the determination of the optimal response path. This process aims to reduce resource consumption and shorten response time, achieving rational resource allocation and improved response efficiency, while avoiding resource waste and response delays caused by traditional manual intervention.

[0055] The newly added event warning triggering module generates warning information before abnormal events occur, thus mitigating risks in advance. The event data storage module achieves orderly data storage through priority allocation, facilitating data retrieval and event traceability. The event behavior verification module effectively prevents interference from forged event information, ensuring the authenticity and reliability of system data. Overall, this system comprehensively enhances the event correlation analysis capabilities, anomaly identification accuracy, and warning response efficiency of the security information management platform, providing more intelligent and efficient technical support for security management. Attached Figure Description

[0056] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings, wherein:

[0057] Fig. 1 This is a schematic diagram illustrating the working principle of the event correlation analysis and early warning system of the security information management platform described in this invention.

[0058] Fig. 2 A flowchart for the event identifier generation module;

[0059] Fig. 3 A flowchart generated from the association results of event features. Detailed Implementation

[0060] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0061] like Figs. 1-3 As shown, the present invention is described in [reference needed]. Figs. 1-3This invention provides an event correlation analysis and early warning system for a security information management platform, including a data collection module, an event identifier generation module, an event feature correlation module, an abnormal event discrimination module, and an early warning response execution module. Specific implementation methods are as follows:

[0062] The data collection module is used to collect real-time environmental data through a sensor network deployed in the physical monitoring area, and to preprocess the environmental data to generate standardized security management events; the environmental data includes at least one of gas concentration, temperature, pressure, vibration or sound signals; wherein the physical monitoring area is a coal mine or a refining and chemical enterprise production area, and the sensor network includes multi-parameter gas sensors, temperature sensors, pressure sensors and vibration sensors, used to monitor the mine's gas concentration, temperature, pressure or equipment vibration status.

[0063] The hardware foundation of the data collection module is a heterogeneous sensor network deployed in a specific physical monitoring area (preferably a coal mine or a refining and chemical enterprise production area in this embodiment). This network consists of multiple types of sensor nodes, which are distributed according to the physical layout and risk points of the monitoring area.

[0064] In coal mine environments, multi-parameter gas sensors are densely deployed in key locations such as mining faces, return airways, and transport roadways to monitor real-time and continuous concentrations of methane (CH4), carbon monoxide (CO), and oxygen (O2) to prevent gas explosions and spontaneous combustion of coal seams. Temperature / humidity sensors monitor the ambient temperature in roadways and the surface temperature of equipment to provide early warnings of fires or equipment overheating. Pressure sensors monitor the air pressure of the mine ventilation system to ensure effective ventilation and prevent methane buildup. Vibration sensors are installed on the bearings and housings of critical mechanical equipment (such as main ventilation fans, hoists, and coal mining machines) to monitor equipment vibration acceleration and frequency for early fault diagnosis.

[0065] In the production areas of refining and chemical enterprises, multi-parameter gas sensors are used to focus on monitoring combustible gas (LEL) and hydrogen sulfide (…). The concentration of volatile organic compounds (VOCs) is monitored to prevent leaks and poisoning accidents. Temperature and pressure sensors are installed on pressure vessels such as reactors, pipelines, and storage tanks to directly monitor temperature and pressure parameters during the production process, ensuring they operate within safe thresholds. Vibration sensors are used to monitor the operating status of rotating equipment such as large compressors and pump sets.

[0066] Sensor nodes aggregate raw data collected via wired / wireless hybrid network protocols such as Industrial Ethernet, Industrial Wi-Fi, ZigBee, or LoRa to a data acquisition gateway deployed at the edge of the area. The data acquisition gateway has built-in edge computing capabilities and is responsible for running the following data preprocessing logic: The gateway receives raw data streams from each sensor and applies statistical (e.g., the 3σ rule) or rule-based filters to identify and remove physically impossible data points caused by instantaneous sensor interference (e.g., a sudden jump in gas concentration to 100%). It converts the raw analog signals or digital readings using preset calibration coefficients (e.g., zero point, range) to ensure the physical accuracy of the data. It assigns a unified timestamp to all data from the same batch or related monitoring points to resolve data timing discrepancies caused by network transmission delays. It performs preliminary feature-level fusion on the cleaned data, weighting and averaging or taking the maximum value from data from multiple similar sensors within the same area to represent the overall state of the area (e.g., the average gas concentration of a coal face). Based on domain knowledge, it calculates derived features. For example, by combining gas concentration, wind speed and tunnel cross-sectional area, the gas emission can be calculated in real time; or by performing a fast Fourier transform (FFT) on the vibration signal to extract its spectral features, which can be used to identify specific fault modes such as equipment imbalance, misalignment or bearing damage.

[0067] The fused effective information is encapsulated into a unified "Security Management Event" data object. This object's data structure includes at least the following fields: serial number (generated by the gateway); the ID of the main sensor that generated the data; the data acquisition time; the geographic location of the sensor deployment; event type tags based on the data source and content, such as: gas concentration warning, abnormal temperature, vibration fault alarm, normal pressure, etc.; a dynamically assigned urgency level based on the comparison between the numerical value and a threshold, such as: critical fault, warning fault, attention fault, normal fault; and a payload, storing the specific monitoring values ​​and characteristics in key-value pairs, for example: {"CH4": 1.2, "CO": 0.002,"O2": 20.8} or {"vibration_rms": 5.6, "dominant_frequency": 120}.

[0068] The event identifier generation module is used to generate a unique event identifier for each security management event, and calculate the correlation importance of the event based on the event's urgency level, type label, and historical occurrence frequency through a dynamic weighted algorithm. The correlation importance is used for priority ranking and resource allocation.

[0069] After receiving standardized security management events from the data collection module, the event identifier generation module first generates a globally unique identifier (UEI) for each event. This UEI is not a simple serial number, but rather employs a composite structure to ensure its uniqueness, readability, and traceability. Its generation rules are as follows: UEI = <Region Code>.<Device Cluster Code>.<Timestamp>.<Event Type Code>.<Random Checksum>;

[0070] Area code: Identifies the physical area where the event occurred, such as MK01 representing Mine No. 1 and PH02 representing Refinery No. 2.

[0071] Equipment cluster code: locates the sub-unit within the area, such as FACE_A representing coal face A, and REACTOR_101 representing reactor number 101.

[0072] Timestamp: Uses Unix timestamps to ensure uniqueness over time.

[0073] Event type coding: Standardized coding based on event type labels, such as GAS_CH4_H representing a high methane concentration alarm, and VIB_BRG_F representing bearing failure vibration.

[0074] Random checksum: A 4-digit hexadecimal random number used to prevent identifier collisions that may occur under extremely high concurrency.

[0075] Example: A high flammable gas alarm event occurring in reactor 101 of the No. 2 refinery area may have a UEI of PH02.REACTOR_101.1672531845123.GAS_LEL_H.A1B2.

[0076] After generating the UEI, the event identifier generation module calculates the "Relevance Ratio" (RI) of the event using a dynamic weighted algorithm. This algorithm comprehensively considers the event's immediate attributes and historical behavior, and the calculation formula is as follows: ;in, , , The dynamic weighting coefficients satisfy the following conditions: ; As an emergency level factor, For type label factor, This is a historical occurrence frequency factor.

[0077] This is a static mapping function that quantifies the urgency level of an event (such as critical, warning, attention, and normal) into numerical values. Example mapping: critical → 1.0, warning → 0.7, attention → 0.4, normal → 0.1. The factor weights... It is usually set to the highest value (such as an initial value of 0.5) because it directly reflects the urgency of the event.

[0078] This is a query function based on a predefined event type importance library. The initial importance for different types is defined by domain experts. Example mapping: Fire Alert (FIRE) → 0.9, Gas Leak (GAS_LEAK) → 0.9, Equipment Failure (EQUIP_FAULT) → 0.6, Parameter Offset (PARAM_OFFSET) → 0.3. This factor weight... Used to balance the inherent risk of event types, the initial value can be set to 0.3.

[0079] By querying the historical event database, the frequency of the event type corresponding to the UEI within a recent time window (such as the past 24 hours) is calculated. The calculation aims to identify "high-frequency anomalies" or "occasional critical events".

[0080] Calculation formula (normalized): ,in, This represents the recent frequency of occurrences. Therefore, frequently occurring events tend to have a value close to 1, while occasional events tend to have a value close to 0. The system monitors the performance of historical frequency factors. If a high-frequency event continues to receive alerts but is not effectively addressed, the system will automatically escalate the alert. The weight (and correspondingly reduced) and This amplifies the impact of the "frequent occurrence" characteristic in importance assessment, forcing the system to invest more resources in addressing this persistent problem. The calculated Relevance Index (RI) is a floating-point number between 0 and 1. The module appends the UEI and RI values ​​to the original event object and outputs them to downstream modules. When processing the event stream, the event correlation analysis engine sorts the events in descending order of RI values, ensuring that high-importance events are analyzed first. The alert response execution module determines the level of response resource allocation based on the RI values. For example:

[0081] when The highest level of response will be triggered, which may simultaneously activate on-site audible and visual alarms, notify multiple responsible persons, and pre-activate emergency procedures.

[0082] when When a high-priority response is triggered, the operations and maintenance team leader is notified, and the event is highlighted on the monitoring dashboard.

[0083] when When a medium-priority response is triggered, the event is logged as a normal operation event or automatically tracked and observed by the system.

[0084] when When a low-priority response is triggered, this event is recorded in the log as normal inspection data.

[0085] The event feature association module is used to construct the feature evolution sequence of an event and compare the sequence with a pre-trained standard event development chain in real time. The feature evolution sequence is formed by integrating the initial features of the event, the periodically collected stage features, and the correlation features across event nodes. The standard event development chain is a digital representation of the normal development pattern of an event constructed based on historical normal event data through a time-series machine learning model. The real-time comparison quantifies the feature deviation by calculating the angle between the feature vector space of the current event evolution sequence and the standard event development chain.

[0086] When a new security management event (with UEI) enters the event feature association module, the system creates a feature evolution sequence for it. This sequence is not static, but a dynamic array that continuously expands over time, integrating three types of features in three stages:

[0087] Initial characteristics: Basic attributes that are recorded when the event occurs and when the event ends.

[0088] Example: {Event Type: Abnormal Gas Concentration, Emergency Level: Warning, Initial Concentration Value: 1.2%, Location: Return Airway of Working Face, Associated Device: Sensor_001}.

[0089] The phased characteristics of periodic data collection: The system captures the latest state of the event from the data stream at fixed time intervals.

[0090] First cycle: {Time offset: +30s, Concentration value: 1.5%, Trend: Increasing, Gradient: 0.3% / min}.

[0091] Second cycle: {Time offset: +60s, Concentration value: 1.8%, Trend: Continuously rising, Gradient: 0.3% / min, Ventilation equipment status: No response}.

[0092] Period N: {...}. Periods one through N together depict the continuous variation curves of the key parameters of the event.

[0093] Cross-event node association features refer to the system searching the global event pool for other events that are spatiotemporally or logically related to the current event and introducing them as context features. Association features include spatial associations and logical associations.

[0094] Spatial correlation: Discover "wind speed decrease" events within the same area.

[0095] Logical association: Discover the associated "ventilator failure" event.

[0096] Example characteristics: {Number of associated events: 2, Strongest associated event type: Equipment failure, Average importance of associated events: 0.7}.

[0097] The final complete feature evolution sequence It can be represented as: .

[0098] The standard event development chain is constructed by analyzing massive amounts of historical normal event data using a time-series machine learning model. A large number of known normal or benign event sequences are extracted from the historical database. The time-series machine learning model can use LSTM or autoencoder models. For example, thousands of "normal gas concentration fluctuations" eventually dissipate safely without causing accidents. The training process allows the time-series machine learning model to learn the spatiotemporal patterns and dynamic laws implicit in these normal sequences. For example, the time-series machine learning model might learn that "under normal ventilation conditions, after a brief increase in gas concentration due to production activities, it usually decreases steadily within 2 minutes along with changes in wind speed." After training, for a given normal event sequence... Temporal machine learning models can map this to a low-dimensional feature vector space and output a standard feature vector that represents its core pattern. . This is a digital representation of the "standard event development chain" for this type of event. The system pre-stores several typical examples for each common event type (such as "gas concentration fluctuation" and "equipment startup vibration"). The currently evolving sequence of events. When input into the pre-trained temporal machine learning model, the model will compress and summarize it into a current feature vector representing the current pattern. In the eigenvector space, calculate Standard feature vectors of similar events Cosine similarity between The range of cosine similarity is [-1, 1]. The closer the value is to 1, the more consistent the directions of the two vectors, meaning the current event's development pattern is more similar to the normal pattern. To more intuitively represent the degree of anomaly, cosine similarity is converted into feature deviation (…). Calculation formula: ;therefore, The range of values ​​is . The closer This indicates that the smaller the deviation of the characteristics, the more normal the development of the event; The larger the value, the higher the deviation of the feature, and the more abnormal the development of the event.

[0099] Under normal circumstances: the current gas concentration is steadily decreasing. Compared with standard feature vectors The included angle is very small, and the cosine similarity is . ,but The system determined it to be normal.

[0100] Abnormal situation: The current gas concentration is continuously surging and is associated with a ventilation failure. and The included angle is large, and the cosine similarity is only [value missing]. ,but The system determines that the deviation is significant and generates a high deviation alarm.

[0101] The abnormal event discrimination module is used to make anomaly discrimination by comprehensively considering the parsing anomalies of event identifiers and the feature deviations of event evolution. Specifically, it calculates the identifier anomaly quantity by monitoring the device status, timeliness, and content integrity of event identifier parsing; it quantifies the feature deviation degree by calculating the angle between the feature vector space of the current event evolution sequence and the standard event development chain; when either the identifier anomaly quantity or the feature deviation degree exceeds its corresponding dynamic threshold, it generates abnormal event association information.

[0102] The processing flow of the abnormal event discrimination module is divided into two parallel discrimination channels:

[0103] Channel 1: Event Identifier Resolution and Anomaly Calculation

[0104] The purpose of Channel 1 is to detect anomalies in the "identity" of events. It analyzes the metadata implicit in the UEI (User Equipment Identity), specifically the "device cluster code" within the UEI, and queries the real-time status of the device management system. An anomaly index is generated if the device is marked as "offline," "under maintenance," or "faulty."

[0105] The timeliness anomaly is calculated by parsing the "timestamp" in the UEI and comparing it with the current system time. The delay from data generation to processing is calculated. The longer the delay, the higher the anomaly index. This can detect "outdated" alerts caused by data retransmission after network interruptions or system processing bottlenecks.

[0106] Content integrity anomalies are determined by checking the completeness of required fields in the event object. This includes checking if fields exist, if the format is correct, and if the values ​​are within a reasonable physical range (e.g., negative concentration). The more missing or invalid fields, the higher the anomaly index.

[0107] Channel Two: Obtaining the Deviation of Event Evolution Features

[0108] Directly receive the pre-calculated feature deviation from the event feature association module. This value quantifies the difference between event content data (such as concentration change trends) and normal patterns.

[0109] The abnormal event detection module does not use a fixed threshold, but rather a dynamic threshold to adapt to the sensitivity requirements of different system operating states.

[0110] Threshold for identifying outliers ( The adjustment is based on the overall system load and communication quality. When the system communication load is high, the adjustment can be appropriately increased. This is to avoid generating too many interfering alarms due to general delays.

[0111] Feature deviation threshold ( The adjustment is based on the historical deviation distribution and current association importance (RI) of this type of event. For events with high RI (high importance), the RI can be appropriately reduced. This makes it more sensitive, thereby enabling key targets to be monitored.

[0112] The final decision logic uses an "OR" relationship to maximize the recall rate of the warning: if ( ) or( If the above conditions are met, the module generates a structured exception event association information message, which includes: the original event ID that triggered the exception determination, the exception type (identified exception, feature deviation exception, or composite exception), and the exception score vector. , ), the threshold that is exceeded ( , And associated context data snapshots (such as associated device status, other events in the same area, etc.).

[0113] The early warning response execution module is used to drive a multi-dimensional early warning response model based on the correlation importance and the correlation information of the abnormal event. The multi-dimensional early warning response model selects an initial response plan from a pre-set plan library and dynamically optimizes the parameters and execution order of the response path through reinforcement learning algorithms based on real-time feedback environmental data and event evolution status, and outputs and executes the optimal response path.

[0114] The Relevance of Association (RI), generated by the event identifier generation module, determines the resource allocation level and urgency of the response action. The abnormal event association information, provided by the abnormal event discrimination module, offers the specific target and context of the response, including the abnormality type and abnormality score vector. The pre-set solution library is a knowledge base storing various standard emergency procedures. Each solution is a structured set of response actions for a specific type of event. When the gas concentration is abnormal, the alarm area is highlighted on the monitoring screen; a level one alarm notification is sent to the handheld terminals of the area inspection personnel; the associated audible and visual alarms are activated; an emergency response order is automatically generated and pushed to the ventilation team. The system matches the most suitable initial response solution from the solution library based on the abnormality type in the abnormal event association information and the event type corresponding to the unique identifier of the triggering event. The Relevance of Association (RI) determines the default intensity of the actions in the solution; for example, a higher RI results in a wider notification range and a louder alarm volume.

[0115] A digital description of the current system environment. This includes: current feature deviation (FDS), real-time environmental data (such as concentration, temperature, equipment status), feedback on the effects of executed response actions, and available resource status. Adjustments to the initial response plan include: adjusting parameters (e.g., increasing ventilation by X% instead of the default 20%), changing the execution order (e.g., executing "notify evacuation" before "equipment intervention" instead of the other way around), and adding or deleting actions (e.g., adding "linkage to close specific valves"). The system begins execution based on the initial response plan, grounded in the current state. Select an optimization action (For example, increasing ventilation to 35%). The environment (i.e., the actual physical monitoring area) reacts to this action and enters a new state. (For example, the gas concentration begins to decrease), and a reward value is given as feedback. The system will use this experience ( , , , The data is stored in the experience replay pool. By continuously sampling and learning from the experience replay pool, the optimizer updates its internal value network (e.g., using DQN or A3C algorithms), thereby learning which optimization actions to take in which states to obtain the long-term maximum reward. Based on the newly learned knowledge, the optimizer outputs the optimal response path at the current moment—that is, a set of specific execution instructions after parameter tuning and sequence optimization. The module converts the optimal response path into a specific, executable instruction set and issues it through the system's executor interface:

[0116] Example instruction 1 (issued to the equipment control system): "Adjust_Ventilation_Fan(FAN_001, speed=35%)";

[0117] Example command 2 (sent to the broadcast system): "Broadcast_Alert(Zone_A, level=3, message='Please evacuate the relevant personnel')".

[0118] Example instruction 3 (issued to the work order system): "Create_Work_Order(priority=Urgent,assigned_team=Maintenance_Crew, checklist=[...])".

[0119] By recording and learning from response experiences, the system can adopt the validated "optimal response path" more quickly and accurately when similar but not identical situations arise again.

[0120] Example 1

[0121] The specific process by which the event identifier generation module generates a unique event identifier for each security management event and calculates its correlation importance includes:

[0122] The historical occurrence frequency of an event is determined based on the proportion of unprocessed events in the total number of events.

[0123] The emergency level attribute, type label attribute, and historical occurrence frequency of the event are evaluated, and the correlation importance of the event is determined by a dynamic weighting algorithm, wherein the dynamic weighting algorithm is based on the entropy weight method to calculate the weight of each attribute;

[0124] Based on the importance of the integrated events, and considering the selection of encoding rules, capacity adaptation, and security level, a unique event identifier is generated for each event. The encoding rules include timestamp, event type encoding, and geographic location encoding.

[0125] A quantum random number generator is used to inject quantum random factors into each event identifier, ensuring the unpredictability and anti-counterfeiting properties of the identifier.

[0126] The calculation of association importance is a quantitative process based on multi-attribute decision-making, the core of which lies in the dynamic allocation of weights. The specific steps are as follows: First, the three evaluation attributes are normalized to eliminate the influence of dimensions.

[0127] Emergency level: Pre-set using expert evaluation method. For example, Emergency = 1.0, Important = 0.7, Normal = 0.3, Alert = 0.1.

[0128] Type labels: Also based on a preset importance mapping table. For example, fire = 1.0, leakage = 0.9, equipment failure = 0.6, parameter out of bounds = 0.3.

[0129] Historical occurrence frequency is not a simple count, but a dynamic value related to the current processing pressure of the system. The calculation formula is: Historical occurrence frequency = (Total number of currently unprocessed events / System event processing capacity) * (Number of occurrences of this type of event within the most recent time window T). This formula ensures that when the system load is too high, high-frequency events will receive a higher frequency factor and thus be prioritized for processing.

[0130] The system periodically (e.g., every 5 minutes) extracts a sample set from the event stream and calculates the information entropy of three attributes. For each attribute, its information entropy is calculated. The calculation formula is ;in It is the first The sample at the th The normalized value for each attribute. The smaller the information entropy of an attribute, the greater the degree of data variation within that time period, the more information it provides, and therefore the greater its weight should be. The weight calculation formula is as follows: .

[0131] At any given time, if the "emergency level" attribute values ​​are highly consistent (all "general"), then its entropy value is high and its weight is low; while the "type label" attribute values ​​vary greatly (both fire and malfunction are present), then its entropy value is low and its weight is high. This achieves dynamic self-adjustment of weights according to the distribution characteristics of events.

[0132] The correlation importance of each event is calculated using dynamically calculated weights. The formula for calculating correlation importance is as follows: ;in, , , The dynamic weighting coefficients satisfy the following conditions: ; As an emergency level factor, For type label factor, The RI value is a historical frequency factor; it is used for prioritizing global events and allocating computing resources in real time.

[0133] The calculated RI value is incorporated into the identifier generation considerations, mainly reflected in:

[0134] Encoding rule selection: High RI value events may use finer timestamps (such as nanosecond level) and more detailed geolocation encoding (such as specific to device coordinates), while low RI value events use coarser granularity.

[0135] Capacity adaptation selection: The system dynamically adjusts the sequence number length of the identifier based on the total number of unprocessed events to cope with event surges and ensure that the identifier space is never exhausted.

[0136] Security level selection: Events with high RI values ​​automatically trigger higher-level security coding rules.

[0137] Based on the selected rules above, generate the main structure of UEI: UEI = <RI level prefix>.<Geographical area code>.<Device location code>.<Type code>.<Precise timestamp>.

[0138] To prevent the unique identifier from being forged or predicted, at the end of the structured encoding, a random number generated by a quantum random number generator is integrated. The system is connected to a physical random number generator based on optical quantum vacuum fluctuations or semiconductor quantum tunneling effects to obtain a segment of true random numbers (e.g., 16-bit hexadecimal numbers) in real time for each UEI. The final UEI: UEI = <Structured encoding>@<Quantum random factor>; this quantum random factor ensures the global uniqueness, unpredictability, and non-repeatability of UEI, fundamentally eliminating the possibility of data injection attacks through reverse engineering or prediction, and laying a solid foundation for the data credibility of the entire system.

[0139] Embodiment 2

[0140] The process of the event feature correlation module constructing a feature evolution sequence and comparing it with the standard event development chain includes:

[0141] Determine the initial features according to the feature parameters of the starting end and the ending end in the current event node;

[0142] Determine the stage features according to the feature parameters at fixed intervals during the event development process and the feature parameters before the event occurs;

[0143] Determine the correlation features according to the feature parameters of the ending end of the current event node and the starting end of the subsequent node;

[0144] Integrate the initial features, the stage features, and the correlation features to form the feature evolution sequence, where the feature evolution sequence is represented as a multi-dimensional feature vector;

[0145] Compare the feature evolution sequence with the pre-trained standard event development chain, and quantify the similarity by calculating the included angle of the feature vector space to form a feature comparison result;

[0146] Construct a digital twin environment to reproduce the event development process in real time in the virtual space, and verify the accuracy of the feature evolution sequence by comparing the deviation between the virtual deduction result and the actual event data.

[0147] The initial features include capturing the event at the starting end ( ) and the ending end (the current latest moment The global state parameters of the event; snapshot data when the event was first identified; and the latest data at the current moment. Specific data includes: initial intensity values ​​(e.g., initial concentration, initial vibration amplitude), cumulative changes (e.g., from...). arrive Total concentration change), total duration ( The initial and current states of the spatial scope are also considered. The purpose of obtaining the initial features is to describe the overall outline and scope of influence of the event.

[0148] Stage characteristics refer to the fixed time intervals during the development of an event ( The features collected and compared with those before the event occurred ( The baseline data is compared with that of the target data. Stage feature data is data extracted periodically (e.g., every 30 seconds) from the data stream. Specific parameters include: instantaneous values ​​(e.g., concentration at that moment), gradient of change (…). The parameters include the acceleration of change (rate of change of gradient) and the offset from the baseline state (difference between the current value and the normal value before the event); the purpose is to characterize the dynamic process, trend and rate of event evolution.

[0149] Association features, based on causal graphs and event graphs, analyze the association parameters between the termination point of the current event node and the starting point of its triggered subsequent event nodes. The data for association features is a global event graph database. Specific parameters include: the number of direct causal events, key associated event types (e.g., "gas exceeding limits" associated with "wind speed decrease"), the average importance (RI) of the associated event chain, and the scope of impact across subsystems. The purpose is to assess the cascading risk and global impact of events from a system-level perspective.

[0150] The feature evolution sequence integrates the above three types of features into a unified multidimensional feature vector, forming a complete time series sequence. This can be represented as... This sequence serves as a comprehensive digital representation of the current event development pattern.

[0151] The feature evolution sequence of the current event Input the pre-trained time series model and map it to a high-dimensional feature vector space to obtain the current feature vector. ,calculate Standard event development chain vector of similar events The cosine similarity between them. The similarity formula is: The similarity result is used as the feature comparison result. The closer the value is to 1, the more it matches the normal pattern.

[0152] Based on the type and location of the event, the system creates a corresponding digital twin in real time in virtual space. This twin includes relevant physical models (such as fluid dynamics models and equipment vibration models), a rules engine, and a real-time data interface.

[0153] Using the initial state of the current event and the actions already taken as input, the system drives a digital twin to perform real-time simulation and deduction, predicting the physical development of the event over a future period. The system continuously compares the deviations between the virtual simulation results and the actual event data.

[0154] If the deviation is small, it proves that the feature evolution sequence accurately captures the physical essence of the event, enhancing the confidence of the current analysis.

[0155] If the deviation is large, it indicates that the feature sequence may not fully reflect the complexity of reality, or that there are unknown interference factors. In this case, the system will trigger an alarm, indicating that the analysis model may need to be corrected, or that there are new situations on site that have not been captured by the sensors.

[0156] Example 3

[0157] The specific process by which the abnormal event discrimination module calculates the anomaly quantity and feature deviation includes:

[0158] Obtain the parsing status, parsing delay duration, and parsing content details of the event identifier parsing device during the event process;

[0159] Based on the parsing status, the parsing location information in the parsing content details, and the parsing content details, the parsing status weight value, the location information matching value, and the content completeness value are determined respectively;

[0160] The parsing state weight value, the parsing delay duration, the location information matching value, and the content integrity value are evaluated, and the anomaly quantity is calculated using a weighted summation formula.

[0161] Simultaneously, the angle between the feature vector space of the current event evolution sequence and the standard event development chain is calculated to quantify the feature deviation, wherein the angle between the feature vector space is calculated by cosine similarity.

[0162] When either the identified abnormal quantity or the feature deviation exceeds its corresponding dynamic threshold, abnormal event association information is generated. The dynamic threshold is adaptively adjusted based on historical abnormal data.

[0163] A multimodal fusion mechanism is introduced to perform cross-modal correlation analysis on visual monitoring data, audio features, and sensor data, thereby improving the accuracy of anomaly detection.

[0164] The anomaly detection module calculates a comprehensive anomaly count from four dimensions by deeply analyzing the metadata of the event identifier. Retrieve key parameters during the event identifier resolution process:

[0165] Resolution Status: The real-time working status of the resolution device (normal, offline, faulty, unstable communication).

[0166] Parsing latency: The time difference between when data is generated and when it is successfully parsed ( ).

[0167] Parsing details: Includes the parsed geographic location coordinates, device ID, data format, and other raw information.

[0168] Analyze the state weight values ​​( ): Values ​​are assigned based on a predefined device status-weight mapping table, for example, fault = 1.0, offline = 0.9, communication unstable = 0.6, normal = 0.

[0169] Location information matching value ( The parsed geographic location is compared with the preset geofence of the event's location. If the location exceeds the fence or does not match the logical location of the event, then... Otherwise, it is 0.

[0170] Complete content value ( ): Check the missing rate of required fields and format compliance in the parsed content. The formula for calculating the complete content value is as follows:

[0171] Time-sensitive outliers ( The parsing delay time is normalized. The formula for calculating time-out anomalies is as follows: ,in, It is the maximum tolerable delay allowed by the system.

[0172] Calculate the overall outlier count using a weighted formula: ;in, , , These are the weighting coefficients. To analyze the state weight values, This is an outlier due to time constraints. For complete content value, The specific location information matching values ​​are configured according to the scenario. The weights w1 to w4 are preset by domain experts based on the importance of each dimension and can be fine-tuned based on system performance.

[0173] Receive the current event evolution sequence feature vector from the event feature association module. and the feature vector of the standard event development chain The angle between two vectors in the feature space is calculated using cosine similarity and then converted into feature deviation. ): This calculation is mathematically equivalent to measuring the difference in the directions of two vectors. It is not sensitive to the absolute magnitude of the vectors and can better capture the essential differences in patterns.

[0174] Scenario A (primarily anomaly): The system receives a gas alarm event, its (Mode is normal), but analyzing its UEI reveals that the data originates from a sensor whose status is "power off". , Although the data content appears normal, the system identifies it as an anomaly and generates an alert: "Suspected forged data or system configuration error received."

[0175] Scenario B (primarily characterized by abnormal deviations): The system receives a vibration event, the identifier of which is completely normal. However, its vibrational sequence differs greatly from standard healthy patterns. The system determines that the feature deviates abnormally and generates an alarm: "Equipment XXX's operating status has seriously deviated from the healthy mode, predictive maintenance alarm".

[0176] Scenario C (Compound Anomaly): A stress event originating from a device reporting "unstable communication" ( Its pressure rise curve is also unusually steep. The two are combined to generate a composite anomaly alert with higher confidence.

[0177] Real-time video streams are acquired from cameras, and behavioral features (such as running people and smoke patterns) are extracted using a computer vision (CV) model. Ambient sound is acquired from a microphone array, and voiceprint features (such as abnormal sounds and equipment noises) are extracted. Traditional physical environment sensor data is also used. A multimodal feature fusion network is constructed to map feature vectors from different modalities to the same semantic space. When sensor data shows "temperature increase" and visual data simultaneously identifies "open flame," the anomaly confidence level is multiplied. When a vibration sensor alarms but audio feature analysis fails to capture a corresponding abnormal sound, the anomaly weight of that vibration event may be reduced, suggesting a possible false alarm.

[0178] Threshold for identifying outliers ( ) and feature deviation threshold ( These are not fixed values. The system adjusts the thresholds in real time using statistical process control (SPC) techniques based on the distribution of historical anomaly data (such as the mean and variance within a sliding window) and the current overall system load rate to balance the false alarm rate and the missed alarm rate.

[0179] like( ) or( If the condition is met, it is determined to be an abnormal event. When the condition is met, the module generates a structured abnormal event association information message, which not only includes the basic abnormal score and type, but also adds a multimodal fusion confidence field, which reflects the consistency of different modal data in the discrimination results.

[0180] Example 4

[0181] The process by which the early warning response execution module uses the multi-dimensional early warning response model to determine the optimal response path includes:

[0182] Obtain the historical characteristics of the association importance of the event and the historical anomaly monitoring volume of the processing path;

[0183] The multi-dimensional early warning and response model is constructed with the optimization objectives of reducing response resource consumption and shortening response time, and integrates...

[0184] The correlation importance, the historical feature correlation results, and the historical anomaly monitoring volume are used to determine the comprehensive optimization objective of the multi-dimensional early warning response model;

[0185] Based on the comprehensive optimization objective, a reinforcement learning algorithm is used to dynamically adjust the parameters and execution order of the response path based on real-time environmental data and event evolution status, and to solve for and determine the optimal response path.

[0186] By introducing a federated learning mechanism, early warning and response experience can be shared across regions while protecting privacy, and the multi-dimensional early warning and response model can be continuously optimized.

[0187] The multi-dimensional early warning and response model's decisions are based on a deep fusion of current events, historical experience, and global knowledge. The module receives three core inputs:

[0188] Association importance refers to the global priority of the current event. Historical feature association results refer to successful / failed response cases and their effectiveness evaluations that are similar to the evolution sequence of the current event's features in the historical record. Historical anomaly monitoring volume refers to the frequency and intensity of abnormal events occurring in the system as a whole or in a specific area within a recent time period, used to assess the current system's "stress level". The multi-dimensional early warning response model defines a comprehensive optimization objective that balances efficiency and cost.

[0189] As a negative penalty, the importance of association means that more resources and time can be invested in high-importance events to ensure effective handling.

[0190] Historical success rates are derived from the correlation results of historical features, encouraging models to select high-success-rate paths that have been validated in the past.

[0191] The system dynamically adjusts its approach based on historical anomaly monitoring data. When the system detects a high frequency of anomalies, the weight of response time will be appropriately increased to achieve faster processing speeds. Status includes real-time environmental data, event evolution status, available resource status, and contextual features extracted from historical feature correlation results. The adjustment space for the pre-defined response plan includes:

[0192] Parameter adjustments: such as ventilation volume and alarm volume.

[0193] Order adjustment: such as whether to isolate the area first or start fire suppression first.

[0194] After an agent takes an action, it receives a positive reward if it reduces the overall optimization objective value (i.e., brings it closer to the objective). The model uses reinforcement learning algorithms such as Proximal Policy Optimization (PPO) to learn a policy network π(A|S) through trial and error in a virtual simulation environment. This network can adjust its policy based on the current state. Directly output the optimal action with the highest probability. The sequence of these actions constitutes the optimal response path. On local servers in each region (such as a single mine or refinery), local historical feature correlation results and anomaly monitoring data are used to train a local multi-dimensional early warning response model, generating model updates (gradients or weight parameters). Each local server encrypts the model updates and uploads them to the central federated learning server, while the original data remains locally. The central server securely aggregates model updates from multiple regions (using algorithms such as FedAvg) to generate a more powerful and general global early warning response model. The updated global model is then distributed back to each region and integrated into local decision-making systems. The experience gained from successfully handling a rare gas anomaly in Mine A can be securely applied to the system of Mine B as model parameters, without sharing any sensitive raw operational data.

[0195] Example 5

[0196] The process of constructing the comprehensive optimization objective includes:

[0197] The primary optimization direction is to reduce response resource consumption, and the secondary optimization direction is to shorten response time.

[0198] The importance of the association is used as the first weighting factor, the historical feature association results are used as the second weighting factor, and the historical anomaly monitoring volume is used as the third weighting factor.

[0199] By integrating various optimization directions and weighting factors, a comprehensive optimization objective of the multi-dimensional early warning response model is formed using a multi-objective optimization function, wherein the multi-objective optimization function is a linear weighted sum or Pareto optimization; an attention mechanism is introduced to dynamically adjust the influence of each weighting factor in the response process to achieve adaptive optimization.

[0200] The first optimization direction (resource efficiency): reduce response resource consumption. This is the foundation for the long-term stable operation and economy of the system. Specific indicators include: manpower input, equipment wear and tear, energy consumption, etc.

[0201] The second optimization direction (response efficiency): shortening response time. This is key to controlling the situation and reducing losses. Specific indicators include: the time from event confirmation to the first response, and the overall handling cycle.

[0202] First weighting factor - Relevance Importance: The first weighting factor ensures that system resources are tilted towards the most critical events. Events with high relevance importance are allowed to occupy more resources or have longer processing time in order to pursue thorough handling.

[0203] The second weighting factor – historical feature association results: The second weighting factor injects "experience" into the model. It comes from pattern matching of historical successful cases, encouraging the system to prioritize high-success-rate response paths that have been validated in similar scenarios.

[0204] The third weighting factor – historical anomaly monitoring volume: The third weighting factor reflects the system's "global pressure". When the system as a whole experiences a high frequency of anomalies, it is necessary to adjust the optimization approach, for example, by focusing more on quickly releasing resources (shortening the time) to cope with possible concurrent events.

[0205] The multi-objective approach is used to transform the multi-objective objective into a single integrated objective, the function of which is: ;

[0206] in: This is resource consumption (normalized to [0,1]); This is the response time (normalized to [0,1]). It is the importance of association (0-1, the larger the value, the more important). It represents the historical success rate (0-1, the larger the value, the higher the success rate). This is system pressure compensation (0-1, the larger the value, the more idle the system). and These are the basic weights, corresponding to two optimization directions; It is the coefficient of the first weighting factor, and is used as a negative term to allow high-importance events to tolerate higher J values; It is the coefficient of the second weighting factor, also a negative term, to encourage the adoption of experiences with high success rates; It is the coefficient of the third weighting factor, which dynamically affects and When the historical anomaly monitoring volume is high, It will increase, thereby indirectly improving The weighting of response time prompts the system to shift to a faster response mode. For advanced applications that require demonstrating multiple trade-offs, Pareto optimization can be used to find a set of non-dominated solutions (Pareto fronts) for decision-makers to choose from based on real-time conditions.

[0207] Construct a lightweight attention network whose input is a vector representation of the current state, including: event evolution stage, real-time resource availability, number of concurrent events, etc. This attention network will output a set of dynamic attention scores. , , This is used to scale the influence of each weighting factor in real time.

[0208] ; ; ;

[0209] Attention networks may assign importance to associations when an event first breaks out. ) and response time ( Extremely high attention score, pursuing rapid control and high-priority handling.

[0210] When an event enters a stalemate, attention may shift to the correlation between historical features and results. They tend to prefer proven and robust solutions.

[0211] When the system detects new concurrent events, attention significantly increases the amount of historical anomaly monitoring. The score of the current event may prompt the current event handling strategy to free up resources for the whole, and may switch to a maintenance strategy with lower resource consumption.

[0212] Example 6

[0213] It also includes an event warning triggering module, used to generate warning information before abnormal events occur; specifically:

[0214] Obtain the correlation results of historical event features and the correlation set of current event features, integrate the feature change trends within the preset warning time window, and use a time series prediction model to determine the warning threshold for abnormal events;

[0215] The current event feature association set is compared with the abnormal event warning threshold. If the warning conditions are met, an abnormal event warning message is generated and sent to the management terminal.

[0216] Based on causal reasoning algorithms, key causal chains in the development of events can be identified, allowing for early intervention of the root causes that may lead to abnormal events.

[0217] The results of historical event feature association are a series of feature evolution sequences of a large number of historical events stored in the database and their labels indicating whether they ultimately lead to anomalies.

[0218] The current event feature association set refers to real-time event feature data that is evolving and has not yet been judged as abnormal.

[0219] The system defines a preset warning time window (e.g., 5-10 minutes in the future) and focuses on the characteristic change trend within this window, such as gradient and acceleration.

[0220] By associating historical event features with the results, a time series prediction model (such as LSTM, Transformer, or TCN) is trained. The model's learning objective is to predict the trend of feature values ​​within a future warning time window based on the feature sequence of the event's preceding period. The time series prediction model not only provides predicted values ​​but also outputs a prediction confidence interval. The system uses the upper limit (for risk indicators, such as concentration) or lower limit (for safety indicators, such as wind speed) of this confidence interval as a dynamic abnormal event warning threshold. This threshold is not fixed; it dynamically changes based on the event type, location, and current environmental context (such as production intensity), thereby achieving accurate warnings.

[0221] The event warning trigger module continuously monitors the current event feature association set; if the feature value (or its predicted value) of the current event reaches or exceeds the calculated dynamic warning threshold, a warning is immediately triggered. For example, if the system predicts that the gas concentration at a certain working face will reach 0.8% (the warning threshold) in 8 minutes, and the current concentration is only 0.5%, its upward trend is rapid, leading the prediction model to determine that the risk is extremely high. Therefore, a warning is generated immediately, rather than waiting until the concentration reaches 0.8%.

[0222] Once the warning conditions are met, the module generates structured abnormal event warning information. This information includes: the type of potential abnormal event, the predicted probability of occurrence, the expected time of occurrence, key causative factors, and recommended intervention measures. This information is pushed to management terminals (such as the control room screen or the responsible person's mobile APP) in real time through the platform interface, and provides audio and visual alerts.

[0223] The event warning trigger module runs a causal reasoning algorithm (such as causal discovery based on PC or FCI algorithms, or intervention analysis using Do-Calculus). This algorithm constructs a causal graph between event features based on historical and real-time data, rather than simply identifying correlations. The algorithm can identify the key causal paths leading to the eventual abnormal event. For example, analysis might reveal that a slight decrease in cooling water flow is the direct cause of a slow increase in reactor temperature, which in turn is the primary cause of abnormal pressure.

[0224] Once a key causal chain is identified, the system generates an early warning at its inception. When the system confirms through causal reasoning that "reduced cooling water flow" is the root cause, it does not wait for "temperature increase" or "pressure anomaly" to occur, but directly generates an early warning for the root cause of "reduced cooling water flow": "Warning: Reduced efficiency of the cooling water system detected, expected to cause reactor overpressure risk in 15 minutes. Immediate inspection of water pumps and pipelines is recommended." Simultaneously, this warning information is linked with the early warning response execution module, suggesting or directly executing targeted initial response actions, such as "starting the backup cooling water pump," thereby eliminating the root cause before the abnormal event occurs.

[0225] Example 7

[0226] It also includes an event data storage module, used to store key data information during the event process; specifically:

[0227] Based on the importance of the events, data storage priorities are assigned. Event identifiers generated by the event identifier generation module, feature parameters obtained by the event feature association module, and event anomaly monitoring quantities determined by the anomaly event discrimination module are classified and stored in different storage media according to the data storage priorities, forming a traceable event data archive. The highest priority data is stored in high-speed storage devices, and the lower priority data is stored in low-cost storage devices. Blockchain technology is introduced to perform tamper-proof distributed storage of key event data, ensuring data security and traceability.

[0228] The module receives data streams from upstream modules, and each data packet carries its corresponding importance value.

[0229] The system divides data into different storage priorities based on preset thresholds:

[0230] The highest priority (P0) is RI ≥ 0.8, which specifically includes abnormal events that lead to the warning, critical equipment failures, etc.

[0231] High priority (P1) is 0.5 ≤ RI < 0.8, which specifically includes warning events that need to be monitored.

[0232] The medium priority (P2) is 0.2 ≤ RI < 0.5, which specifically includes general operational events and parameter fluctuations.

[0233] Low priority (P3) is defined as RI < 0.2, which includes normal inspection data and low-value logs.

[0234] The system automatically routes data to different storage media based on data priority, forming a traceable event data archive.

[0235] Highest priority data (high-speed storage): Stored in an all-flash array or NVMe SSD. Ensures extremely low latency access to all critical details, including high-frequency raw sensor readings and complete video recordings, during incident review and in-depth analysis.

[0236] High-priority data (performance storage): Stored on high-performance SAS hard drives. This balances performance and cost, making it suitable for common query and analysis tasks.

[0237] Medium-priority data (capacity storage): Stored on large-capacity SATA hard drives or distributed file systems. Used to store data that is not frequently accessed but needs to be retained online.

[0238] Low-priority data (archive storage): Stored in object storage or tape libraries. A cold storage strategy significantly reduces long-term storage costs, accessing data only when legally audited or for macroeconomic trend research.

[0239] All data is archived in a structured manner, linked by Event Identifier (UEI) as the primary key. A complete event data archive contains:

[0240] Event metadata comes from the event identifier generation module (UEI, RI, etc.).

[0241] The feature evolution data comes from the event feature association module (feature sequence, FDS value, etc.).

[0242] The anomaly detection records come from the anomaly event detection module (IAS, FDS, judgment results, etc.).

[0243] The response execution log comes from the alert response execution module (response path, execution results, etc.).

[0244] Not all data is recorded on the blockchain; instead, the highest priority data is stored immutably. This includes: the event's UEI (User Information Identity), key timestamps, the final anomaly detection conclusion, the alert information summary, and the response instruction hash.

[0245] The system generates a Merkle tree for the highest priority data in each batch and calculates its root hash. This hash, along with key metadata, is packaged into a transaction and sent to a permissioned blockchain network maintained by multiple regulatory nodes or cross-departmental agencies. Once the transaction is confirmed and written into a block, its content is cryptographically considered immutable and forgery-proof.

[0246] In the event of incidents, disputes, or security audits, on-chain data can serve as legally valid electronic evidence. Any attempt to modify key event records will be detected because altering the original data will result in a hash value that does not match the on-chain record. The distributed ledger feature enables regulators, operators, and other parties to collaborate based on the same trusted data foundation.

[0247] Example 8

[0248] The specific process by which the early warning response execution module adjusts the current processing path includes:

[0249] Obtain the node load status, response latency data, and bandwidth utilization of the current processing path;

[0250] By integrating the correlation importance, the historical feature correlation results, and the historical anomaly monitoring data, the adjustment priority of each candidate path is determined;

[0251] The load balance and response stability of the candidate paths are evaluated sequentially according to the adjustment priority. The path with the best load balance and the best response stability is selected as the optimal response path. The load balance is evaluated by calculating the node load variance.

[0252] By introducing edge computing nodes, some response tasks can be offloaded to edge devices for execution, reducing cloud load and improving response speed.

[0253] The early warning response execution module continuously obtains real-time performance data of each node on the current processing path from the system monitoring platform:

[0254] Node load status: CPU and memory utilization of each server or processing unit.

[0255] Response latency data: average latency from instruction issuance to execution, 95th percentile latency.

[0256] Bandwidth utilization: The bandwidth usage of a network link.

[0257] The system maintains a candidate path library, where each path is accompanied by historical feature correlation results (such as average success rate and average execution time). The module integrates the correlation importance (RI) of the current event, the historical anomaly monitoring volume (system pressure), and the historical performance of the candidate paths, and calculates the adjustment priority score for each candidate path through a scoring algorithm.

[0258] When the historical anomaly monitoring volume is high (system pressure is high), paths with shorter historical execution times will receive higher priority.

[0259] When an event has a high relevance importance (RI), paths with a high historical success rate will receive higher priority.

[0260] The system performs a detailed feasibility assessment on each candidate path in descending order of adjustment priority.

[0261] Evaluation Metric 1: Load Balancing

[0262] Predict the load on each node along the path after the response task for this event is assigned to that path. Calculate the variance of the predicted load rate for all nodes. The smaller the variance, the better the load balancing, which can effectively avoid single-point overload.

[0263] Evaluation metric 2: Response stability

[0264] Can this path meet the response time requirements under the current system pressure? The predicted 95th percentile response delay must be lower than the maximum tolerable delay required for this event type. The system selects the highest priority path with optimal load balancing (minimum node load variance) and satisfactory response stability, and determines it as the final optimal response path.

[0265] The complete response task is broken down into latency-sensitive subtasks and computationally intensive subtasks.

[0266] Latency-sensitive subtasks (such as immediately triggering local audible and visual alarms or closing the nearest solenoid valve) are directly sent to edge computing nodes (such as edge servers or smart gateways deployed in workshops or underground) for execution.

[0267] Reduce cloud load: Many simple, local control commands no longer consume the processing resources and network bandwidth of the core cloud platform.

[0268] Improved response speed: Edge processing avoids network latency caused by uploading data to the cloud and then retransmitting it, enabling millisecond-level local rapid response, which is crucial for containing the initial situation.

[0269] The cloud focuses on computationally intensive subtasks, such as global policy optimization, multi-event correlation analysis, and model training.

[0270] Example 9

[0271] It also includes an event behavior verification module, used to verify the legality of event behaviors; specifically:

[0272] Obtain the event identifier generated by the event identifier generation module and extract the verification field from it;

[0273] The verification field is compared with a preset legal identifier library. If a match is found, the event behavior is marked as legal. If a match fails, the event behavior is marked as having a risk of forgery, and the forgery risk information is fed back to the abnormal event discrimination module.

[0274] Introducing biometric identification technology allows for the verification of the legitimacy of events through the operator's fingerprint, voiceprint, or iris features, preventing unauthorized operations.

[0275] The event behavior verification module receives a unique event identifier (UEI) from the event identifier generation module and extracts specific verification fields from the structured encoding of the UEI. These fields include, but are not limited to:

[0276] Quantum random factors are used to verify the unpredictability and uniqueness of identifiers.

[0277] Digital signature hashes are used to verify the integrity and authenticity of an identifier.

[0278] The issuing authority code is used to verify whether the source of the identification is legitimate.

[0279] The event behavior verification module maintains a legitimate identifier library, which stores legitimate identifier templates, valid digital certificates, and current quantum random number sequence states for all authorized devices and sensors.

[0280] If the extracted verification field (such as the digital signature) can be verified using the public key of the corresponding certificate in the legitimate identifier library, and the quantum random factor is within the expected valid sequence, then the event identifier is deemed legitimate. The event is marked as "verified" and the subsequent process continues.

[0281] If the verification field fails verification (e.g., invalid signature, mismatched quantum random factor, or has been reused), the event behavior is immediately determined to be at risk of forgery.

[0282] When a forgery risk is detected, the module generates a forgery risk information message and feeds it back to the abnormal event discrimination module in real time.

[0283] The message includes: the Event Entity Information (UEI) involved, the type of forgery risk, and the confidence level.

[0284] Linkage effect: After receiving this information, the anomaly detection module will significantly improve the score of its Identification Anomaly Quantity (IAS) regardless of the Feature Deviation Degree (FDS) of the event, or directly trigger anomaly detection, thereby achieving "one-vote veto" and greatly improving the system's defense against forgery attacks.

[0285] Feature binding: During system initialization, the biometrics (such as fingerprints, voiceprints, or irises) of authorized operators (such as control room operators or field maintenance engineers) and their operation permission levels are pre-recorded and stored in a secure encrypted database.

[0286] Verification Trigger: When the system needs to perform critical or high-privilege operations (e.g., manually confirming the cancellation of the highest-level alarm or remotely controlling critical equipment), the early warning response execution module will send an operation verification request to the event behavior verification module.

[0287] The system prompts the operator to provide biometrics (such as pressing a fingerprint with a fingerprint scanner, or speaking a specific command into a microphone to collect a voiceprint).

[0288] The event behavior verification module compares real-time collected biometric data with pre-stored templates in the database. If the operator's identity and permissions are both legitimate, the system allows the operation and records "Operation has passed biometric authentication." If either the operator's identity or permissions are illegitimate, the system immediately terminates the operation, generates an "Unauthorized Operation Attempt" security event, and triggers the highest-level security alert. This event is directly reported to the security manager, and a tracing investigation process is initiated.

[0289] Example 10

[0290] It also includes an adaptive learning module for continuously optimizing system performance; specifically:

[0291] Collect various performance indicators during system operation, including response accuracy, false alarm rate, and response latency.

[0292] Based on deep reinforcement learning algorithms, a system performance optimization model is constructed to dynamically adjust the parameter configuration of each module;

[0293] By combining online learning with offline training, the system's early warning accuracy and response efficiency are continuously improved.

[0294] The adaptive learning module collects comprehensive performance metrics from all aspects of the system to form a quantitative view of the system's "health":

[0295] Response accuracy: The ratio of the number of real abnormal events that were correctly alerted and handled to the total number of alert events.

[0296] False alarm rate: The ratio of the number of false alarms to the total number of alarms.

[0297] Response latency: The average time from the occurrence of an event to the system initiating a valid response.

[0298] Additional metrics include: false negative rate (real anomalies that are not alerted), resource consumption efficiency, and processing throughput of each module.

[0299] State space (S): defined as the vector of various performance metrics currently collected, such as [Accuracy, False Alarm Rate, Latency, ...].

[0300] Action Space (A): Defined as the adjustment actions for key adjustable parameters in the system. For example: adjusting the dynamic thresholds of the Identifier Scale (IAS) and Feature Deviation (FDS) in the abnormal event discrimination module; adjusting the weight update frequency of the entropy weight method in the event identifier generation module; adjusting the weight coefficients (λ1~λ4) of the multi-objective optimization function in the early warning response execution module.

[0301] Reward function (R): used to guide the model to optimize in the desired direction.

[0302] R = w1 * accuracy + w2 * (1 - false positive rate) + w3 * (1 / latency) + w4 * resource efficiency; this function encourages the model to improve accuracy while reducing false positives and latency, and also considers resource utilization efficiency. A well-trained deep reinforcement learning agent can output optimal parameter adjustment actions A_t based on the current system state S_t. These adjustments are applied in real time to the corresponding modules, achieving dynamic, online self-optimization of system parameters.

[0303] Example: When the system detects a recent increase in the "false alarm rate", the agent may automatically fine-tune the anomaly detection threshold, slightly increasing it while ensuring no missed detections, thereby filtering out some edge interference signals.

[0304] Offline training mode: During system maintenance windows or low-load periods, a large amount of historical operational data is used as the training set to fully and deeply train the deep reinforcement learning model. This process is computationally intensive, but it can learn more robust and general optimization strategies, avoiding potential risks to the production system caused by the exploratory behavior of online learning.

[0305] Online learning mode: During normal system operation, lightweight online learning algorithms (such as online policy gradient methods) are employed. Based on small amounts of new data generated in real time, the model is fine-tuned and incrementally updated, enabling the system to quickly adapt to slowly changing operating conditions or emerging threat patterns. Experience accumulated through online learning is periodically incorporated into the offline training library and integrated during the next offline training session, forming a virtuous cycle of learning.

[0306] Example 11

[0307] The specific implementation process of the event propagation and deduction module includes:

[0308] Construct an event propagation knowledge graph based on historical event data to identify causal relationships between events;

[0309] Graph neural networks are used to simulate the propagation path of abnormal events in a monitoring network and predict the scope of impact.

[0310] By combining the Monte Carlo method to perform multiple random simulations, the probability of each node being affected is calculated, and a risk heatmap is generated.

[0311] The simulation results are fed back to the early warning response execution module to optimize resource allocation and response strategies.

[0312] The event propagation and deduction module extracts historical event data from the event data storage module, including information such as event type, occurrence time, spatial location, and handling results. It then uses causal discovery algorithms (such as PC algorithm and FCI algorithm) to automatically mine causal relationship rules between events from the historical data.

[0313] The knowledge graph is constructed as follows: nodes represent different types of events (such as "gas exceeding limits", "equipment failure", "ventilation abnormality"). Edges represent causal relationships between events, and the weights on the edges represent the strength and probability of triggering the causal relationship.

[0314] Example: "Fan malfunction" → (leading to) → "Decreased wind speed" → (further leading to) → "Gas accumulation".

[0315] The event propagation simulation module uses a graph neural network to dynamically simulate the propagation of abnormal events.

[0316] The constructed event propagation knowledge graph is used as the underlying topology of a graph neural network (GNN). When a new anomalous event occurs, the event propagation knowledge graph is injected into the GNN as nodes. The GNN simulates the propagation of the anomalous state within the monitoring network based on the causal relationships connected in the graph. Through a message passing mechanism, each node aggregates the state information of its neighbors and updates its own "infection" probability. The most likely propagation path sequence and expected impact range of the anomalous event are deduced, including potentially affected subsystems, devices, and regions.

[0317] Considering the uncertainty of causal relationships, the module employs the Monte Carlo method to conduct numerous (e.g., 10,000) random simulations. In each simulation, the probability weights of the causal edges are used to randomly determine whether an event propagates along that path. The number of times each node (representing a system component or region) is affected in all simulations is counted. The probability of each node being affected is calculated: Probability of being affected = Number of times the node is affected / Total number of simulations. The calculated probability values ​​are mapped onto a digital twin model of the physical space. A color gradient (e.g., green → yellow → red) is used to visualize the risk levels of different regions, forming a risk heatmap. This heatmap visually displays the system's weak points and key protection areas. The simulation results (including propagation paths, impact ranges, and risk heatmaps) are fed back to the early warning response execution module in real time. Based on the simulation results, the early warning response execution module can pre-deploy response resources (e.g., emergency response teams, backup equipment) to high-risk areas. For example, if the simulation shows that an area has an 80% probability of being affected within 30 minutes, response forces can be dispatched to neighboring areas in advance.

[0318] Identify key intervention points along the propagation path and develop targeted blocking strategies for these nodes. Example: If simulations reveal that a "device A failure" will ultimately lead to a "system-wide shutdown" through three paths, then ensuring the reliable operation of device A or preparing its rapid backup plan becomes the highest priority response strategy. Based on the simulation results, generate preventative warnings for high-risk events that have not yet occurred, achieving "prevention is better than cure."

[0319] Other structures of the event correlation analysis and early warning system of the security information management platform described in this embodiment are referenced in existing technologies.

[0320] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Therefore, any modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. An event correlation analysis and early warning system for a security information management platform, characterized in that, include: The data collection module is used to collect real-time environmental data through a heterogeneous sensor network deployed in the physical monitoring area, and to preprocess the environmental data to generate standardized security management events. The event identifier generation module is used to generate a unique event identifier for each security management event, and calculate the correlation importance of the event based on the event's urgency level, type label, and historical frequency of occurrence through a dynamic weighted algorithm. The event feature association module is used to construct the feature evolution sequence of an event and compare the feature evolution sequence with a pre-trained standard event development chain in real time; the standard event development chain is a digital representation of the normal development pattern of an event constructed based on historical normal event data through a time-series machine learning model. The abnormal event discrimination module is used to make anomaly discrimination by comprehensively considering the parsing anomalies of event identifiers and the feature deviations of event evolution. Specifically, it calculates the identifier anomaly quantity by monitoring the device status, timeliness, and content integrity of event identifier parsing; it quantifies the feature deviation degree by calculating the angle between the feature vector space of the current event evolution sequence and the standard event development chain; when either the identifier anomaly quantity or the feature deviation degree exceeds its corresponding dynamic threshold, it generates abnormal event association information. The early warning response execution module is used to drive the multi-dimensional early warning response model to output and execute the optimal response path based on the correlation importance and the correlation information of the abnormal event.

2. The event correlation analysis and early warning system of the security information management platform according to claim 1, characterized in that, The specific process by which the event identifier generation module generates a unique event identifier for each security management event and calculates its correlation importance includes: The historical occurrence frequency of an event is determined based on the proportion of unprocessed events in the total number of events. The event's urgency level attribute, type label attribute, and historical occurrence frequency are evaluated, and the event's correlation importance is determined using a dynamic weighted algorithm. Based on the importance of the integrated events, a unique event identifier is generated for each event according to the selection of encoding rules, capacity adaptation, and security level. The encoding rules include timestamp, event type encoding, and geolocation encoding, and the security level selection dynamically adjusts the encryption strength of the identifier based on the importance of the integrated events.

3. The event correlation analysis and early warning system of the security information management platform according to claim 1, characterized in that, The process by which the event feature association module constructs a feature evolution sequence and compares it with a standard event development chain includes: Determine the initial features based on the feature parameters of the start and end points in the current event node; The stage characteristics are determined based on the characteristic parameters of each fixed time interval during the development of the event and the characteristic parameters before the event occurs; Determine the associated features based on the characteristic parameters of the termination point of the current event node and the start point of the subsequent node; The initial features, the stage features, and the associated features are integrated to form the feature evolution sequence; The feature evolution sequence is compared with the pre-trained standard event evolution chain, and the similarity is quantified by calculating the angle between the feature vector spaces to form the feature comparison result.

4. The event correlation analysis and early warning system of the security information management platform according to claim 1, characterized in that, The specific process by which the abnormal event discrimination module calculates the abnormal quantity includes: Obtain the parsing status, parsing delay duration, and parsing content details of the event identifier parsing device during the event process; Based on the parsing status, the parsing location information in the parsing content details, and the parsing content details, the parsing status weight value, the location information matching value, and the content completeness value are determined respectively; The parsing status weight value, parsing delay duration, location information matching value, and content integrity value are evaluated to determine the anomaly quantity.

5. The event correlation analysis and early warning system of the security information management platform according to claim 1, characterized in that, The process by which the early warning response execution module drives the multi-dimensional early warning response model to output and execute the optimal response path includes: Obtain the historical characteristics of the association importance of the event and the historical anomaly monitoring volume of the processing path; The multi-dimensional early warning response model is constructed with the optimization objectives of reducing response resource consumption and shortening response time. The model integrates the correlation importance, the historical feature correlation results, and the historical anomaly monitoring volume to determine the comprehensive optimization objective of the multi-dimensional early warning response model. Based on the comprehensive optimization objective, the optimal response path is determined.

6. The event correlation analysis and early warning system of the security information management platform according to claim 5, characterized in that, The process of constructing the comprehensive optimization objective includes: The primary optimization direction is to reduce response resource consumption, and the secondary optimization direction is to shorten response time. The importance of the association is used as the first weighting factor, the historical feature association results are used as the second weighting factor, and the historical anomaly monitoring volume is used as the third weighting factor. By integrating various optimization directions and weighting factors, a comprehensive optimization objective for the multi-dimensional early warning response model is formed.

7. The event correlation analysis and early warning system of the security information management platform according to claim 1, characterized in that, It also includes an event warning triggering module, used to generate warning information before abnormal events occur; specifically: Obtain the correlation results of historical event features and the correlation set of current event features, integrate the feature change trends within the preset warning time window, and determine the warning threshold for abnormal events; The current event feature association set is compared with the abnormal event warning threshold. If the warning conditions are met, an abnormal event warning message is generated and sent to the management terminal.

8. The event correlation analysis and early warning system of the security information management platform according to claim 1, characterized in that, It also includes an event data storage module, used to store key data information during the event process; specifically: Based on the importance of the association between events, data storage priorities are determined; The event identifiers generated by the event identifier generation module, the feature parameters obtained by the event feature association module, and the event anomaly monitoring quantities determined by the anomaly event discrimination module are classified and stored in different storage media according to the data storage priority to form a traceable event data archive. The highest priority data is stored on high-speed storage devices, while the low priority data is stored on low-cost storage devices.

9. The event correlation analysis and early warning system of the security information management platform according to claim 5, characterized in that, The specific process by which the early warning response execution module adjusts the current processing path includes: Obtain the node load status, response latency data, and bandwidth utilization of the current processing path; By integrating the correlation importance, the historical feature correlation results, and the historical anomaly monitoring data, the adjustment priority of each candidate path is determined; The load balancing and response stability of candidate paths are evaluated sequentially according to the adjustment priority, and the path with the best load balancing and satisfactory response stability is selected as the optimal response path.

10. The event correlation analysis and early warning system of the security information management platform according to claim 1, characterized in that, It also includes an event behavior verification module, used to verify the legality of event behaviors; specifically: Obtain the event identifier generated by the event identifier generation module and extract the verification field from it; The verification field is compared with a preset legal identifier library. If a match is found, the event behavior is marked as legal. If a match fails, the event behavior is marked as having a risk of forgery, and the forgery risk information is fed back to the abnormal event discrimination module.

Images