Intelligent identification method for covert data center based on multi-scale time sequence feature fusion

Abstract

This invention relates to a method for intelligent identification of hidden data centers based on multi-scale temporal feature fusion, comprising the following steps: S1: acquiring and preprocessing temporal data of the region to be detected; S2: establishing an initial graph structure at the entity and observation point levels based on the preprocessed temporal tensor, and calibrating and sparsifying the edge weights through a data-driven adaptive graph learning mechanism, learning the set of multiple time-delay paths between node pairs to obtain optimized dynamic adjacency and time-delay weights; S3: constructing an intelligent identification model for hidden data centers by combining an ST-GNN model; S4: training the intelligent identification model for hidden data centers to obtain the trained model; S5: obtaining the real-time detection probability and confidence interval based on the real-time data stream; S6: selecting an initial alarm threshold through a cost-sensitive curve, performing adaptive fine-tuning, and obtaining the final alarm list based on the real-time detection probability. This invention effectively improves the efficiency of intelligent identification of hidden data centers.

Description

Technical Field

[0001] This invention relates to the field of intelligent monitoring, and in particular to an intelligent identification method for concealed data centers based on multi-scale temporal feature fusion. Background Technology

[0002] Covert data centers typically refer to data processing and storage entities located in restricted, regulated, or sensitive areas. They employ various technical means, camouflage methods, or resource allocation strategies to conceal their operational characteristics and external appearance, thereby evading regulation or tracking. These facilities not only threaten network and information security but may also affect compliance with energy regulation, environmental governance, and organizational management. Therefore, achieving efficient, reliable, and intelligent identification of covert data centers is of significant practical importance for improving network security capabilities, safeguarding public resources, and maintaining social order.

[0003] With the widespread deployment of IT infrastructure and IoT nodes, data center energy consumption, thermal environment, and information activities exhibit highly dynamic and diverse temporal characteristics. Covert data centers often deliberately adjust their operating modes, blurring the boundaries between normal and abnormal, and employing multiple concealment methods such as network camouflage, power management, and environmental disturbances, making traditional detection methods based on single indicators or static rules ineffective. On the one hand, data centers often exhibit potential correlations and temporal coupling across multiple dimensions of signals, including network traffic, energy consumption changes, and environmental conditions; on the other hand, the complexity of multi-source big data places higher demands on the feature acquisition capabilities, data fusion capabilities, and multi-scale modeling capabilities of detection methods. Summary of the Invention

[0004] To address the aforementioned issues, the present invention aims to provide a method for intelligent identification of hidden data centers based on multi-scale temporal feature fusion, which significantly improves the accuracy and interpretability of intelligent detection of hidden data centers.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A method for intelligent identification of hidden data centers based on multi-scale temporal feature fusion includes the following steps:

[0007] S1: Acquire the network traffic time series data, power load time series data and environmental time series data of the area to be detected, and preprocess them to obtain the preprocessed time series tensor;

[0008] S2: Based on the preprocessed temporal tensor, an initial graph structure is established at the entity and observation point level. The edge weights are calibrated and sparsified through a data-driven adaptive graph learning mechanism. The set of multiple time-delay paths between node pairs is learned to obtain the optimized dynamic adjacency and time-delay weights.

[0009] S3: Based on dynamic adjacency and time delay weights, and combined with the ST-GNN model, construct an intelligent identification model for hidden data centers;

[0010] S4: Based on the preprocessed temporal tensor, train the hidden data center intelligent identification model to obtain the trained hidden data center intelligent identification model.

[0011] S5: Based on the trained hidden data center intelligent recognition model, real-time detection probability and confidence interval are obtained according to real-time data stream;

[0012] S6: Select the initial alarm threshold through the cost-sensitive curve, and make adaptive fine-tuning based on drift and confidence interval during operation, and obtain the final alarm list based on the real-time detection probability.

[0013] Further preprocessing is performed as follows: First, clock alignment and interpolation are performed to map asynchronously sampled multi-source data to a unified time axis; then, denoising and gentle compression of outliers are carried out: quantile smoothing and short-window median filtering are used for network traffic to preserve burst patterns; robust wavelet denoising is used for power and environmental channels to protect edges and periodicity; missing data are classified and processed according to the missing mechanism: random missing data is processed using local time-domain interpolation, and systematic missing data is reconstructed using adjacent periods.

[0014] Furthermore, an initial graph structure is established at the entity and observation point level, as follows:

[0015] First, all observed entities are modeled as nodes, abstracting monitoring points in the physical world into nodes in the graph. Node types include: network probe nodes, power monitoring nodes, and environmental sensing nodes. In addition to carrying the corresponding time series data, each node also carries node attribute information, including node type identifier, geographical coordinates, equipment number, sampling frequency, and measurement accuracy metadata.

[0016] Physical adjacency edges are established based on physical layout and infrastructure connection relationships. Strong connection edges are established between power nodes in the same power distribution circuit to reflect the load coupling relationship under shared power supply. Medium-strength connection edges are established between all types of nodes in the same or adjacent computer rooms to reflect the environmental sharing and mutual influence brought about by spatial proximity. Weak connection edges are established between nodes on the same or adjacent floors of the same building to capture environmental correlations over a larger range.

[0017] Network adjacent edges are established based on network topology and logical connection relationships. Direct connection edges are established between network nodes within the same switching domain; logical connection edges are established between nodes within the same VLAN or subnet; indirect connection edges are established between nodes that are reachable by routing but require multiple hops; for connections across network boundaries, edge weights are adjusted based on network performance indicators such as bandwidth capacity, link quality, and routing hop count.

[0018] By analyzing the statistical relationships between historical time series data, statistical adjacency edges are established. Specifically, the Pearson correlation coefficient and Spearman rank correlation coefficient between node pairs are calculated, and correlation edges are established when the correlation exceeds a preset threshold. Mutual information index is calculated to identify nonlinear statistical dependencies and establish information coupling edges. Granger causality test is used to identify causal relationships between time series and establish causal inference edges.

[0019] Furthermore, edge weights are calibrated and sparsified using a data-driven adaptive graph learning mechanism, as follows: Based on the initial graph structure, a data-driven edge weight calibration mechanism is adopted, using gradient descent to optimize and learnable weight parameters for each edge; the calibration process combines backpropagation of task loss and graph structure regularization constraints; the calibration strategy employs an alternating optimization scheme, first fixing model parameters to optimize the graph structure, then fixing the graph structure to optimize model parameters, reaching a stable state through multiple iterations; L1 regularization is used to promote the sparsity of edge weights, setting an edge weight threshold, and dynamically pruning edges below the threshold; to address occasional correlations and noise interference in the data, a multi-level stability enhancement mechanism is constructed for processing, and an ensemble learning strategy for graph structures is adopted to learn multiple candidate graph structures from multiple random initializations and different hyperparameter settings, ultimately fusing them to obtain a more stable and reliable graph representation.

[0020] Furthermore, a multi-layered stability enhancement mechanism is implemented, as follows:

[0021] Divide all training data into segments according to a fixed window, denoted as W1, W2, ..., W... k ,…,W K ;

[0022] In each window W k Above, independent training can learn the adjacency matrix A. (k) Obtain the edge weight distribution for each time period;

[0023] For the edge (i,j) from node i to node j, calculate its weight sequence in each window, using variance scale. Measure its temporal consistency;

[0024] ;

[0025] Where Var represents the variance function; Let represent the adjacency matrix of edge (i,j);

[0026] for Edges exceeding the threshold are either weighted down or removed from the final graph structure.

[0027] Random noise of varying intensities is introduced into the original time-series data to generate a perturbed sample set. The graph structure is then fine-tuned for each perturbed data set to obtain A. (n) Multiple sets of experiments can be executed in parallel: for each edge A (n) The stability of its weights under different perturbations is statistically analyzed. :

[0028] ;

[0029] Where Std represents the standard deviation function; N is the number of perturbation samples;

[0030] for Edges exceeding the threshold are also subject to weight reduction or pruning.

[0031] Furthermore, the set of multiple time-delay paths between node pairs is learned, as follows:

[0032] Considering the potential time delay effects between different signal channels in a concealed data center, a predefined set of multiple time delays is used to capture these delay relationships. The time delay set includes: immediate response, short-term delay, medium-term delay, and long-term delay. Each node establishes connections at multiple time delay levels to form a spatiotemporal correlation pattern.

[0033] A cross-modal time-delay learning mechanism is constructed to capture the delay impact relationships between different modalities: power to network, network to environment, and environment to power. For each modal pair, the system learns a set of time-delay weight parameters to represent the impact strength at different delay times. The most important time-delay connections are automatically discovered through an attention mechanism. Cross-modal delay modeling pays special attention to possible camouflage patterns in hidden data centers.

[0034] The time delay weights are optimized using an end-to-end learning approach and are jointly trained with the main detection task. Learnable weight parameters are assigned to each time delay path, and the optimal time delay combination is automatically learned through gradient descent. The optimization process introduces temporal consistency constraints to ensure that the learned time delay relationships conform to physical causal logic.

[0035] Furthermore, the intelligent identification model for hidden data centers includes a time-latency-aware edge aggregation layer, a spatiotemporal block stacking layer, a discriminant header, and a confidence interval header, as detailed below:

[0036] Input preprocessed temporal tensor X, dynamic adjacency A t Time Delay Weight Corresponding time delay set ,in Indicates the first A specific time delay length value;

[0037] The time-delay-aware edge-level aggregation layer, for each pair of nodes (i, j) with an edge, first aligns the time series of i to the time axis of j according to the time-delay set, and then applies time-delay attention weights. The information is integrated and transmitted to j at the edge level.

[0038] The spatiotemporal block stacking layer includes several spatiotemporal blocks, each spatiotemporal block containing two branches: spatial graph convolution and multi-scale temporal convolution, which are fused by gating.

[0039] The discriminant header and confidence interval header are based on the gated fused feature z. graph The detection probability is obtained through the discriminant head. ,in, The activation function is MLP, which stands for Multilayer Perceptron. Confidence intervals are obtained through the confidence interval header.

[0040] Furthermore, the time-delay-aware edge aggregation layer is as follows:

[0041] Let the node feature sequence be X. i Define the causal time-shift operator:

[0042] ;

[0043] in, For the first Each time delay length; The vector is all zeros; t is the current time step;

[0044] For each edge (i, j) and each time delay Perform a linear transformation first, then align:

[0045] ;

[0046] Among them, W in The input feature projection matrix; This indicates that after projection and time-delay alignment, node i is at the [missing information] level. The characteristics of the information transmitted to j under a time delay;

[0047] Given dynamic time delay weights Then, by introducing local context attention and gating, we obtain the edge messages:

[0048] ;

[0049] in, For node pair (i,j) in the th... Normalized attention weights at time t with time lag; This indicates that for all time-delay channels Perform softmax normalization; qj (t) is the query vector of node j at time t; For node i in the th Key vector under time delay; d k The dimension of the key vector; These are the original time-delay weights that the model can learn; This is the default value; For based on Position offset; h j (t) represents the current hidden state of node j; The gating factor; This is a time-delayed message; W g h is the gated weight matrix; j (t) represents the hidden state of node j at time t; U g b represents the gating state weights. g For gated bias; m i→j (t) represents the final aggregate message sent by node i to node j at time t under all time delays; ⊙ represents element-wise multiplication; W v Projection weights for edge messages;

[0050] And use normalized dynamic adjacency A t The contribution of controlling the incoming edges:

[0051] ;

[0052] in, It is a nonlinear function; X represents the initial hidden layer features of node j at time t; j (t) represents the original feature of node j at time t; W s For self-feature projection weights; Let m be the i,jth element of the dynamic adjacency matrix at time t, based on the normalization process. i→j (t) represents the information from neighbor i; N(j) represents the set of neighbors of node j.

[0053] Furthermore, the initial alarm threshold is selected through a cost-sensitive curve, and adaptive fine-tuning is performed during operation based on drift and confidence intervals, as follows:

[0054] During the offline model evaluation phase, a family of cost-sensitive curves is constructed based on the detection probabilities output from the validation set and the true labels, including: cost-weighted ROC, expected cost-threshold curve, and Precision-Recall-cost curve. First, the business-side false positive cost C is defined. FP Underreported costs C FN Benefits of correct alarms R TPBased on this, the expected net cost per unit window under different thresholds τ is calculated:

[0055]

[0056] The initial threshold τ0 is selected based on the criterion of minimum expected cost or maximum benefit, and a set of candidate running bands is output simultaneously. Used for a stable transition during the initial stage of deployment; FP(τ), FN(τ), and TP(τ) represent the false alarm rate, false negative rate, and correct detection rate at the threshold τ, respectively;

[0057] Continuously monitor data distribution and performance proxy metrics, including: input statistics, probability flow distribution, alarm baseline, and confidence interval; trigger a threshold fine-tuning mechanism when drift or an increase in the confidence interval is detected.

[0058] Perform adjustments within the running band:

[0059] ;

[0060] Where s t It is a weighted composite of target alarm rate deviation, unit cost trend, confidence interval cross-threshold ratio, and near-end calibration error. η represents the alarm threshold at time t; η is the learning rate.

[0061] Furthermore, based on the real-time detection probability stream and confidence interval, the final alarm list is obtained, as follows:

[0062] In each real-time window, the system is based on the detection probability. Its confidence interval Perform tiered decision-making: when Directly confirm strong alarms; when The remaining items are directly filtered; the rest are marked as requiring review or requiring delayed decision-making and enter the short-term observation queue. The probabilities and evidence from several subsequent windows are then combined for rolling re-evaluation.

[0063] Simultaneously, a cost-sensitive two-threshold strategy is introduced for priority allocation: Trigger high priority, The trigger is prioritized, and the interval crossover is combined with the confidence interval and operation and maintenance capacity for batch verification. The final alarm list includes event timestamp, alarm level, location and edge evidence, probability and interval.

[0064] The present invention has the following beneficial effects:

[0065] 1. This invention breaks through the limitations of single data source detection by deeply fusing multi-source heterogeneous time-series data (network traffic, power load, environmental sensing) and can capture the composite feature patterns of hidden data centers at different physical levels.

[0066] 2. This invention introduces a multi-delay path set learning mechanism to automatically discover and quantify the delay coupling relationship between different modalities, which is suitable for identifying advanced covert strategies that evade through temporal camouflage.

[0067] 3. This invention breaks away from the limitations of traditional topology construction based on prior knowledge through a data-driven adaptive graph learning mechanism. It can automatically discover potential physical connections, statistical dependencies and causal relationships, and ensure that the model focuses on the most critical information pathways through sparsification processing, which greatly improves the accuracy and interpretability of detection. Attached Figure Description

[0068] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0069] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0070] refer to Figure 1 In this embodiment, a method for intelligent identification of hidden data centers based on multi-scale temporal feature fusion is provided, including the following steps:

[0071] S1: Acquire network traffic time-series data (connection density, session duration distribution, port activity spectrum, packet size spectrum, etc.), power load time-series data (active power, reactive power, power factor, harmonic components, load step characteristics, etc.) and environmental time-series data (temperature, humidity, noise, electromagnetic radiation level, diurnal cycle) of the area to be detected, and preprocess them to obtain the preprocessed time-series tensor;

[0072] S2: Based on the preprocessed temporal tensor, an initial graph structure is established at the entity and observation point levels. A data-driven adaptive graph learning mechanism is used to calibrate and sparsify edge weights, preserving stable and interpretable key edges and suppressing overfitting caused by incidental correlations. Considering that the behavior of covert data centers may have time delays between different channels, the set of multiple time-delay paths between node pairs is learned, allowing cross-modal delay couplings such as "power → network" and "network → environment" to be captured and quantified, thereby improving sensitivity to camouflage and circumvention strategies; optimized dynamic adjacency and time-delay weights are obtained.

[0073] S3: Based on dynamic adjacency and time delay weights, and combined with the ST-GNN model, construct an intelligent identification model for hidden data centers;

[0074] S4: Based on the preprocessed temporal tensor, train the hidden data center intelligent identification model to obtain the trained hidden data center intelligent identification model.

[0075] S5: Based on the trained hidden data center intelligent recognition model, real-time detection probability and confidence interval are obtained according to real-time data stream;

[0076] S6: Select the initial alarm threshold through the cost-sensitive curve, and make adaptive fine-tuning based on drift and confidence interval during operation, and obtain the final alarm list based on the real-time detection probability.

[0077] In this embodiment, the preprocessing is as follows: First, clock alignment and interpolation are performed to map the asynchronously sampled multi-source data to a unified time axis; then, denoising and gentle compression of outliers are performed: quantile smoothing and short-window median filtering are used for network traffic to preserve burst patterns; robust wavelet denoising is used for power and environmental channels to protect edges and periodicity; missing data is classified and processed according to the missing mechanism: random missing data is processed using local time-domain interpolation, and systematic missing data is processed using adjacent period reconstruction.

[0078] In this embodiment, an initial graph structure is established at the entity and observation point level, as follows:

[0079] First, all observed entities are modeled as nodes, abstracting monitoring points in the physical world into nodes in the graph. Node types include: network probe nodes (corresponding to network access points, switch ports, router interfaces, and other network traffic acquisition points), power monitoring nodes (corresponding to power data acquisition devices such as meters, power analyzers, and distribution cabinet monitoring points at all levels), and environmental sensing nodes (corresponding to environmental parameter acquisition devices such as temperature and humidity sensors, noise monitors, and electromagnetic radiation detectors). In addition to carrying the corresponding time-series data, each node also carries node attribute information, including node type identifier, geographical location coordinates, device number, sampling frequency, and measurement accuracy metadata.

[0080] Physical adjacency edges are established based on physical layout and infrastructure connection relationships. Strong connection edges are established between power nodes in the same power distribution circuit to reflect the load coupling relationship under shared power supply. Medium-strength connection edges are established between all types of nodes in the same or adjacent computer rooms to reflect the environmental sharing and mutual influence brought about by spatial proximity. Weak connection edges are established between nodes on the same or adjacent floors of the same building to capture environmental correlations over a larger range.

[0081] Network adjacency edges are established based on network topology and logical connections. Direct connections are established between network nodes within the same switching domain, with higher weights; logical connections are established between nodes within the same VLAN or subnet, with medium weights; indirect connections are established between nodes reachable by routing but requiring multiple hops, with lower weights; for connections across network boundaries, edge weights are adjusted based on network performance metrics such as bandwidth capacity, link quality, and routing hop count; network adjacency considers not only direct data transmission paths but also logical associations based on traffic pattern similarity.

[0082] By analyzing the statistical relationships between historical time series data, statistical adjacency edges are established. Specifically, the Pearson correlation coefficient and Spearman rank correlation coefficient between node pairs are calculated, and correlation edges are established when the correlation exceeds a preset threshold. Mutual information index is calculated to identify nonlinear statistical dependencies and establish information coupling edges. Granger causality test is used to identify causal relationships between time series and establish causal inference edges.

[0083] In this embodiment, edge weights are calibrated and sparsified using a data-driven adaptive graph learning mechanism, as follows: Based on the initial graph structure, a data-driven edge weight calibration mechanism is adopted. Gradient descent is used to optimize and learn the learnable weight parameters of each edge, maximizing the performance of the downstream detection task in the final graph structure. The calibration process combines backpropagation of task loss and graph structure regularization constraints to ensure that the learned edge weights improve detection accuracy while maintaining reasonable sparsity and interpretability. The calibration strategy employs an alternating optimization scheme: first, the model parameters are fixed to optimize the graph structure, then the graph structure is fixed to optimize the model parameters, achieving a stable state through multiple iterations. To prevent computational complexity explosion and overfitting risks caused by an overly dense graph structure, an adaptive sparsity strategy is implemented. L1 regularization is used to promote the sparsity of edge weights, and an edge weight threshold is set, with edges below the threshold being dynamically pruned. For occasional correlations and noise interference in the data, a multi-level stability enhancement mechanism is constructed for processing, and an ensemble learning strategy for graph structures is adopted. Multiple candidate graph structures are learned from multiple random initializations and different hyperparameter settings, ultimately fusing them to obtain a more stable and reliable graph representation.

[0084] In this embodiment, the multi-layered stability enhancement mechanism is as follows:

[0085] Divide all training data into segments according to fixed windows (e.g., 1 hour / 1 day / 1 week), and denote them as W1, W2, ..., W... k ,…,W K ;

[0086] In each window W k Above, independent training can learn the adjacency matrix A. (k) Obtain the edge weight distribution for each time period;

[0087] For the edge (i,j) from node i to node j, calculate its weight sequence in each window, using variance scale. Measure its temporal consistency;

[0088] ;

[0089] Where Var represents the variance function; Let represent the adjacency matrix of edge (i,j);

[0090] for Edges exceeding a threshold (such as those in the top 20% of the total edge distribution) are directly weighted down in the final graph structure (e.g., multiplied by a coefficient <1) or pruned (set to zero).

[0091] Random noise of varying intensities (e.g.) is introduced into the original time-series data. (Incrementing), generating a perturbation sample set, and fine-tuning the graph structure for each perturbation data set to obtain A. (n) Multiple sets of experiments can be executed in parallel: for each edge A (n) The stability of its weights under different perturbations is statistically analyzed. :

[0092] ;

[0093] Where Std represents the standard deviation function; N is the number of perturbation samples;

[0094] for Edges exceeding the threshold are also subject to weight reduction or pruning.

[0095] In this embodiment, the set of multiple time-delay paths between learning node pairs is as follows:

[0096] Considering the potential time delay effects between different signal channels in a concealed data center, a predefined set of multiple time delays is used to capture these delay relationships. The time delay set includes: instantaneous response (0 delay), short-term delay (1-10 seconds, corresponding to network response and instantaneous power regulation), medium-term delay (30 seconds-5 minutes, corresponding to system scheduling and environmental response), and long-term delay (10-60 minutes, corresponding to thermodynamic response and load migration). Each node establishes connections at multiple time delay levels, forming a spatiotemporal correlation pattern.

[0097] A cross-modal time-delay learning mechanism is constructed to capture the delay impact relationships between different modes such as power to network, network to environment, and environment to power. For each modal pair, the system learns a set of time-delay weight parameters to represent the impact strength at different delay times. The most important time-delay connections are automatically discovered through an attention mechanism. Cross-modal delay modeling pays special attention to possible camouflage patterns in hidden data centers, such as masking the synchronization relationship between power and computing load through delay modulation, or masking the true thermodynamic response through environmental interference.

[0098] The time delay weights are optimized using an end-to-end learning approach and are jointly trained with the main detection task. Learnable weight parameters are assigned to each time delay path, and the optimal time delay combination is automatically learned through gradient descent. The optimization process introduces temporal consistency constraints to ensure that the learned time delay relationships conform to physical causal logic.

[0099] In this embodiment, the concealed data center intelligent identification model includes a time-delay-aware edge aggregation layer,

[0100] The spatiotemporal block stacking layer, the discrimination header, and the confidence interval header are detailed below:

[0101] Input preprocessed temporal tensor X, dynamic adjacency A t (Originated from S2, which can be sparse), time-delay weights Corresponding time delay set ,in Indicates the first A specific time delay length value;

[0102] The time-delay-aware edge-level aggregation layer, for each pair of nodes (i, j) with an edge, first aligns the time series of i to the time axis of j according to the time-delay set, and then applies time-delay attention weights. The information is integrated and transmitted to j at the edge level.

[0103] The spatiotemporal block stacking layer includes several spatiotemporal blocks, each of which contains two branches: spatial graph convolution and multi-scale temporal convolution (TCN), which are fused through gating.

[0104] The discriminant header and confidence interval header are based on the gated fused feature z. graph The detection probability is obtained through the discriminant head. ,in, The activation function is MLP, which stands for Multilayer Perceptron. Confidence intervals are obtained through the confidence interval header.

[0105] In this embodiment, the time-delay-aware edge aggregation layer is specifically as follows:

[0106] Let X be the node feature sequence. i Define the causal time-shift operator:

[0107] ;

[0108] in, For the first Each time delay length; The vector is all zeros; t is the current time step;

[0109] For each edge (i, j) and each time delay Perform a linear transformation first, then align:

[0110] ;

[0111] Among them, W in The input feature projection matrix; This indicates that after projection and time-delay alignment, node i is at the [missing information] level. The characteristics of the information transmitted to j under a time delay;

[0112] Given dynamic time delay weights (Based on S2 learning), and then by introducing local context attention and gating, we obtain the edge messages:

[0113] ;

[0114] in, For node pair (i,j) in the th... Normalized attention weights at time t with time lag; This indicates that for all time-delay channels Perform softmax normalization; q j (t) is the query vector of node j at time t; For node i in the th Key vector under time delay; d k The dimension of the key vector; These are the original time-delay weights that the model can learn; This is the default value; For based on Positional offset encourages short time delays; h j (t) represents the current hidden state of node j; The gating factor; This is a time-delayed message; W g h is the gated weight matrix; j (t) represents the hidden state of node j at time t; U g b represents the gating state weights. g For gated bias; m i→j (t) represents the final aggregate message sent by node i to node j at time t under all time delays; ⊙ represents element-wise multiplication; W v Projection weights for edge messages;

[0115] And use normalized dynamic adjacency A t The contribution of controlling the incoming edges:

[0116] ;

[0117] in, It is a nonlinear function; X represents the initial hidden layer features of node j at time t; j (t) represents the original feature of node j at time t; W s For self-feature projection weights; Let m be the i,jth element of the dynamic adjacency matrix at time t, based on the normalization process. i→j(t) represents the information from neighbor i; N(j) represents the set of neighbors of node j.

[0118] In this embodiment, the initial alarm threshold is selected using a cost-sensitive curve, and adaptive fine-tuning is performed during runtime based on drift and confidence intervals, as detailed below:

[0119] During the offline model evaluation phase, a family of cost-sensitive curves is constructed based on the detection probabilities output from the validation set and the true labels. These include: cost-weighted ROC (weighted FPR / TPR), expected cost-threshold curve, and Precision-Recall-cost curve. First, the business-side false positive cost C is defined. FP Underreported costs C FN Benefits of correct alarms R TP Based on this, the expected net cost per unit window under different thresholds τ is calculated:

[0120]

[0121] The initial threshold τ0 is selected based on the criterion of minimum expected cost or maximum benefit, and a set of candidate running bands is output simultaneously. Used for a stable transition during the initial stage of deployment; FP(τ), FN(τ), and TP(τ) represent the false alarm rate, false negative rate, and correct detection rate at the threshold τ, respectively;

[0122] Continuously monitor data distribution and performance metrics, including: input statistics (mean / variance / autocorrelation), probability stream distribution (quantile drift after calibration), alarm baseline (alarm rate, alarm duration distribution), and confidence intervals; when significant drift (such as PSI / KL exceeding the threshold) or an increase in the confidence interval is detected, trigger the threshold fine-tuning mechanism.

[0123] Perform adjustments within the running band:

[0124] ;

[0125] Where st is a weighted composite of target alarm rate deviation, unit cost trend, confidence interval cross-threshold ratio, and near-end calibration error (such as Brier / ECE); η represents the alarm threshold at time t; η is the learning rate.

[0126] In this embodiment, the final alarm list is obtained based on the real-time detection probability stream and confidence interval, as follows:

[0127] In each real-time window, the system is based on the detection probability. Its confidence interval Perform tiered decision-making: when Directly confirm strong alarms; when The remaining items are directly filtered; the rest are marked as requiring review or requiring delayed decision-making and enter the short-term observation queue. The probabilities and evidence from several subsequent windows are then combined for rolling re-evaluation.

[0128] Simultaneously, a cost-sensitive two-threshold strategy is introduced for priority allocation: Trigger high priority, Triggering is prioritized, and for interval intersections, batch verification is performed by combining confidence intervals and operational capacity. The final alarm list includes event timestamps, alarm levels, location and edge evidence (dominant node, key edge, dominant time delay), probability, and interval. Spatiotemporal aggregation is performed on homogeneous / nearest neighbor alarms, outputting deduplicated alarm clusters and root cause clues. Threshold trajectories, drift indicators, and handling feedback are retained throughout the process for closed-loop updates of cost parameters and threshold strategies, achieving dynamically optimal alarm decision-making "cost-centric."

[0129] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0131] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0132] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0133] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A concealed data center intelligent identification method based on multi-scale time sequence feature fusion, characterized in that, The method comprises the following steps: S1: obtaining network traffic time series data, power load time series data and environmental time series data in a region to be detected, and preprocessing to obtain a preprocessed time series tensor; S2: based on the preprocessed time series tensor, an initial graph structure is established at the entity and observation point level, and an adaptive graph learning mechanism driven by data is used to calibrate and sparsify the edge weight, learn a set of multiple time lag paths between nodes, and obtain optimized dynamic adjacency and time lag weights; S3: according to the dynamic adjacency and time lag weights, an intelligent identification model of a hidden data center is constructed in combination with an ST-GNN model; S4: according to the preprocessed time series tensor, the intelligent identification model of the hidden data center is trained to obtain a trained intelligent identification model of the hidden data center; S5: based on the trained intelligent identification model of the hidden data center, real-time detection probability and a confidence interval are obtained according to real-time data flow; S6: an initial alarm threshold is selected through a cost-sensitive curve, and in the running period, adaptive fine-tuning is performed according to drift and the confidence interval, and a final alarm list is obtained according to the real-time detection probability; The intelligent identification model of the hidden data center comprises a time lag perception edge level aggregation layer, a spatio-temporal block stacking layer, a discrimination head and a confidence interval head, and specifically as follows: Input pre-processed time series tensor X, dynamic adjacency A t , time lag weight , corresponding time lag set , wherein denotes the th specific time lag length value; The edge-level aggregation layer with time delay perception aligns the time series of i to the time axis of j according to the time delay set for each pair of nodes (i, j) with edges, and then transmits the edge-level information to j with a time delay attention weight Fusion, form edge-level information transmission to j; The spatio-temporal block stacking layer comprises a plurality of spatio-temporal blocks, each spatio-temporal block comprising a spatial graph convolution and a multi-scale time convolution two branches, and the two branches are fused through a gate; The discriminant head and the confidence interval head obtain the detection probability z according to the gated fused feature graph , through the discriminant head , wherein, is an activation function, and the MLP represents a multi-layer perceptron, and the confidence interval is obtained through the confidence interval head. 2.The method according to claim 1, characterized in that, The preprocessing is specifically as follows: first, clock alignment and interpolation are performed to map the asynchronously sampled multi-source data to a unified time axis; then, denoising and mild compression of abnormal points are performed: quantile smoothing and short window median filtering are used for network traffic to retain burst patterns; robust wavelet denoising is used for power and environmental channels to protect edges and periodicity; missing data is classified and processed according to a missing mechanism: local time domain interpolation is used for random missing, and adjacent period reconstruction is used for systematic missing. 3.The method according to claim 1, characterized in that, The initial graph structure is established at the entity and observation point level, and specifically as follows: First, all observation entities are modeled as nodes, and the monitoring points in the physical world are abstracted as nodes in the graph, and the node types include: network probe nodes, power monitoring nodes and environmental perception nodes; each node carries not only the corresponding time series data, but also node attribute information, including node type identification, geographic location coordinates, device number, sampling frequency and measurement accuracy metadata; Physical adjacent edges are established based on physical layout and infrastructure connection relationship, strong connection edges are established between power nodes in the same power distribution circuit to reflect the load coupling relationship under the common power supply; medium-strength connection edges are established between all types of nodes in the same machine room or adjacent machine rooms to reflect the environmental sharing and mutual influence brought by spatial proximity; weak connection edges are established between nodes on the same building floor or adjacent floors to capture the environmental correlation in a larger range; According to the network topology and logical connection relationship, a network adjacent edge is established, a direct connection edge is established between network nodes in the same switching domain, a logical connection edge is established between nodes in the same VLAN or in the same subnet, an indirect connection edge is established between nodes that can reach each other through routing but need to cross multiple hops, and for connections across network boundaries, the edge weight is adjusted according to bandwidth capacity, link quality, and routing hop number network performance indicators; Statistical adjacent edges are established by analyzing the statistical relationship between historical time series data. Specifically, the Pearson correlation coefficient and the Spearman rank correlation coefficient between node pairs are calculated, and a correlation edge is established when the correlation exceeds a preset threshold. Mutual information indicators are calculated to identify nonlinear statistical dependencies and establish information coupling edges. Granger causality tests are used to identify causal relationships between time series and establish causal inference edges. 4.The method according to claim 3, characterized in that, The adaptive graph learning mechanism driven by data is used to calibrate and sparsify the edge weight, as follows. On the basis of the initial graph structure, a data-driven edge weight calibration mechanism is used to optimize and learn the learnable weight parameters of each edge through gradient descent. The calibration process combines task loss backpropagation and graph structure regularization constraints. The calibration strategy uses an alternating optimization scheme, which first optimizes the graph structure while fixing the model parameters, and then optimizes the model parameters while fixing the graph structure. Through multiple iterations, a stable state is reached. L1 regularization is used to promote the sparsity of the edge weight, and edges with a weight below a threshold are dynamically pruned. A multi-level stability enhancement mechanism is constructed to handle occasional correlations and noise in the data, and a graph structure ensemble learning strategy is used to learn multiple candidate graph structures from multiple random initializations and different hyperparameter settings. Finally, a more stable and reliable graph representation is obtained by fusion. 5.The method of claim 4, wherein, The multi-level stability enhancement mechanism is as follows: The entire training data is segmented by a fixed window, respectively denoted as W1, W2, …, W k ,…,W K ; At each window W k , the independent learnable adjacency matrix A (k) is trained to obtain the edge weight distribution in each time period; For edge (i,j) from node i to node j, compute its weight sequence in each window, using variance score measures its timing consistency; ； wherein Var denotes a variance function; denotes an adjacency matrix of edges (i,j). For Edges that exceed the threshold are directly downweighted or pruned in the final graph structure. Introduce random noise with different intensities to the original time series data to generate perturbed sample sets, fine-tune the graph structure for each set of perturbed data, and obtain A (n) ; Parallel execution of multiple sets of experiments: for each edge , statistics of its weight stability under different perturbations : ； where Std represents the standard deviation function, and N is the number of perturbed samples. For Edges above the threshold are also downweighted or pruned. 6.The method of claim 5, wherein, The multiple time-lag path set between node pairs is learned as follows: Considering the time delay effects that may exist between different signal channels in the hidden data center, a multiple time-lag set is predefined to capture these delay relationships. The time-lag set includes immediate response, short-term delay, medium-term delay, and long-term delay. Each node pair establishes connections at multiple time-lag levels, forming a spatiotemporal association pattern. A cross-modal time-lag learning mechanism is constructed to capture the delay influence relationships between different modalities, such as power to network, network to environment, and environment to power. For each modality pair, the system learns a set of time-lag weight parameters representing the influence strength at different delay times. The most important time-lag connections are automatically discovered through an attention mechanism. Cross-modal delay modeling pays special attention to the possible camouflage patterns of the hidden data center. The time-lag weight is optimized using an end-to-end learning method and is jointly trained with the main detection task. A learnable weight parameter is assigned to each time-lag path, and the optimal time-lag combination is automatically learned through gradient descent. The optimization process introduces a temporal consistency constraint to ensure that the learned time-lag relationships conform to the physical causal logic. 7.The method of claim 1, wherein, The time-lag-aware edge-level aggregation layer is as follows: The sequence of note features is denoted as X i , define the causal time-shift operator: ； wherein, is the first time delay length; is an all-zero vector; t is the current time step; For each edge (i, j) and each time lag , first linear transformation and then alignment: ； wherein W in is an input feature projection matrix; represents the information feature transmitted from node i to j at the time delay after projection and time delay alignment. Given dynamic latency weights The local context attention and gate are introduced again to get edge messages: ； where, is the normalized attention weight for node pair (i, j) at time t with the th time lag; denotes softmax normalization over all time lag channels; q j (t) is the query vector of node j at time t; is the key vector of node i at the th time lag; d k is the dimension of the key vector; is the original time lag weight that the model can learn; is the preset value; is the position bias based on h j (t) is the current hidden state of node j; is the gating coefficient; W g is the gating weight matrix; h j (t) is the hidden state of node j at time t; U g is the gating state weight; b g is the gating bias; m i→j (t) represents the final aggregated message from node j at time t for node i at all time lags; is the element-wise multiplication; W v is the edge message projection weight; Normalized dynamic adjacency A t Controlling the contribution of incoming edges: ; wherein, is a non-linear function; Xj(t) is the initial hidden layer feature of node j at time t; j Xj(t) is the original feature of node j at time t; s is a self-feature projection weight; Nij(t) is the i,j-th entry of the dynamic adjacency matrix based on normalization at time t; N(j) is the neighbor set of node j. 8.The method according to claim 1, wherein, The initial alarm threshold is selected by a cost-sensitive curve, and in the running period, the drift and confidence interval are used for adaptive fine-tuning, specifically as follows: In the model offline evaluation stage, the detection probability output by the verification set and the true label are used to construct a cost-sensitive curve family, including: cost-weighted ROC, expected cost-threshold curve, precision-recall-cost; first define the business side false alarm cost C FP , the false negative cost C FN and the correct alarm benefit R TP , and then calculate the expected net cost per window under different thresholds τ: ； An initial threshold value τ0 is selected as a criterion of minimum expected cost or maximum benefit, and a set of candidate operating bands is output For stable transition in the initial stage of going online; FP(τ), FN(τ), TP(τ) represent false positive rate, false negative rate and correct detection rate at threshold value τ respectively; The data distribution and performance agent indicators are continuously monitored, including input statistics, probability flow distribution, alarm baseline, and confidence interval. When drift or confidence interval is detected, the threshold fine-tuning mechanism is triggered: Adjustment is performed in the running band: ； where s t is synthesized by target false alarm rate deviation, unit cost trend, confidence interval crossing threshold proportion, near-end calibration error weighted synthesis; η is the learning rate. 9.The method of claim 8, wherein, The final alarm list is obtained according to real-time detection of probability flow and confidence interval, specifically as follows: In each real-time window, the system bases the detection probability with its confidence interval makes a hierarchical decision: when strong alarm is directly confirmed; when it is directly filtered; the rest are marked for review or delayed decision, entering the short-term observation queue, and the probability and evidence of subsequent several windows are combined for rolling re-decision; A cost-sensitive double-threshold strategy is introduced to prioritize the alarms: Trigger high priority, Trigger medium priority, and batch verification is conducted by combining confidence intervals and operation and maintenance capacity. The final alarm list contains event timestamps, alarm levels, point and edge evidence, probabilities, and intervals.

Images