Industrial internet traffic anomaly prediction method, device, medium and product

Abstract

The invention provides an industrial internet traffic anomaly prediction method and device, a medium and a product. The method comprises the following steps: acquiring physical topological data, historical traffic time sequence data, real-time traffic data and industrial chain business topological data; constructing a hierarchical node set comprising a physical device node, a function group node and a service unit node based on the data; determining a physical space edge based on the geographic coordinates of the equipment; determining a communication dependence edge based on the historical traffic time sequence data; determining upstream and downstream sides of the industrial chain based on the business topology data of the industrial chain; constructing an industrial chain space-time diagram by combining the nodes and the edges; training a space-time diagram convolutional network model based on the industry chain space-time diagram; and constructing a spatial-temporal feature window, inputting the spatial-temporal feature window into the model, and outputting a traffic anomaly prediction result. By implementing the technical scheme provided by the invention, accurate prediction of traffic anomaly in a complex industrial chain network can be realized, and the anomaly detection accuracy and response timeliness are improved.

Description

Technical Field

[0001] This invention relates to the field of industrial data technology, and in particular to a method, device, medium, and product for predicting abnormal traffic in the industrial internet. Background Technology

[0002] With the deepening development of the Industrial Internet and the massive growth of device interconnection and data, abnormal traffic detection has become crucial for ensuring industrial network security. Effectively capturing the physical connections, communication dependencies, and spatial distribution relationships between devices in the Industrial Internet to improve the accuracy of abnormal traffic prediction has become a core requirement for ensuring the collaborative security of the supply chain.

[0003] In existing technologies, abnormal traffic detection is typically achieved through methods based on single time series analysis or traditional machine learning. For example, ARIMA models or LSTM networks are used to perform time-series analysis on traffic data from a single device or link to identify abnormal patterns in the data stream. However, in practical applications, this approach, which focuses on single time series analysis, neglects the impact of physical connections, communication dependencies, and spatial distribution between devices in industrial scenarios on the propagation of anomalies. When facing supply chain collaboration scenarios, this approach carries the risk of low prediction accuracy and slow response speed. Summary of the Invention

[0004] In view of this, this application provides a method, device, medium, and product for predicting abnormal traffic in the Industrial Internet to solve the above problems.

[0005] Firstly, a method for predicting anomalies in industrial internet traffic is provided, the method comprising: Acquire physical topology data, historical traffic time-series data, real-time traffic data, and industry chain business topology data of industrial internet devices; Based on physical topology data and industry chain business topology data, a hierarchical node set is constructed, which includes physical device nodes, functional group nodes, and business unit nodes. Based on the geographical coordinates of the devices in the physical topology data, the spatial distance between physical device nodes is calculated, and the physical spatial edge between physical device nodes is determined according to the comparison result between the spatial distance and the preset physical distance threshold. Based on historical traffic time-series data, the communication pattern characteristics between physical device nodes are analyzed, and the communication dependency edges between physical device nodes are determined according to the comparison results between the communication pattern characteristics and the preset communication dependency threshold. Based on the business topology data of the industry chain, determine the upstream and downstream edges of the industry chain between functional group nodes or business unit nodes. By combining physical device nodes, functional group nodes, business unit nodes, physical space edges, communication dependency edges, and upstream and downstream edges of the industry chain, a spatiotemporal diagram of the industry chain is constructed. The pre-defined spatiotemporal graph convolutional network model is trained based on the spatiotemporal graph of the industrial chain. Based on real-time traffic data and historical traffic time-series data, a spatiotemporal feature window is constructed, and the spatiotemporal feature window is input into the trained spatiotemporal graph convolutional network model. The spatiotemporal graph convolutional network model outputs the traffic anomaly prediction results.

[0006] The above technical solution, by comprehensively utilizing the physical topology data of industrial internet devices, historical and real-time traffic data, and supply chain business topology data, establishes a multi-layered node relationship including physical devices, functional groups, and business units. It also constructs a spatiotemporal graph of the industrial chain by combining spatial distance, communication dependencies, and supply chain relationships. This graph comprehensively reflects the spatial distribution characteristics, communication correlation characteristics, and business logic correlation characteristics of the industrial internet system. After training a spatiotemporal graph convolutional network model based on this graph and inputting real-time traffic data, it can accurately predict traffic anomalies in complex supply chain networks, improving the accuracy and timeliness of anomaly detection.

[0007] Optionally, based on physical topology data and industry chain business topology data, a hierarchical node set is constructed, specifically including: Based on device information in physical topology data, construct multiple physical device nodes; Based on the pre-defined business logic in the industry chain business topology data, physical device nodes are clustered according to pre-defined aggregation features to obtain multiple functional group nodes. Based on the upstream and downstream characteristics of the industrial chain in the business topology data, multiple business unit nodes are constructed, and the hierarchical inclusion relationship between each functional group node, each physical device node and each business unit node is determined to form a hierarchical node set.

[0008] The above technical solution aggregates physical device nodes into functional group nodes according to the business logic of the industrial chain, and then forms business unit nodes based on upstream and downstream characteristics. It also determines the inclusion relationship between nodes at each layer, thus constructing a node system with a clear hierarchical structure. This allows the model to reflect not only the communication characteristics of the device layer but also the collaborative relationship between the business logic layer and the industrial chain layer when analyzing industrial Internet traffic data, thereby improving the anomaly prediction model's ability to identify cross-level traffic anomalies.

[0009] Optionally, the hierarchical inclusion relationship between each functional group node, each physical device node, and each business unit node is determined to form a hierarchical node set, specifically including: From the business topology data of the industry chain, a pre-defined business unit mapping table is parsed out. The business unit mapping table is used to represent the hierarchical inclusion relationship. Perform the following operations on each business unit node: Query the business unit mapping table to obtain the list of identifiers corresponding to the business unit nodes; Traverse the identifier list and match the identifiers in the identifier list with the node identifiers of the functional group nodes and physical device nodes; Based on the matching results, a hierarchical affiliation edge is established between the business unit node and the successfully matched functional group node and physical device node; Each physical device node, each functional group node, each business unit node, and each level of belonging edge are combined to form a hierarchical node set.

[0010] The above technical solution automatically establishes hierarchical affiliation edges between business unit nodes, functional group nodes, and physical device nodes by parsing the business unit mapping table in the industry chain business topology data. This achieves automatic construction of hierarchical node sets, reduces manual configuration workload, and ensures the consistency and accuracy of hierarchical relationships. This process makes the subsequent construction of the industry chain spatiotemporal diagram more systematic and structured, helping the model accurately capture cross-layer dependencies and improve the logical consistency of prediction results.

[0011] Optionally, based on historical traffic time-series data, the communication pattern characteristics between physical device nodes are analyzed, and the communication dependency edges between physical device nodes are determined according to the comparison results between the communication pattern characteristics and the preset communication dependency threshold, specifically including: Obtain historical traffic time-series data corresponding to the first physical device node and the second physical device node, where the first physical device node and the second physical device node are any two physical device nodes; Based on historical traffic time-series data, the communication frequency, average traffic intensity, communication periodicity, and communication stability characteristics between the first physical device node and the second physical device node are extracted and calculated. The communication mode characteristics are obtained by aggregating and calculating the characteristics of communication frequency, average traffic intensity, communication periodicity, and communication stability. The communication pattern characteristics are compared with a preset communication dependency threshold. When the communication pattern characteristics are less than the preset communication dependency threshold, a communication dependency edge is determined to be established between the two physical device nodes.

[0012] The above technical solution, by analyzing the historical traffic time-series data of any two physical device nodes using multi-dimensional features such as communication frequency, average traffic intensity, communication periodicity, and communication stability, and filtering communication relationships based on communication dependency thresholds, can quantitatively identify the true communication dependency edges between devices. This dependency determination method based on multi-feature aggregation improves the accuracy of communication relationship identification, reduces the interference of occasional communication on model training, and makes the edge structure of the device layer in the spatiotemporal graph more consistent with actual network characteristics.

[0013] Optionally, based on the industry chain business topology data, determine the upstream and downstream edges of the industry chain between functional group nodes or business unit nodes, specifically including: Obtain the upstream and downstream topology map of the industry chain from the business topology data of the industry chain; Analyze the upstream and downstream topology of the industry chain to determine the upstream and downstream relationships between functional group nodes or business unit nodes defined in the industry chain topology. Based on the upstream and downstream relationships of the industry, determine the upstream and downstream edges of the industrial chain between functional group nodes or business unit nodes. The upstream and downstream edges of the industrial chain are directed edges.

[0014] The above technical solution extracts the upstream and downstream topology graph of the industrial chain from the business topology data of the industrial chain, identifies the upstream and downstream relationships between functional group nodes or business unit nodes, and establishes directed upstream and downstream edges of the industrial chain. This graph structure can reflect the production dependence and material flow between businesses. This structure allows the model to analyze the direction and scope of anomaly propagation along the industrial chain path when making anomaly predictions, thereby achieving forward warning and source tracing of anomaly risks.

[0015] Optionally, a pre-defined spatiotemporal graph convolutional network model is trained based on the spatiotemporal graph of the industry chain, specifically including: The spatiotemporal graph of the industrial chain is transformed into a graph data structure, which includes a node feature matrix and an edge relationship adjacency matrix. The spatiotemporal graph convolutional network model receives node feature matrices and edge relationship adjacency matrices through its input layer. Temporal dependencies in node feature matrices are identified through the temporal convolutional layers of a spatiotemporal graph convolutional network model. Spatial dependencies in the edge relation adjacency matrix are identified through the graph convolutional layers of the spatiotemporal graph convolutional network model. The spatiotemporal graph convolutional network model uses a fusion layer to fuse the outputs of the temporal convolutional layer and the graph convolutional layer, and then uses the output layer to map the fused output to obtain the node anomaly probability. The spatiotemporal graph convolutional network model is trained based on the node anomaly probability to obtain the trained spatiotemporal graph convolutional network model.

[0016] The above technical solution transforms the spatiotemporal graph of the industrial chain into a graph data structure containing node feature matrices and edge adjacency matrices. It then utilizes the temporal and graph convolutional layers of a spatiotemporal graph convolutional network model to identify temporal and spatial dependencies, respectively. After integration by a fusion layer, the output node anomaly probabilities are generated, enabling the model to simultaneously capture both temporal dynamics and network structure dependencies. This training method enhances the model's ability to learn from multi-source heterogeneous data in complex industrial networks, improving the accuracy and generalization performance in identifying anomaly patterns.

[0017] Optionally, the output of traffic anomaly prediction results through the spatiotemporal graph convolutional network model also includes: Abnormal nodes in the hierarchical node set are identified using a spatiotemporal graph convolutional network model. Based on the spatiotemporal graph structure of the industrial chain, starting from the abnormal node, a graph traversal algorithm is used to traverse along the communication dependency edges and the upstream and downstream edges of the industrial chain to search for all reachable related nodes. Based on the communication dependency edges between associated nodes and abnormal nodes, as well as the upstream and downstream edges of the industry chain, calculate the risk transmission data; The abnormal nodes, related nodes, and risk transmission data are aggregated and output as the traffic anomaly prediction results.

[0018] The above technical solution identifies anomalous nodes in a hierarchical graph using a spatiotemporal graph convolutional network model. It then employs a graph traversal algorithm to expand the search for related nodes along communication dependency edges and upstream / downstream edges of the industry chain, calculating risk transmission data. This enables the analysis of anomalous node associations and the identification of risk diffusion paths. This approach not only outputs anomaly detection results but also provides information on the scope and direction of anomaly impact, offering maintenance personnel targeted intervention strategies and improving the efficiency of risk management and decision-making in industrial internet systems. Secondly, this application provides an electronic device including a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, and both the user interface and the network interface are used to communicate with other devices. The processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method described in any of the above. Thirdly, this application provides a computer-readable storage medium storing instructions that, when executed, perform the method described in any of the foregoing descriptions. Fourthly, this application provides a computer program product containing instructions that, when the computer program product is run on a server, cause the server to perform the method described in the first aspect and any possible implementation thereof.

[0019] Understandably, the electronic device provided in the second aspect, the computer-readable storage medium provided in the third aspect, and the computer program product provided in the fourth aspect are all used to execute the method provided in this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0020] In summary, implementing one or more technical solutions provided in this application has at least the following technical effects or advantages: 1. By introducing data relationships across three different dimensions—physical topology, communication dependencies, and industry chain logic—within a single prediction framework, this approach transforms industrial internet traffic prediction from single-dimensional data analysis to multi-layer, multi-domain fusion modeling. This enables the system to maintain efficient data association and dynamic learning capabilities in complex, multi-source data environments. During implementation, this solution eliminates the need for manual topology configuration or experience-based anomaly rule setting, automatically generating a spatiotemporal industry chain model based on real business and communication data, significantly reducing deployment and maintenance costs.

[0021] 2. By adaptively training the spatiotemporal graph of the industrial chain using a spatiotemporal graph convolutional network, spatial dependencies, temporal evolution, and upstream and downstream transmission relationships within the industrial chain can be embedded into the model structure. This enables the prediction system to identify abnormal risks in advance and infer potential propagation paths, achieving a technological leap from post-event detection to pre-event prediction. The overall solution possesses good scalability and generalization performance, making it suitable for industrial internet scenarios of different scales and topologies. It can effectively improve the security, stability, and resource scheduling efficiency of industrial systems. Attached Figure Description

[0022] Figure 1 This is an exemplary system architecture diagram of an industrial internet traffic anomaly prediction method disclosed in this application; Figure 2 This is a flowchart illustrating an industrial internet traffic anomaly prediction method disclosed in this application; Figure 3 This is a schematic diagram of the structure of an electronic device disclosed in this application.

[0023] Explanation of reference numerals in the attached figures: 100, System architecture; 101, First terminal device; 102, Second terminal device; 103, Third terminal device; 104, Network; 105, Server; 301, Processor; 302, Communication bus; 303, User interface; 304, Network interface; 305, Memory. Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0025] In the description of the embodiments of this application, the words "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design that is described as "for example" or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design options. Rather, the use of the words "for example" or "for instance" is intended to present the relevant concepts in a specific manner.

[0026] In the description of the embodiments of this application, the term "multiple" means two or more. For example, multiple systems means two or more systems, and multiple screen terminals means two or more screen terminals. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized. Figure 1 An exemplary system architecture diagram is shown, illustrating an embodiment of an industrial internet traffic anomaly prediction method that can be applied to this application.

[0027] like Figure 1 As shown, the system architecture 100 may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used as a medium to provide communication links between the terminal devices 101, 102, 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0028] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as model training applications, video recognition applications, web browser applications, social platform software, etc.

[0029] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be various electronic devices with displays, including but not limited to smartphones, tablets, e-book readers, MP3 (Moving Picture Experts Group Audio Layer III) players, MP4 (Moving Picture Experts Group Audio Layer IV) players, laptops, and desktop computers, etc. When terminal devices 101, 102, and 103 are software, they can be installed in the aforementioned electronic devices. They can be implemented as multiple software programs or software modules (e.g., multiple software programs or software modules used to provide distributed services) or as a single software program or software module. No specific limitations are imposed here.

[0030] When terminals 101, 102, and 103 are hardware devices, video capture devices can also be installed on them. These video capture devices can be various devices capable of capturing video, such as cameras, sensors, etc. Users can use the video capture devices on terminals 101, 102, and 103 to capture video.

[0031] Server 105 can be a server that provides various services, such as a backend server for processing data displayed on terminal devices 101, 102, and 103. The backend server can analyze and process the received data and can feed back the processing results (such as recognition results) to the terminal devices.

[0032] It should be noted that a server can be either hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When the server is software, it can be implemented as multiple software programs or software modules (e.g., multiple software programs or software modules used to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0033] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included. In particular, if the target data does not need to be obtained remotely, the above system architecture may exclude the network and include only terminal devices or servers. Figure 2This is a flowchart illustrating an industrial internet traffic anomaly prediction method according to an embodiment of this application. This method can be implemented using a computer program or a microcontroller. The computer program can be integrated into an application or run as a standalone utility application. The specific steps of an industrial internet traffic anomaly prediction method are described in detail below.

[0034] S201: Obtain physical topology data, historical traffic time-series data, real-time traffic data, and industry chain business topology data of industrial internet devices.

[0035] In this application embodiment, industrial internet devices refer to physical entities deployed in an industrial internet environment that have data acquisition, communication, or execution functions. For example, they may include smart sensors, programmable logic controllers (PLCs), industrial smart gateways, robots on production lines, CNC machine tools, etc.

[0036] Data from multiple heterogeneous data sources can be aggregated for industrial internet devices. For example, physical topology data can be acquired, representing the objective attributes and deployment information of industrial internet devices in the physical world. This data can include the device's unique ID, device type, firmware version, and geographical coordinates, which can be refined to a level such as "Plant X - Production Line A - Workstation B - No. 03". Simultaneously, real-time traffic data can be acquired. Real-time traffic data refers to data packets or data streams currently being transmitted in the network, reflecting the instantaneous communication status of the devices. This data can include source IP / port, destination IP / port, protocol type, number of data packets, total number of bytes, TCP (Transmission Control Protocol) flags, and parsed data of industrial protocols. Furthermore, historical traffic time-series data can be acquired. This data is a dataset reflecting the historical behavior patterns of devices, formed by aggregating and storing real-time traffic data according to fixed time windows. For example, it can include time series data on traffic characteristics such as the total number of bytes, total number of data packets, average packet length, traffic rate, and number of connections calculated for each device. In addition, it is necessary to acquire supply chain business topology data. This data represents the logical relationships, collaborative relationships, or sequential order of equipment, functional groups, or business units in production or business processes. For example, it can be the upstream and downstream business process definitions exported from an Enterprise Resource Planning (ERP) system or a supply chain system. The acquired physical topology data, historical traffic time-series data, real-time traffic data, and supply chain business topology data will be uniformly aggregated for use in subsequent steps. S202: Based on physical topology data and industry chain business topology data, construct a hierarchical node set, which includes physical device nodes, functional group nodes, and business unit nodes.

[0037] For example, specific physical device nodes (such as sensors and actuators) are instantiated based on physical topology data; based on the business logic defined in the industry chain business topology data, multiple physical device nodes that perform related tasks are aggregated into functional group nodes (such as "quality inspection unit"); then one or more functional group nodes are combined with physical device nodes to define higher-level business unit nodes (such as "packaging production line"), and the hierarchical relationship between them is established, thereby constructing a hierarchical node set.

[0038] In one possible implementation, a hierarchical node set is constructed based on physical topology data and industry chain business topology data. Specifically, this includes: constructing multiple physical device nodes based on device information in the physical topology data; clustering the physical device nodes according to preset aggregation features based on preset business logic in the industry chain business topology data to obtain multiple functional group nodes; and constructing multiple business unit nodes based on upstream and downstream features of the industry chain business topology data, and determining the hierarchical inclusion relationship between each functional group node and each physical device node and each business unit node to form a hierarchical node set.

[0039] In the embodiments of this application, the hierarchical node set refers to a specific node organization method used to represent the topology of the industrial Internet in a graph structure. It is not a flat list of nodes, but rather divides the nodes into different abstract levels. For example, it may include physical device nodes representing specific hardware, functional group nodes representing collaborative functions, and business unit nodes representing business processes, and associates these nodes at different levels through hierarchical inclusion relationships.

[0040] Based on device information in the physical topology data, such as unique device IDs, device types, and geographic coordinates retrieved from a database, each independent industrial internet device can be instantiated to construct multiple physical device nodes. The constructed physical device nodes are then processed based on pre-defined business logic within the industry chain business topology data. For example, based on the business logic of collaboratively completing a specific function, clustering operations can be performed on the physical device nodes according to pre-defined aggregation characteristics (such as common device types or production line attributes) representing that specific function, resulting in multiple functional group nodes. Based on the upstream and downstream characteristics of the industry chain in the industry chain business topology data (such as business definitions used to break down industry chain segments), multiple business unit nodes are constructed. After construction, predefined mapping relationships need to be parsed from the industry chain business topology data to determine the hierarchical inclusion relationships between each functional group node and each physical device node and each business unit node (e.g., mapping and assigning specific functional group nodes and physical device nodes to their respective business unit nodes). The constructed physical device nodes, functional group nodes, business unit nodes, and the determined hierarchical inclusion relationships are then combined to form a hierarchical node set.

[0041] In one possible implementation, the hierarchical inclusion relationship between each functional group node, each physical device node, and each business unit node is determined to form a hierarchical node set. Specifically, this includes: parsing a preset business unit mapping table from the industry chain business topology data, whereby the business unit mapping table is used to represent the hierarchical inclusion relationship; performing the following operations for each business unit node: querying the business unit mapping table to obtain the identifier list corresponding to the business unit node; traversing the identifier list and matching the identifiers in the identifier list with the node identifiers of the functional group nodes and physical device nodes; establishing hierarchical belonging edges between the business unit node and the successfully matched functional group nodes and physical device nodes based on the matching results; and combining each physical device node, each functional group node, each business unit node, and each hierarchical belonging edge to form a hierarchical node set.

[0042] In this application embodiment, the business unit mapping table refers to a specific data structure that is pre-set in the industry chain business topology data. The business unit mapping table is used to represent hierarchical inclusion relationships. For example, the mapping table can be a key-value pair list, where the key is a unique identifier of the business unit node and the value is a list of identifiers, which contains the node identifiers of all functional group nodes or physical device nodes that should belong to the business unit node.

[0043] During this step, a pre-defined business unit mapping table is parsed from the industry chain business topology data. For each business unit node, the following operations are performed: using the node identifier of the current business unit node as the query key, the business unit mapping table is queried to obtain the identifier list corresponding to the business unit node. After obtaining the identifier list, iteratively traverses the identifier list, matching each identifier in the identifier list with the node identifiers of functional group nodes and physical device nodes. Based on the matching results, hierarchical belonging edges are established in the graph data structure between the business unit node and all successfully matched functional group nodes and physical device nodes. After completing the above traversal and edge construction operations on all business unit nodes, each physical device node, each functional group node, each business unit node, and all established hierarchical belonging edges are combined to form a unified graph data structure, namely, a hierarchical node set. S203: Based on the geographical coordinates of the devices in the physical topology data, calculate the spatial distance between physical device nodes, and determine the physical spatial edge between physical device nodes based on the comparison result between the spatial distance and the preset physical distance threshold.

[0044] In the embodiments of this application, a physical space edge refers to an edge in a graph structure. Physical space edges are used to characterize the geographical proximity relationship between physical device nodes in the real physical world in a spatiotemporal graph of the industry chain.

[0045] The geographical coordinates of each physical device node can be extracted from the physical topology data. The node pairs of physical device nodes are traversed, and for any two physical device nodes, the spatial distance between them is calculated. For example, the spatial distance can be calculated using internal factory coordinates or geographic latitude and longitude. When using latitude and longitude, the Haversine formula can be used to calculate the actual ground distance; when using internal factory coordinates (such as X, Y, Z), Euclidean distance can be used. After obtaining the spatial distance, it is compared with a pre-set physical distance threshold, T. phy The threshold can be selected through offline statistical methods: taking the p-th percentile (e.g., p=10% or 20%) of the distance distribution of all node pairs during normal operation as the threshold, or determining the optimal threshold range through cross-validation with actual network connection data (example range: 10 meters–200 meters, depending on device deployment density). Based on the comparison results, it is determined whether a physical spatial edge exists between two physical device nodes. For example, if the comparison result shows that the spatial distance is less than the preset physical distance threshold, it is determined that a physical spatial edge exists between the two physical device nodes; otherwise, it does not exist. In addition, after determining that a physical spatial edge exists, a weight value can be set for the physical spatial edge. For example, the reciprocal of the spatial distance can be used as the weight value to quantitatively represent that the closer the physical distance, the stronger the spatial relationship. S204: Based on historical traffic time-series data, analyze the communication pattern characteristics between physical device nodes, and determine the communication dependency edges between physical device nodes based on the comparison results of the communication pattern characteristics and the preset communication dependency threshold.

[0046] For example, the preset communication dependency threshold can be a fixed parameter predetermined and stored during an offline calibration phase by statistically analyzing the communication pattern characteristics in historical traffic time-series data of industrial internet devices under typical operating conditions (e.g., taking the 20th percentile of all feature values). For any two physical device nodes, their corresponding historical traffic time-series data can be extracted and analyzed to quantify a communication pattern characteristic reflecting the closeness of communication between them (e.g., a dependency score that integrates communication frequency, strength, and stability). Then, this communication pattern characteristic is compared with the preset communication dependency threshold. When a specific condition is met (e.g., the feature value is less than the threshold), a communication dependency edge is determined between the two physical device nodes.

[0047] In one possible implementation, based on historical traffic time-series data, the communication pattern characteristics between physical device nodes are analyzed, and communication dependency edges between physical device nodes are determined according to the comparison results of the communication pattern characteristics and a preset communication dependency threshold. Specifically, this includes: obtaining historical traffic time-series data corresponding to a first physical device node and a second physical device node, wherein the first physical device node and the second physical device node are any two physical device nodes; extracting and calculating the communication frequency, average traffic intensity, communication periodicity, and communication stability characteristics between the first physical device node and the second physical device node based on the historical traffic time-series data; aggregating and calculating the communication frequency, average traffic intensity, communication periodicity, and communication stability characteristics to obtain communication pattern characteristics; comparing the communication pattern characteristics with a preset communication dependency threshold, and determining to establish a communication dependency edge between the two physical device nodes when the communication pattern characteristics are less than the preset communication dependency threshold.

[0048] In the embodiments of this application, a communication dependency edge refers to an edge in a graph structure. Communication dependency edges are used in the spatiotemporal graph of the industry chain to characterize the strength of the dependency relationship or interaction mode between physical device nodes at the network communication level.

[0049] The set of physical device nodes can be traversed to obtain any two physical device nodes, namely the first physical device node and the second physical device node, and the historical traffic time-series data corresponding to the first physical device node and the second physical device node can be obtained. Based on the historical traffic time-series data, multi-dimensional communication interaction features between the first physical device node and the second physical device node are extracted and calculated. These features may include, for example, communication frequency (e.g., the number of communications per unit time), average traffic intensity (e.g., the average number of bytes transmitted), communication periodicity (e.g., the regularity of communication interval time), and communication stability (e.g., the jitter of communication latency). The extracted communication frequency, average traffic intensity, communication periodicity, and communication stability features are aggregated and calculated. For example, these multi-dimensional features can be fused into a single quantified value through weighted summation or function mapping to obtain the communication pattern feature. The obtained communication pattern feature is compared with a preset communication dependency threshold. When the communication pattern feature is less than the preset communication dependency threshold (e.g., the communication pattern feature can be designed as a reverse indicator, with a smaller value representing a stronger dependency), a communication dependency edge is established between the two physical device nodes.

[0050] In this embodiment, the communication mode feature F is... mode The construction is clearly defined as follows: for the communication frequency f freq Average flow intensity f strength Communication periodicity index f interval (Consider the variance of the communication interval) and the communication stability f latency (Taking the time delay variance) Perform linear normalization to the interval [0, 1] (normalization method: x norm =(x−x min ) / (x max -x min ), where x min x max (Statistics obtained from the offline calibration phase). Define F. mode =w1·(1−f freq，norm )+w2·(1−f strength，norm )+w3·f interval，norm +w4·f latency，norm Where w1, w2, w3, and w4 are non-negative weights determined through offline cross-validation, and w1 + w2 + w3 + w4 = 1. In one embodiment, w1 = 0.30, w2 = 0.30, w3 = 0.20, and w4 = 0.20 can be taken. Communication dependency threshold T comm Determined during the offline calibration phase (example: using the 20th percentile of a historical normal communication window as the threshold). When F mode <T comm When a significant communication dependency exists between two nodes, a communication dependency edge is established. S205: Based on the business topology data of the industry chain, determine the upstream and downstream edges of the industry chain between functional group nodes or business unit nodes.

[0051] For example, the business processes defined in the business topology data of the industrial chain can be parsed, and functional group nodes or business unit nodes with sequential process dependencies can be connected. For example, between the node representing "raw material processing" and the node representing "parts assembly", an upstream and downstream edge of the industrial chain can be determined, thereby reproducing the transmission direction of the business flow in the spatiotemporal diagram of the industrial chain.

[0052] In one possible implementation, based on industry chain business topology data, the upstream and downstream edges of the industry chain between functional group nodes or business unit nodes are determined. Specifically, this includes: obtaining an industry chain upstream and downstream topology graph from the industry chain business topology data; analyzing the industry chain upstream and downstream topology graph to determine the industry chain upstream and downstream relationships between functional group nodes or business unit nodes defined in the industry chain upstream and downstream topology graph; and determining the industry chain upstream and downstream edges between functional group nodes or business unit nodes based on the industry chain upstream and downstream relationships, wherein the industry chain upstream and downstream edges are directed edges.

[0053] In the embodiments of this application, the upstream and downstream edge of the industrial chain refers to a directed edge in a graph structure. The upstream and downstream edge of the industrial chain is used to represent the logical sequence relationship, material flow relationship or collaborative dependency relationship between functional group nodes or business unit nodes in the business process or production process in the spatiotemporal graph of the industrial chain. For example, a directed edge from the "raw material processing" business unit node to the "parts assembly" business unit node is a downstream edge of the industrial chain.

[0054] A predefined upstream and downstream topology map of the industry chain can be obtained from the business topology data of the industry chain. This map can be data representing business processes imported from an enterprise production management system (such as MES) or supply chain management system (SCM). The upstream and downstream topology map is analyzed to determine the upstream and downstream relationships between functional group nodes or business unit nodes defined in the map. For example, it can be identified that process A is a precursor process of process B. Based on the identified upstream and downstream relationships, upstream and downstream edges are determined between functional group nodes or business unit nodes. For example, if process A corresponds to one functional group node and process B corresponds to another functional group node, an upstream and downstream edge is established between the two functional group nodes. Furthermore, the upstream and downstream edges are set as directed edges to accurately represent the business flow from the upstream node to the downstream node. S206: Combine physical device nodes, functional group nodes, business unit nodes, physical space edges, communication dependency edges, and upstream and downstream edges of the industry chain to construct a spatiotemporal diagram of the industry chain.

[0055] In this application embodiment, the industry chain spatiotemporal graph refers to a specific graph data structure. The industry chain spatiotemporal graph is used to uniformly represent the multi-dimensional complex relationships between devices, functions and business units in the industrial Internet. The multi-dimensional complex relationships at least integrate the physical proximity relationship between physical device nodes, the network communication dependency relationship between physical device nodes, the business process relationship between functional group nodes or business unit nodes, and the affiliation relationship between different node levels.

[0056] This step integrates the hierarchical node set (including physical device nodes, functional group nodes, and business unit nodes) constructed in the previous steps, along with all determined edge types, to build a unified graph data structure. The node set of this graph data structure consists of all physical device nodes, functional group nodes, and business unit nodes from the hierarchical node set. The edge set of this graph data structure consists of all edge types determined in the previous steps, specifically including physical space edges, communication dependency edges, upstream and downstream industry chain edges, and hierarchical affiliation edges established when constructing the hierarchical node set. The action of constructing the spatiotemporal graph of the industry chain specifically refers to instantiating the above node set and edge set into a data structure that can be processed by subsequent models (such as spatiotemporal graph convolutional network models) (e.g., generating a corresponding adjacency matrix set or adjacency list). In this data structure: physical space edges and communication dependency edges are used to represent same-layer connections between physical device nodes; upstream and downstream industry chain edges are used to represent same-layer connections between functional group nodes or business unit nodes; and hierarchical affiliation edges are used to represent cross-hierarchical connections between physical device nodes or functional group nodes and their respective business unit nodes. The resulting spatiotemporal graph of the industry chain is a hierarchical, heterogeneous graph data structure that integrates four relationships: physical proximity, communication dependency, business logic, and hierarchical affiliation. S207: Train a pre-defined spatiotemporal graph convolutional network model based on the spatiotemporal graph of the industrial chain.

[0057] For example, the spatiotemporal graph of the industry chain and the temporal characteristics of the nodes it carries (such as historical traffic time series data) can be used as training data and input into a pre-defined spatiotemporal graph convolutional network model. Through an iterative optimization process, the model learns the complex spatiotemporal dependencies contained in the spatiotemporal graph of the industry chain, which integrates physical, communication and business logic, until the model converges, so that it has the ability to predict anomalies.

[0058] In one possible implementation, training a pre-defined spatiotemporal graph convolutional network model based on a spatiotemporal graph of the industry chain specifically includes: converting the spatiotemporal graph of the industry chain into a graph data structure, the graph data structure including a node feature matrix and an edge relationship adjacency matrix; receiving the node feature matrix and the edge relationship adjacency matrix through the input layer of the spatiotemporal graph convolutional network model; identifying the temporal dependencies in the node feature matrix through the temporal convolutional layer of the spatiotemporal graph convolutional network model; identifying the spatial dependencies in the edge relationship adjacency matrix through the graph convolutional layer of the spatiotemporal graph convolutional network model; fusing the outputs of the temporal convolutional layer and the graph convolutional layer through the fusion layer of the spatiotemporal graph convolutional network model, and mapping the fused output to obtain the node anomaly probability through the output layer; and training the spatiotemporal graph convolutional network model based on the node anomaly probability to obtain the trained spatiotemporal graph convolutional network model.

[0059] In this application embodiment, the spatiotemporal graph convolutional network model refers to a pre-defined deep learning model for processing spatiotemporal graph data. The architecture of the spatiotemporal graph convolutional network model is designed to include components such as temporal convolutional layers and graph convolutional layers, enabling it to extract both temporal and spatial (topological) dependencies from the spatiotemporal graph of the industry chain.

[0060] In one possible implementation, when converting the spatiotemporal graph of the industry chain into a graph data structure, the node feature matrix in the graph data structure is constructed through the following steps: Constructing the features of physical device nodes: For each physical device node in the hierarchical node set, extract the traffic features (e.g., traffic rate, number of connections) of its most recent T time steps (T being a preset time window length) from historical traffic time-series data, and concatenate them into a T×F dimensional feature vector, where F is the number of selected features. When historical traffic time-series data lacks manual annotation, the following pseudo-label generation process is adopted: 1) Use an isolation forest to score the historical time-series features of each node as anomalies; 2) Label samples with scores higher than the threshold Tiso as "anomalies," and only retain pseudo-labels with confidence higher than γ (e.g., γ=0.9) for initial training; 3) Evaluate the trained model on the validation set, and incorporate high-confidence predictions as new labels into the next round of self-training. Example training hyperparameters: time window length T=12 (i.e., the past 12 time steps), batch size 64, learning rate 1e-3, optimizer Adam, and loss function using cross-entropy. Model convergence typically occurs within 50–200 epochs (depending on the amount of data). Initial features are constructed for functional group nodes. For each functional group node, all physical device nodes it contains are determined based on hierarchical inclusion relationships (e.g., by hierarchical belonging edges). Initial feature vectors for functional group nodes are generated by performing aggregation operations (e.g., mean-pooling, max-pooling, or weighted summation) on the feature vectors of all contained physical device nodes. Initial features are constructed for business unit nodes. For each business unit node, all functional group nodes and / or physical device nodes it contains are determined based on hierarchical inclusion relationships. Initial feature vectors for business unit nodes are generated by performing similar aggregation operations (e.g., mean-pooling) on ​​the feature vectors of all contained nodes. The feature vectors of all physical device nodes, functional group nodes, and business unit nodes are combined to form a complete node feature matrix for use in subsequent training of the spatiotemporal graph convolutional network model.

[0061] The pre-designed spatiotemporal graph convolutional network model is trained based on the spatiotemporal graph of the industry chain. Specifically designed to address the hierarchical and heterogeneous characteristics of the spatiotemporal graph, the training includes the following steps: 1. Data transformation and adjacency matrix construction: The spatiotemporal graph of the industry chain is transformed into a graph data structure, which includes a node feature matrix (e.g., constructed based on historical traffic time-series data). Furthermore, this step does not construct a single edge relationship adjacency matrix, but rather constructs multiple corresponding adjacency matrices: Based on physical space edges, a physical space adjacency matrix A is constructed. phy Based on communication dependency edges, construct a communication dependency adjacency matrix A. comm Based on the upstream and downstream edges of the industry chain, construct the industry chain adjacency matrix A.biz Based on the hierarchical belonging edges, construct the hierarchical belonging adjacency matrix A. hier 2. Model Architecture Determination and Training: The architecture of the spatiotemporal graph convolutional network model is determined. Its graph convolutional layers are specifically implemented as layered multi-relation graph convolutional modules. Training details include: Step 1 (Device Layer Multi-Relation Convolution): The node feature matrix and the aforementioned multiple adjacency matrices are received through the input layer of the spatiotemporal graph convolutional network model. At the device layer (i.e., physical device nodes), this module first performs multi-relation graph convolution: that is, for A... phy and A comm Different convolution kernels (i.e., relation-specific weight matrices) are used to perform graph convolution operations to identify different spatial and communication dependencies between physical device nodes. The results are then aggregated to obtain device-level feature representations. Step 2 (Hierarchical Feature Aggregation) is based on the hierarchical adjacency matrix A. hier The graph pooling operation is performed to aggregate the device-level feature representations (from physical device nodes) to their corresponding functional group nodes and business unit nodes. Step three (business layer relational convolution) involves this module specifically targeting the industry chain adjacency matrix A on the functional group nodes and business unit nodes. biz Perform graph convolution operations to identify spatial dependencies (i.e., business dependencies) in the business process. Step 4 (Spatiotemporal Fusion and Optimization): Identify temporal dependencies in the node feature matrix through a temporal convolutional layer. A fusion layer merges the output of the temporal convolutional layer, device-level feature representations, and the output of the business layer relational convolution. The output layer then maps the fused output to obtain the node anomaly probability. Step 5 (Training Completed): Optimize the spatiotemporal graph convolutional network model based on the node anomaly probability (e.g., minimize the cross-entropy loss between the predicted probability and the true label using backpropagation). The true label can be obtained in the following ways: 1. When acquiring historical traffic time-series data, this data already contains anomaly labels marked by operations personnel or a historical security event database (e.g., known intrusion events, equipment failure downtime events). During training, these already labeled labels are directly used as the "true labels" for optimizing the spatiotemporal graph convolutional network model. 2. In the absence of labeled historical traffic time-series data, an unsupervised anomaly detection algorithm (e.g., isolated forest, or a 3-Sigma statistical thresholding method) is first used to preprocess the historical traffic time-series data to generate "pseudo-labels." These "pseudo-labels" are then used as "real labels" to train the spatiotemporal graph convolutional network model. During training, the node anomaly probabilities obtained through output layer mapping are compared with the "real labels" or "pseudo-labels" obtained in the above manner (e.g., cross-entropy loss is calculated) to optimize the spatiotemporal graph convolutional network model, resulting in the trained spatiotemporal graph convolutional network model. S208: Based on real-time traffic data and historical traffic time-series data, a spatiotemporal feature window is constructed, and the spatiotemporal feature window is input into the trained spatiotemporal graph convolutional network model. The spatiotemporal graph convolutional network model outputs the traffic anomaly prediction results.

[0062] For example, real-time traffic data can be continuously acquired, and the most recent time slice data can be extracted from historical traffic time-series data. The two can be merged to construct a dynamically scrolling spatiotemporal feature window. The spatiotemporal feature window is then input into a spatiotemporal graph convolutional network model, which analyzes the spatiotemporal data within the window and outputs the traffic anomaly prediction results for each node, such as a specific anomaly probability value.

[0063] In one possible implementation, outputting the traffic anomaly prediction result through the spatiotemporal graph convolutional network model further includes: determining the abnormal nodes in the hierarchical node set through the spatiotemporal graph convolutional network model; based on the graph structure of the spatiotemporal graph of the industry chain, starting from the abnormal nodes, using a graph traversal algorithm to traverse along the communication dependency edges and upstream and downstream edges of the industry chain to search for all reachable associated nodes; calculating risk transmission data based on the communication dependency edges between associated nodes and abnormal nodes and the upstream and downstream edges of the industry chain; and summarizing the abnormal nodes, associated nodes, and risk transmission data as the traffic anomaly prediction result for output.

[0064] In the embodiments of this application, risk transmission data refers to data used to quantify the propagation path and impact of abnormal events in the spatiotemporal diagram of the industry chain. Risk transmission data is calculated based on the communication dependency edges (representing network transmission) between associated nodes and abnormal nodes and the upstream and downstream edges of the industry chain (representing business transmission).

[0065] Anomaly nodes are identified in the hierarchical node set using a spatiotemporal graph convolutional network model (e.g., nodes whose anomaly probability output by the model is greater than a preset alarm threshold are identified as anomaly nodes). After identifying the anomaly nodes, based on the graph structure of the spatiotemporal graph of the industry chain, a graph traversal algorithm (e.g., breadth-first search or depth-first search) is used to traverse along communication dependency edges and upstream and downstream edges of the industry chain, starting from the identified anomaly nodes. This traversal process searches for all reachable related nodes, i.e., other nodes potentially affected by the anomaly nodes at the network level or in the business process. After determining the set of related nodes, risk transmission data is calculated based on the communication dependency edges between related nodes and the anomaly nodes, as well as the upstream and downstream edges of the industry chain, and according to the transmission paths found by the graph traversal algorithm (e.g., calculating a risk transmission probability or risk attenuation factor). The anomaly nodes (anomaly source), the searched related nodes (affected nodes), and the calculated risk transmission data are summarized and output as the final traffic anomaly prediction result, thus providing a comprehensive alarm information including the anomaly source, the scope of impact, and the transmission path.

[0066] In one possible implementation, the steps for calculating risk transmission data based on the communication dependency edges between associated nodes and anomalous nodes, as well as the upstream and downstream edges of the industry chain, are as follows: 1. When searching for associated nodes, the graph traversal algorithm records the traversal path (Path) from the anomalous node to each associated node and the path length (Hops, i.e., the number of hops on the edge). 2. Set risk transmission coefficients for communication dependency edges and upstream and downstream edges of the industry chain (e.g., these can be determined based on the edge weights, ranging from 0 to 1). 3. The risk transmission data may specifically include a risk transmission probability (P). risk Its calculation formula can be: Among them, P source W represents the probability of an anomaly at an abnormal node (determined by the model). e It is the risk propagation coefficient for each edge (e) along the traversal path. Alternatively, the risk propagation data can be a risk decay factor (F). risk Its calculation formula can be: F risk =P source ·α Hops Here, α is a preset attenuation constant (e.g., 0.8), and Hops is the number of path hops from the anomalous node to the associated node. The calculated risk transmission data (e.g., P) risk or F risk The associated nodes are summarized and output together. This embodiment also discloses an electronic device, as shown in the reference. Figure 3 The electronic device may include: at least one processor 301, at least one communication bus 302, user interface 303, network interface 304, and at least one memory 305.

[0067] The communication bus 302 is used to enable communication between these components.

[0068] The user interface 303 may include a display screen and a camera. Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0069] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0070] The processor 301 may include one or more processing cores. The processor 301 connects to various parts of the server using various interfaces and lines, and performs various server functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 305, and by calling data stored in memory 305. Optionally, the processor 301 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 301 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required for display; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 301 and may be implemented as a separate chip.

[0071] The memory 305 may include random access memory (RAM) or read-only memory. Optionally, the memory 305 may include a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 305 may also be at least one storage device located remotely from the aforementioned processor 301. Figure 3 As shown, the memory 305, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application program for an industrial internet traffic anomaly prediction method.

[0072] exist Figure 3In the electronic device shown, the user interface 303 is mainly used to provide an input interface for the user and to obtain the user input data; while the processor 301 can be used to call an application program stored in the memory 305 for an industrial Internet traffic anomaly prediction method. When executed by one or more processors 301, the electronic device executes one or more methods as described in the above embodiments.

[0073] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0074] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0075] In some embodiments of this application, a computer-readable storage medium is provided, including instructions that, when executed on the electronic device, cause the electronic device to perform an industrial internet traffic anomaly prediction method according to an embodiment of this application.

[0076] In some embodiments of this application, a computer program product is also provided, which, when run on an electronic device, causes the electronic device to execute an industrial internet traffic anomaly prediction method according to an embodiment of this application.

[0077] In the several embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the shown or discussed mutual couplings or direct couplings or communication connections may be through some service interfaces; indirect couplings or communication connections between apparatuses or units may be electrical or other forms.

[0078] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0079] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0080] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory 305 and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory 305 includes various media capable of storing program code, such as a USB flash drive, external hard drive, magnetic disk, or optical disk.

[0081] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Those skilled in the art will readily conceive of other embodiments of this disclosure upon considering the disclosure in this specification. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described in this disclosure. The specification and embodiments are considered exemplary only, and the scope of this application is defined by the claims.

Claims

1. A method for predicting anomalies in industrial internet traffic, characterized in that, The method includes: Acquire physical topology data, historical traffic time-series data, real-time traffic data, and industry chain business topology data of industrial internet devices; Based on the physical topology data and the industry chain business topology data, a hierarchical node set is constructed, which includes physical device nodes, functional group nodes, and business unit nodes. Based on the device geographic coordinates in the physical topology data, the spatial distance between the physical device nodes is calculated, and the physical spatial edge between the physical device nodes is determined according to the comparison result between the spatial distance and the preset physical distance threshold. Based on the historical traffic time-series data, the communication pattern characteristics between the physical device nodes are analyzed, and the communication dependency edges between the physical device nodes are determined according to the comparison results of the communication pattern characteristics and the preset communication dependency threshold. Based on the industry chain business topology data, determine the upstream and downstream edges of the industry chain between the functional group nodes or the business unit nodes; By combining the physical device nodes, functional group nodes, business unit nodes, physical space edges, communication dependency edges, and upstream and downstream edges of the industry chain, a spatiotemporal graph of the industry chain is constructed. The preset spatiotemporal graph convolutional network model is trained based on the spatiotemporal graph of the industrial chain. Based on the real-time traffic data and the historical traffic time-series data, a spatiotemporal feature window is constructed, and the spatiotemporal feature window is input into the trained spatiotemporal graph convolutional network model. The spatiotemporal graph convolutional network model outputs the traffic anomaly prediction result.

2. The method according to claim 1, characterized in that, The construction of a hierarchical node set based on the physical topology data and the industry chain business topology data specifically includes: Based on the device information in the physical topology data, multiple physical device nodes are constructed; Based on the preset business logic in the industry chain business topology data, the physical device nodes are clustered according to preset aggregation features to obtain multiple functional group nodes; Based on the upstream and downstream characteristics of the industrial chain in the industrial chain business topology data, multiple business unit nodes are constructed, and the hierarchical inclusion relationship between each functional group node, each physical device node and each business unit node is determined to form the hierarchical node set.

3. The method according to claim 2, characterized in that, The process of determining the hierarchical inclusion relationship between each functional group node, each physical device node, and each business unit node to form the hierarchical node set specifically includes: A preset business unit mapping table is parsed from the industry chain business topology data. The business unit mapping table is used to represent the hierarchical inclusion relationship. Perform the following operations on each of the aforementioned service unit nodes: Query the business unit mapping table to obtain the list of identifiers corresponding to the business unit nodes; Traverse the identifier list and match the identifiers in the identifier list with the node identifiers of the functional group node and the physical device node; Based on the matching results, a hierarchical affiliation edge is established between the business unit node and the successfully matched functional group node and physical device node; The physical device nodes, functional group nodes, business unit nodes, and hierarchical belonging edges are combined to form the hierarchical node set.

4. The method according to claim 1, characterized in that, The step of analyzing the communication pattern characteristics between the physical device nodes based on the historical traffic time-series data, and determining the communication dependency edges between the physical device nodes based on the comparison results of the communication pattern characteristics and the preset communication dependency threshold, specifically includes: Obtain the historical traffic time-series data corresponding to the first physical device node and the second physical device node, wherein the first physical device node and the second physical device node are any two physical device nodes; Based on the historical traffic time-series data, the communication frequency, average traffic intensity, communication periodicity, and communication stability characteristics between the first physical device node and the second physical device node are extracted and calculated. The communication mode characteristics are obtained by aggregating and calculating the communication frequency, the average traffic intensity, the communication periodicity, and the communication stability characteristics. The communication pattern feature is compared with the preset communication dependency threshold. When the communication pattern feature is less than the preset communication dependency threshold, it is determined that the communication dependency edge is established between the two physical device nodes.

5. The method according to claim 1, characterized in that, The step of determining the upstream and downstream edges of the industrial chain between the functional group nodes or the business unit nodes based on the industrial chain business topology data specifically includes: From the aforementioned industry chain business topology data, obtain the upstream and downstream topology map of the industry chain; Analyze the upstream and downstream topology of the industry chain to determine the upstream and downstream relationships between the functional group nodes or business unit nodes defined in the upstream and downstream topology of the industry chain; Based on the upstream and downstream relationships of the industry, the upstream and downstream edges of the industrial chain between the functional group nodes or the business unit nodes are determined, and the upstream and downstream edges of the industrial chain are directed edges.

6. The method according to claim 1, characterized in that, The training of the preset spatiotemporal graph convolutional network model based on the spatiotemporal graph of the industrial chain specifically includes: The spatiotemporal graph of the industrial chain is converted into a graph data structure, which includes a node feature matrix and an edge relationship adjacency matrix. The node feature matrix and the edge relationship adjacency matrix are received through the input layer of the spatiotemporal graph convolutional network model. The temporal dependencies in the node feature matrix are identified through the temporal convolutional layers of the spatiotemporal graph convolutional network model. The spatial dependencies in the edge relation adjacency matrix are identified through the graph convolutional layers of the spatiotemporal graph convolutional network model. The spatiotemporal graph convolutional network model uses a fusion layer to fuse the outputs of the temporal convolutional layer and the graph convolutional layer, and then uses the output layer to map the fused output to obtain the node anomaly probability. The spatiotemporal graph convolutional network model is trained based on the node anomaly probability to obtain the trained spatiotemporal graph convolutional network model.

7. The method according to claim 1, characterized in that, The output of the traffic anomaly prediction result through the spatiotemporal graph convolutional network model also includes: The spatiotemporal graph convolutional network model is used to identify abnormal nodes in the hierarchical node set. Based on the graph structure of the spatiotemporal graph of the industrial chain, starting from the abnormal node, a graph traversal algorithm is used to traverse along the communication dependency edges and the upstream and downstream edges of the industrial chain to search for all reachable associated nodes. Based on the communication dependency edges between the associated nodes and the abnormal nodes, and the upstream and downstream edges of the industry chain, calculate the risk transmission data; The abnormal nodes, the associated nodes, and the risk transmission data are aggregated and output as the traffic anomaly prediction result.

8. An electronic device, characterized in that, Including processor and memory; The memory is used to store computer program code, the computer program code including computer instructions, and the processor invokes the computer instructions to cause the electronic device to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium storing computer instructions, characterized in that, When the computer instructions are executed on the electronic device, the electronic device causes the electronic device to perform the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, When the computer program product is run on an electronic device, it causes the electronic device to perform the method as described in any one of claims 1-7.

Images