A method for detecting a false death state of a comprehensive detection device

Abstract

The application discloses a kind of comprehensive detection equipment's false death state detection method, comprising: continuously collecting target equipment data;Dynamic performance baseline equation containing health state decay term, environmental stress coefficient and seasonal compensation term is constructed, and equipment health state coefficient is updated in real time on line using extended Kalman filter;Time is divided into quantization slice, and the expected transmission threshold range under current space-time context is calculated;Respectively from transmission layer, semantic layer and topological layer, abnormal detection is carried out, and respective abnormal confidence is generated;Multi-dimensional abnormal confidence is input into comprehensive judgment model, and comprehensive false death confidence is output, if it exceeds threshold value, it is judged as false death state.The application can automatically adjust expected baseline with equipment aging, seasonal change, traffic and weather disturbance, does not need a large number of labels to cold start, and can be verified from flow, semantic, topological multi-perspective intersection, realize early perception, low false alarm, easy positioning and fast deployment of equipment health state.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of device coma detection, and particularly relates to a method for detecting a coma state of a device. BACKGROUND

[0002] With the rapid development of smart cities and intelligent transportation, intersection comprehensive detection devices, videos, radars, RSUs, etc. have become the core perception sources of traffic signal control, vehicle-road cooperation and illegal snapping. These devices are exposed to the outdoors for a long time and face complex environments such as high temperature, high humidity, vibration, rain, snow, fog and haze, and traffic flow fluctuations. The running state gradually deteriorates, and the phenomenon of "coma" often occurs: the device appears to be online, but the data is missing, the quality is declining or the service is interrupted, which leads to signal degradation, vehicle-road cooperation failure and even traffic violation missed snapping, directly affecting road traffic efficiency and traffic safety.

[0003] The existing detection methods mainly have the following shortcomings:

[0004] Static threshold method - high false alarm in summer and winter: using fixed upper limit / lower limit or simple same period / period strategy, without considering device aging, seasonal temperature change, traffic fluctuation and weather impact, continuously exceeding the limit in summer high temperature period and long-term lower than the limit in winter low temperature period, causing a large number of false alarms and missed alarms.

[0005] Single-dimensional monitoring - difficult to locate the root cause: only focusing on traffic or online heartbeat, unable to distinguish different fault modes such as "device true death", "traffic sudden drop" and "network island", still needing manual pulling of original data comparison after alarm, time-consuming and laborious for troubleshooting.

[0006] Black box model - not interpretable: although the end-to-end deep learning solution has high accuracy, it requires a large number of labeled samples, the model parameters are large, edge deployment is difficult, and it lacks interpretability, making it difficult for maintenance personnel to understand the alarm basis and quickly develop maintenance strategies.

[0007] Lack of environmental quantification - external impact not modeled: phenomena such as early morning peak traffic amplification, heavy rain / thick fog leading to wireless transmission capacity reduction are not quantified and included in the expectation calculation, leading to misjudgment of system as device failure due to high false alarm rate.

[0008] Cold start difficulty - lack of labeled samples: new devices or newly opened road sections have few fault samples, traditional supervised learning methods cannot be directly applied, and a long time is needed to accumulate labeled data before going online, affecting delivery progress.

[0009] Therefore, there is an urgent need for a method for detecting the coma state of a device. SUMMARY

[0010] Therefore, the application provides a method for detecting the pseudo-death state of a comprehensive detection device.

[0011] To achieve the above object, the application provides the following technical scheme.

[0012] The application provides a method for detecting the pseudo-death state of a comprehensive detection device, which comprises the following steps.

[0013] Step S1, continuously collecting performance data, service data, environmental data and context data of the target device;

[0014] Step S2, based on the historical normal operation data of the device, a dynamic performance baseline equation containing a health state decay term, an environmental stress coefficient and a seasonal compensation term is constructed, and an extended Kalman filter is used to update the device health state coefficient online in real time.

[0015] Step S3, dividing time into quantized slices, combining the dynamic performance baseline, the traffic flow mode coefficient and the weather disturbance coefficient to calculate the expected transmission threshold range under the current time and space context;

[0016] Step S4, performing abnormality detection from the transmission volume layer, the semantic layer and the topology layer respectively to generate respective abnormality confidence;

[0017] Step S5, inputting the multi-dimensional abnormality confidence into a comprehensive judgment model to output a comprehensive pseudo-death confidence, and if the comprehensive pseudo-death confidence exceeds a threshold, the device is determined to be in a pseudo-death state.

[0018] Preferably, the dynamic performance baseline equation is expressed as:

[0019]

[0020] wherein, represents the dynamic performance baseline of the target device at time t, represents the initial performance baseline of the device, and is the 95th percentile of the highest transmission data of the device, represents the device health state coefficient, which is updated online by the extended Kalman filter, represents the seasonal compensation coefficient, which is obtained by comparing and fitting the historical data, represents the environmental stress coefficient, which is calculated by weighted fusion of temperature, humidity and vibration intensity data.

[0021] Preferably, the environmental stress coefficient is calculated by the following steps:

[0022] ​Determine the device chassis temperature, humidity and vibration intensity data according to the environmental data;

[0023] The chassis temperature , environmental humidity And the vibration intensity of the device Z-score normalization processing is performed:

[0024]

[0025] Among them, , , The normalized temperature coefficient, the normalized humidity coefficient and the normalized vibration intensity coefficient are represented respectively, and the three denominators 50, 40 and 10 are the engineering experience range values, which are set based on the working limit of the device;

[0026] Then, the weights of the normalized temperature coefficient, the normalized humidity coefficient and the normalized vibration intensity coefficient corresponding to the historical 30-day data are determined by ridge regression fitting , satisfying And the three weight items are greater than 0, and the environmental stress coefficient is finally calculated:

[0027]

[0028] Preferably, the discrete time process of the extended Kalman filter for online updating of the device health state coefficient is as follows:

[0029] The device health state coefficient is a theoretical modeling in continuous time domain, and when implemented in a digital system, it is discretely sampled at a frequency of once per hour, and updated at a fixed period, and its discrete representation is , denoted as the device health state coefficient at the hour in the discrete time domain;

[0030] Based on the state estimation at the last time 1, the prior state and prior estimation covariance at the current time are predicted:

[0031]

[0032]

[0033] Among them, is the prior state prediction value, is the prior estimation covariance, is the process noise covariance, representing the natural fluctuation amplitude of the health state coefficient;

[0034] At the current time , the observation of the health state of the computing device

[0035]

[0036] wherein, is the measured average data transfer volume, is the initial performance benchmark of the device;

[0037] fusing the prior prediction and the current observation, the posterior state estimation and the posterior estimation covariance at the current time instant are calculated:

[0038] the Kalman gain is calculated:

[0039]

[0040] wherein, is the environmental stress coefficient at the current time instant, is the observation noise covariance, representing the error level of the transfer volume measurement; the state estimation is updated:

[0041]

[0042] the estimation uncertainty is updated:

[0043]

[0044]

[0045] At the next update, the and are taken as the new and are put into the prediction process of the prior state and the prior estimation covariance, and the cycle is executed.

[0046] Preferably, the step S3 comprises:

[0047] dividing the 24 hours of a day into 96 quantized slices of 15 minutes, each slice labeling the traffic flow pattern attribute and the weather attribute of the location of the target device, wherein the traffic flow pattern attribute comprises weekday morning peak, weekday evening peak, weekday flat peak, night, and weekend, and the weather attribute is the weather data of the location of the device obtained from the meteorological bureau;

[0048] determining the historical average transfer volume in the quantized slice in the past 30 days: wherein, ​​​​​​​​​​For the past 30 days in the same quantization slice 30 average data transmission amounts measured in the slice;

[0049] Based on the initial performance benchmark of the device Calculate the traffic flow pattern coefficient:

[0050]

[0051] Through the regression analysis technique, based on the historical transmission data and meteorological data of the target device in the healthy state, a disturbance matrix reflecting the comprehensive influence degree of weather changes on the data transmission capacity of the target device is fitted, wherein the matrix elements represent the transmission capacity retention ratio relative to sunny days;

[0052] Based on the transmission capacity retention ratio in the weather data lookup table disturbance matrix, the weather disturbance coefficient is obtained by linear interpolation;

[0053] The upper and lower threshold ranges of the expected transmission amount are calculated by the following formula:

[0054]

[0055]

[0056] wherein, represents the lower threshold of the expected transmission amount at time t, represents the upper threshold of the expected transmission amount at time t, represents the dynamic performance benchmark of the target device at time t calculated based on the dynamic performance baseline, represents the traffic flow pattern coefficient, represents the weather disturbance coefficient.

[0057] Preferably, the calculation process of the semantic layer anomaly confidence includes:

[0058] In a 5-minute sliding window, continuously collect the business event logs of the target device to form the original event sequence;

[0059] The BERT-base model fine-tuned in the traffic field is used to encode each event text in the original event sequence, output the event semantic vector, and perform Softmax normalization on all event semantic vectors in the window to obtain the event probability distribution;

[0060] Calculate the window event information entropy to measure whether the semantics are chaotic:

[0061]

[0062] wherein, is the event probability distribution of the i-th event, Total number of event texts in the original event sequence;

[0063] Read the actual average data transmission of the device measured in the same window , Calculate semantic-flow product:

[0064]

[0065] Take the average of the past 30 days of the device health status As a conservation benchmark :

[0066]

[0067] Calculate semantic conservation deviation degree , Quantify the degree of deviation from the health norm of the current window:

[0068]

[0069] According to the three-sigma law, set the first threshold 0.3, when Indicates that the semantics are normal, and the semantic anomaly confidence When Trigger semantic anomaly, semantic anomaly confidence .

[0070] Preferably, the calculation process of the topology layer anomaly confidence includes:

[0071] In the road section where the target device is located, the surrounding devices with traffic flow correlation relationship are screened out within the preset distance range upstream and downstream or the same physical intersection as the spatial boundary, to form a neighborhood device set.

[0072] For each pair of devices in the neighborhood device set , Calculate the Pearson correlation coefficient using the past 30-day hourly transmission volume curve , The edge weight Is given by:

[0073]

[0074] In the preset sliding window, take the median curve of the transmission volume of all neighborhood devices as the group normal waveform template ;

[0075] Use dynamic time warping algorithm to calculate the optimal matching distance between the actual curve of the target device in the current window And the template ;

[0076]

[0077] The distance is normalized to The similarity is:

[0078]

[0079] The second threshold value 0.4 is set, corresponding to a three-sigma lower limit, and the health sample , the proportion is <3%;

[0080] The topological anomaly confidence is determined:

[0081]

[0082] Preferably, the comprehensive pseudo-death confidence is obtained by the following method:

[0083] A 7-dimensional feature vector is constructed, including the transmission amount anomaly confidence , the semantic anomaly confidence , the topological anomaly confidence , the device health state coefficient , the environmental stress coefficient , the traffic flow pattern coefficient and the weather disturbance coefficient :

[0084]

[0085] A LightGBM gradient boosting tree model containing 128 decision trees with a maximum depth of 5 is used as a comprehensive judgment model;

[0086] The 7-dimensional feature vector is input into the model, and the comprehensive pseudo-death confidence is output by the comprehensive judgment model:

[0087]

[0088] The comprehensive pseudo-death confidence is output.

[0089] The present application has at least the following beneficial effects:

[0090] 1. The present application updates the health decay coefficient online every hour by extended Kalman filtering, superimposes environmental stress and seasonal sine compensation, so that the data amount should drift with the aging of the device, temperature and humidity vibration and annual cycle, and completely eliminates the seasonal drift phenomenon of "normal in summer, false alarm in winter" caused by traditional fixed threshold.

[0091] ​2. Transmission volume layer comparison interval drops, semantic layer uses BERT-information entropy to measure event confusion, topology layer uses DTW to detect and neighborhood similarity, three layers independently output confidence, which can distinguish different root causes such as 'device really dead', 'traffic sudden drop' and 'network island' at one time, and can greatly reduce the false alarm rate.

[0092] Other advantages, objects, and features of the application will be apparent to those skilled in the art from the following specification, and it is intended to cover all such changes and modifications that fall within the scope of the application. The present application may best be understood by reference to the following description taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0093] In order to make the objectives, technical solutions and beneficial effects of the present application clearer, the present application provides the following drawings for description:

[0094] Figure 1 A flow chart of steps of a false death state detection method of a comprehensive detection device in the embodiments of the present application. DETAILED DESCRIPTION

[0095] The preferred embodiments of the present application are described below in conjunction with the accompanying drawings, and it should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application.

[0096] To achieve the above-mentioned purpose, the present application provides the following technical solutions:

[0097] The false death state detection method of a comprehensive detection device provided by the present application refers to Figure 1 , comprising:

[0098] Step S1, continuously collecting performance data, service data, environment data and context data of the target device;

[0099] Step S2, based on the historical normal operation data of the device, a dynamic performance baseline equation containing health state decay term, environmental stress coefficient and seasonal compensation term is constructed, and an extended Kalman filter is used to update the device health state coefficient online in real time;

[0100] Step S3, divide the time into quantum slices, and calculate the expected transmission threshold range under the current space-time context by combining the dynamic performance baseline, traffic flow mode coefficient and weather disturbance coefficient;

[0101] Step S4, respectively detect the abnormality from the transmission volume layer, the semantic layer and the topology layer, and generate the respective abnormal confidence;

[0102] Step S5, input the multi-dimensional abnormal confidence into a comprehensive judgment model, output the comprehensive false death confidence, and if the threshold is exceeded, it is determined as a false death state.

[0103] The working principle and beneficial effects of the above technical solution are: the application adopts a technical route of dynamic baseline+EKF+space-time context+three-layer anomaly scoring+LightGBM fusion: first, four types of data of performance, business, environment and context of the target device are continuously collected, the dynamic performance baseline equation of health decay term, environmental stress coefficient and seasonal compensation term is used to describe the device data amount, and the extended Kalman filter is used to update the invisible health state coefficient online, so that the expected curve automatically drifts with the physical aging of the device, temperature, humidity, vibration and seasonal temperature change, thereby fundamentally solving the problem of inaccurate expectation of traditional fixed threshold in summer and false alarm in winter, realizing the synchronous evolution of the expected baseline and the real health state of the device, and then 24h is quantized into 96 15min slices, respectively superimposed with traffic flow mode coefficient and weather disturbance coefficient, and the traffic flow is converted into transmission capacity reservation ratio, so as to obtain the upper and lower thresholds close to the real scene, thereby quantifying the external traffic and weather impact into the expected interval, avoiding the magnification of the early peak flow or the rainstorm transmission, and significantly reducing the environmental false alarm; at the same time, whether the actual flow is long-term out of the interval is compared in the transmission layer to generate transmission quantity anomaly confidence, the semantic layer uses traffic field BERT to calculate 5min window event information entropy and compares it with the health period "semantic-flow conservation" benchmark to generate semantic anomaly confidence, and the topology layer uses DTW to measure the similarity of the target curve and the median curve in the 500m neighborhood, and if the similarity is less than 40%, it is considered as isolated to generate topology anomaly confidence, and through the cross verification of transmission quantity, semantic and topology three independent perspectives, different root causes such as "device false death", "traffic sudden drop" and "network island" can be distinguished, and single-dimensional missed detection and false positive can be significantly reduced; finally, the transmission quantity anomaly confidence, semantic anomaly confidence, topology anomaly confidence, device health state coefficient, environmental stress coefficient, traffic flow mode coefficient and weather disturbance coefficient are input into 128 LightGBM with depth of 5, and the comprehensive false death confidence Ctotal is output, when Ctotal≥0.75, the alarm is triggered, thereby realizing the online of unsupervised cold start, single-core reasoning <2ms, giving 0-1 probability result, and maintenance personnel can understand the contribution of each layer at a glance, and the troubleshooting time is greatly shortened; the whole realizes early perception, low false alarm, easy positioning, explainable and light computing device false death state comprehensive detection.

[0104] In a preferred embodiment, the dynamic performance baseline equation is represented as:

[0105]

[0106] wherein, represents the dynamic performance baseline of the target device at time t, is the initial performance baseline of the device, taking the 95th percentile of the highest transmission data of the device, is a device health state coefficient, updated online by an extended Kalman filter, is a seasonal compensation coefficient, obtained by comparing and fitting historical data, is an environmental stress coefficient, calculated by weighting and fusing temperature, humidity and vibration intensity data.

[0107] The working principle and beneficial effects of the above technical solution are as follows: taking the initial performance as the starting point, the product of the health coefficient and the environmental stress is used to lower the expectation in the exponential position in real time, so that the baseline smoothly decreases with the aging of the device, the increase of temperature and humidity, or the intensification of vibration, thereby quantifying the invisible degradation into a visible curve; at the same time, the annual sinusoidal term sin(2πt / 8760) is introduced to pre-compensate for the inherent fluctuations in spring, summer, autumn and winter, avoiding the seasonal false alarm of "low threshold in winter and high threshold in summer" — thereby realizing the simultaneous tracking of long-term aging, short-term environmental impact and annual cycle of the expected baseline, significantly reducing the false alarm and missed alarm caused by seasonal temperature difference or sudden heat and humidity of the traditional fixed threshold, and allowing the subsequent anomaly comparison to be always within a dynamic window that is "the same age as the device and synchronized with the weather".

[0108] In a preferred embodiment, the environmental stress coefficient is calculated by the following steps:

[0109] Determine the device cabinet temperature, humidity and vibration intensity data according to the environmental data;

[0110] Z-score normalization is performed on the cabinet temperature , environmental humidity and device vibration intensity :

[0111]

[0112] wherein, , , respectively represent the standardized temperature coefficient, the standardized humidity coefficient and the standardized vibration intensity coefficient, and the three denominators 50, 40 and 10 are engineering experience range values based on the device working limit;

[0113] Then, the weights corresponding to the standardized temperature coefficient, the standardized humidity coefficient and the standardized vibration intensity coefficient are determined by ridge regression fitting of the historical 30-day data, satisfying and all three weight terms are greater than 0, and finally the environmental stress coefficient is calculated:

[0114]

[0115] The working principle and beneficial effects of the technical solution are: through normalization, temperature, humidity and vibration are uniformly mapped to the interval [-1, 1], and the dimensional difference is eliminated; ridge regression stably estimates the weight in the collinearity scene, prevents overfitting, and makes E(t) quantify "how bad the environment is" - when any index of high temperature, high humidity or strong vibration rises, E(t) increases in real time, directly raises the dynamic baseline decay rate, so that the "expected transmission amount" is adjusted in real time according to the environmental stress, avoiding a large number of false positives caused by sudden heat and humidity or strong vibration in the traditional scheme, and realizing online, quantitative and robust compensation of environmental impact.

[0116] In a preferred embodiment, the discrete-time process of the extended Kalman filter for online updating of the device health state coefficient is as follows:

[0117] Device health state coefficient For theoretical modeling in the continuous time domain, when implemented in a digital system, it is discretely sampled at a frequency of once per hour, and updated at a fixed period, and its discrete representation is , denoted as the device health state coefficient at the hour in the discrete time domain;

[0118] Based on the state estimation at the last time 1, the prior state and prior estimation covariance at the current time are predicted:

[0119]

[0120]

[0121] , wherein is the prior state prediction value, is the prior estimation covariance, is the process noise covariance, representing the natural fluctuation amplitude of the health state coefficient;

[0122] At the current time , the observation value of the device health state is calculated :

[0123]

[0124] , wherein is the measured average data transmission amount, is the initial performance benchmark of the device;

[0125] Fusing the prior prediction and the current observation value, the posterior state estimation and the posterior estimation covariance at the current time are calculated:

[0126] The Kalman gain is calculated :

[0127]

[0128] wherein, is the environmental stress coefficient at the current time , is the observation noise covariance, representing the error level of the transmission measurement;

[0129] update the state estimation :

[0130]

[0131] update the estimation uncertainty :

[0132]

[0133] At the next update time, the and are taken as the new and are substituted into the prediction process of the prior state and the prior estimation covariance, and the cycle is executed.

[0134] The working principle and beneficial effects of the above technical solution are as follows: first, the health state coefficient α(t) obtained by theoretical modeling in the continuous time domain is discretely sampled at a fixed period of one hour, denoted as α K , the kth hour; then enter the "prediction-observation-update" closed loop: first, take α K ₋1 as the starting point, predict the prior state α K | K ₋1=α K ₋1 and the prior covariance P K | K ₋1=P K ₋1+Q, wherein the process noise covariance Q=1×10⁻ 8 , used to depict the natural random walk of the health state; then use the measured average data transmission and the initial performance benchmark to construct the observation value, and introduce the environmental stress coefficient in the observation equation to establish the mapping relationship that "the worse the environment, the more allowed speed drop"; through the Kalman gain (R=0.01 represents the measurement error), the optimal weighting is realized, and then α K =α K | K ⁻¹+K K ·[z K −α K | K ⁻¹·E(t K )] is used to correct the state estimation, and P K =(1−K K)·P K | K ⁻¹Compress uncertainty and iterate repeatedly. This enables the real-time distillation of "invisible aging + environmental impact" into a traceable health coefficient with extremely low computational cost (single step <0.2ms). This allows the expected baseline to smoothly decline with equipment degradation and to quickly adapt to sudden environmental deterioration. It avoids false alarms and false negatives caused by observation noise or seasonal changes in traditional threshold methods, and achieves online, unsupervised, and highly robust estimation of equipment health status.

[0135] In a preferred embodiment, step S3 includes:

[0136] The 24 hours of each day are divided into 96 15-minute quantum slices, each slice Mark the traffic flow pattern attributes and weather attributes of the target device's location, among which Traffic flow pattern attributes include weekday morning peak, evening peak, off-peak, night, and rest days; weather attributes are weather data obtained from the meteorological bureau for the location of the equipment.

[0137] Identify the same quantized slice over the past 30 days Historical average transmission volume: ,in, For the past 30 days, the same quantum slice The average data transmission volume of the 30 measurements taken there;

[0138] Based on the initial performance benchmark of the equipment Calculate traffic flow pattern coefficients:

[0139]

[0140] Using regression analysis, based on historical transmission data and meteorological data of the target device under healthy conditions, a perturbation matrix is ​​fitted to reflect the comprehensive impact of weather changes on the data transmission capability of the target device. The matrix elements represent the proportion of transmission capability retained relative to clear days.

[0141] Based on the transmission capacity retention ratio in the disturbance matrix of weather data, the weather disturbance coefficient is obtained by linear interpolation.

[0142] The upper and lower threshold ranges of the expected transmission volume are calculated using the following formula:

[0143]

[0144]

[0145] in, This represents the lower limit threshold of the expected transmission volume at time t. This represents the upper limit threshold of the expected transmission volume at time t. represents the dynamic performance benchmark of the target device at time t calculated based on the dynamic performance baseline, represents the traffic flow pattern coefficient, represents the weather disturbance coefficient.

[0146] The working principle and beneficial effects of the above technical solution are as follows: through "96 slices + double coefficient lookup table", an expected band synchronized with real-time traffic-weather is constructed: 24 hours are cut into 15-minute quantum slices tᵢ (i=1…96), each slice is automatically labeled with five traffic labels of "weekday morning peak / weekday evening peak / weekday flat peak / night / weekend", and is connected to the 1km grid live of the meteorological bureau, and is endowed with weather fields such as precipitation and visibility; the past 30-day same-period data of each slice tᵢ is traced back, the median median(L_data(tᵢ,last30days)) is taken, and the initial performance benchmark D0 is divided to obtain the traffic flow pattern coefficient K_traffic(tᵢ) — the peak median can reach 1.8, and the night is only 0.25, which intuitively quantifies the natural amplification or compression of "more or less cars" on the flow; the 30-day "hour-weather" bivariate sample in the healthy period is used to fit the 5x5 disturbance matrix M (precipitation x visibility, 25 grids) by ridge regression, and each grid is filled with "relative sunny retention ratio", and K_weather(t) is obtained by real-time R, V bilinear interpolation — sunny 1.0, heavy rain and fog can be up to 0.55; finally, the dynamic performance benchmark D_base(t) is multiplied by K_traffic(t) and K_weather(t) at the same time, and 0.5 times and 1.5 times are taken as the engineering experience band to generate [D_low(t), D_high(t)]. The expected interval is refreshed every minute according to the three variables of "time period-traffic-weather", and the early morning peak is automatically widened by 80%, and the heavy rain night is automatically narrowed by 45%, which eliminates the batch false alarm caused by "sunny threshold set for rainy day", so that the subsequent anomaly comparison always falls within the reasonable bandwidth of "this time, this place, this scene", which significantly improves the detection accuracy and reduces the operation and maintenance manpower review cost.

[0147] In a preferred embodiment, the calculation process of the semantic layer anomaly confidence includes:

[0148] In a 5-minute sliding window, continuously collect the business event logs of the target device to form the original event sequence;

[0149] The BERT-base model in the traffic field is used to encode each event text in the original event sequence, output the event semantic vector, and perform Softmax normalization on all event semantic vectors in the window to obtain the event probability distribution;

[0150] The window event information entropy is calculated to measure whether the semantics are chaotic:

[0151]

[0152] wherein, is the event probability distribution of the ith event, represents the total number of event texts within the original event sequence;

[0153] read the measured actual average data transmission volume of the device within the same window , calculate the semantic-flow product:

[0154]

[0155] take the average of the device's health status in the past 30 days as the conservation benchmark :

[0156]

[0157] calculate the semantic conservation deviation degree , quantify the degree of deviation from the healthy norm of the current window:

[0158]

[0159] According to the three-sigma law, set the first threshold value 0.3, when indicates semantic normal, semantic anomaly confidence , when trigger semantic anomaly, semantic anomaly confidence .

[0160] The working principle and beneficial effects of the technical solution are as follows: the business event logs of the target device are continuously collected within a 5-minute sliding window to form an original event sequence; a BERT-base model fine-tuned in the traffic field is used to encode each event text and output an event semantic vector, and then all vectors in the window are normalized by Softmax to obtain an event probability distribution; the window event information entropy is calculated to measure whether the semantics are chaotic, and the higher the entropy value, the more chaotic the event types; the average data transmission Ldata of the measured device in the same window is read, the semantic-flow product is calculated, and the average value of M in the past 30 days of healthy state is taken as the conservation benchmark; the semantic conservation deviation degree is calculated, the first threshold 0.3 is set according to the three-sigma law, when ∆S≤0.3, it is determined that the semantics are normal, C2=0, when ∆S>0.3, the semantic anomaly is triggered and C2=sigmoid(∆S−0.3), the “event chaos or not” and “high or low flow” are compared in the same conservation framework, and the deviation of 30% from the healthy state is smoothed to output a 0-1 confidence, which can not only capture early signs of “semantic collapse” such as dead loop spitting logs and protocol disorder, but also avoid false alarms caused by single event counting or pure text matching, realize soft decision, explainable and minute-level response semantic anomaly detection.

[0161] In a preferred embodiment, the calculation process of the topology layer anomaly confidence includes:

[0162] In the road section where the target device is located, the surrounding devices having a traffic flow correlation relationship are screened out as the neighborhood device set, with the upstream and downstream preset distance range or the same physical intersection as the spatial boundary;

[0163] For each pair of devices in the neighborhood device set , the Pearson correlation coefficient is calculated using the past 30-day hourly transmission curve , and the edge weight is given by the following formula:

[0164]

[0165] In the preset sliding window, the median curve of the transmission of all devices in the neighborhood is taken as the group normal waveform template ;

[0166] The optimal matching distance between the current window actual curve of the target device and the template is calculated by using the dynamic time warping algorithm;

[0167]

[0168] The distance is normalized to similarity:

[0169]

[0170] Set the second threshold 0.4, corresponding to the lower limit of three sigma, healthy samples , less than 3%;

[0171] Determine the topology anomaly confidence:

[0172]

[0173] The working principle and beneficial effects of the above technical solutions are: taking the target device as the center, screening the surrounding devices with traffic flow correlation within the preset distance (such as 500 m) or the same physical intersection, to form a neighborhood device set; for each pair of devices in the set, the Pearson correlation coefficient is calculated using the past 30-day hourly transmission volume curve, and an edge weight is assigned, the higher the Pearson correlation coefficient, the smaller the edge weight, indicating the stronger the traffic flow synchronicity; in the preset sliding window, take the median curve of all neighborhood device transmission volumes as the group normal waveform template, then use the dynamic time warping algorithm to calculate the optimal matching distance between the target device actual curve and the template, and normalize the distance to [0, 1] similarity; Set the second threshold 0.4 (corresponding to the lower limit of three sigma, healthy samples Sim<0.4, less than 3%), when Sim≥0.4, determine that the topology is normal, C3=0, when Sim<0.4, determine that the topology is abnormal and C3 = 1-Sim, use the physical knowledge that "the traffic flow curves of adjacent devices should be synchronized up and down", and quantify the shape deviation of the target device and the neighborhood group into 0-1 confidence, which can identify "island" events such as single machine crash and link interruption, and avoid false positives caused by intersection signal phase differences or short-term congestion, realize soft decision, high robustness and interpretable topology anomaly detection in spatial dimension.

[0174] In a preferred embodiment, the comprehensive coma confidence is obtained by:

[0175] Construct a 7-dimensional feature vector containing transmission volume anomaly confidence , semantic anomaly confidence , topology anomaly confidence , device health state coefficient , environmental stress coefficient , traffic flow pattern coefficient and weather disturbance coefficient : :

[0176]

[0177] Adopt LightGBM gradient boosting tree model containing 128 decision trees and maximum depth of 5 as the comprehensive decision model;

[0178] The 7-dimensional feature vector As a model input, the synthetic death confidence is output by the synthetic judgment model:

[0179]

[0180] Output synthetic death confidence .

[0181] The working principle and beneficial effects of the above technical solution are: seven big information of flow drop, log disorder, neighborhood synchronization, device age, environment, vehicle quantity, and weather are compressed into 0-1 probability, tree structure naturally supports feature importance visualization, maintenance personnel can directly see which layer contributes the most, and early perception, low false alarm, and explainable synthetic death judgment are easy to achieve.

[0182] Finally, it should be pointed out that the above preferred embodiments are only used to illustrate the technical solutions of the present application and are not limiting. Although the present application has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made in form and details without departing from the scope defined by the claims of the present application.

Claims

1. A method for detecting the apparent dead state of a comprehensive testing device, characterized in that, include: Step S1: Continuously collect performance data, service data, environmental data, and context data of the target device; Step S2: Based on the historical normal operation data of the equipment, construct a dynamic performance baseline equation that includes health status decay terms, environmental stress coefficients and seasonal compensation terms, and use an extended Kalman filter to update the equipment health status coefficients online in real time. Step S3: Divide time into quantum slices, and calculate the expected transmission volume threshold range in the current spatiotemporal context by combining the dynamic performance baseline, traffic flow pattern coefficient and weather disturbance coefficient; Step S4: Perform anomaly detection at the transport layer, semantic layer, and topology layer respectively, and generate their respective anomaly confidence scores; Step S5: Input the multi-dimensional anomaly confidence into the comprehensive judgment model and output the comprehensive false death confidence. If it exceeds the threshold, it is judged as a false death state. The dynamic performance baseline equation is expressed as: in, This represents the dynamic performance benchmark of the target device at time t. As the initial performance benchmark for the device, the 95th percentile of the device's highest transmitted data is used. The equipment health status coefficient is updated online using an extended Kalman filter. This is the seasonal compensation coefficient, obtained by fitting data from the same historical period. The environmental stress coefficient is calculated by weighted fusion of temperature, humidity, and vibration intensity data. The environmental stress coefficient Calculate using the following steps: Determine the temperature, humidity, and vibration intensity data of the equipment enclosure based on environmental data; chassis temperature Ambient humidity and equipment vibration intensity Perform Z-score normalization: in, , , These represent the standardized temperature coefficient, standardized humidity coefficient, and standardized vibration intensity coefficient, respectively. The three denominators, 50, 40, and 10, are engineering empirical range values, set based on the equipment's operating limits. Then, the weights corresponding to the standardized temperature coefficient, standardized humidity coefficient, and standardized vibration intensity coefficient were determined by fitting the historical 30-day data using ridge regression. ,satisfy Furthermore, all three weighting terms are greater than 0, and the final environmental stress coefficient is calculated. : Step S3 includes: The 24 hours of each day are divided into 96 15-minute quantum slices, each slice Mark the traffic flow pattern attributes and weather attributes of the target device's location, among which Traffic flow pattern attributes include weekday morning peak, evening peak, off-peak, night, and rest days; weather attributes are weather data obtained from the meteorological bureau for the location of the equipment. Identify the same quantized slice over the past 30 days Historical average transmission volume: ,in, For the past 30 days, the same quantum slice The average data transmission volume of the 30 measurements taken there; Based on the initial performance benchmark of the equipment Calculate traffic flow pattern coefficients: By using regression analysis, based on the historical transmission data and meteorological data of the target device in a healthy state, a perturbation matrix is ​​fitted to reflect the comprehensive impact of weather changes on the data transmission capability of the target device. The matrix elements represent the proportion of transmission capability retained relative to a clear day. Based on the transmission capacity retention ratio in the disturbance matrix of weather data, the weather disturbance coefficient is obtained by linear interpolation. The upper and lower threshold ranges of the expected transmission volume are calculated using the following formula: in, This represents the lower limit threshold of the expected transmission volume at time t. This represents the upper limit threshold of the expected transmission volume at time t. This represents the dynamic performance baseline of the target device at time t, calculated based on the dynamic performance baseline. Represents traffic flow pattern coefficients. Indicates the weather disturbance coefficient; The calculation process for semantic layer anomaly confidence includes: Within a 5-minute sliding window, continuously collect the business event logs of the target device to form the original event sequence; The BERT-base model, fine-tuned for the transportation domain, is used to encode each event text in the original event sequence, outputting an event semantic vector. Softmax normalization is then applied to all event semantic vectors within the window to obtain the event probability distribution. Calculate window event information entropy To measure whether the semantics are confusing: in, Let be the probability distribution of the i-th event. This indicates the total number of event text entries within the original event sequence; Read the actual average data transfer volume of the device measured within the same window. Calculate the semantic-flow product: Take the device's health status over the past 30 days. Mean as a conservation benchmark : Calculate semantic conservation bias Quantify the degree to which the current window deviates from the healthy norm: According to the three-sigma law, the first threshold is set at 0.

3. Indicates the confidence level of semantically normal and semantically abnormal. ,when Triggering semantic anomalies, semantic anomaly confidence level ; The calculation process for the topology layer anomaly confidence score includes: In the road segment where the target device is located, using the upstream and downstream preset distance range or the same physical intersection as the spatial boundary, surrounding devices with traffic flow correlation are screened out to form a neighborhood device set; For each pair of devices within the neighboring device set The Pearson correlation coefficient was calculated using the hourly transmission volume curve over the past 30 days. , border rights Given by the following formula: Within a preset sliding window, the median curve of the transmission volume of all devices in the neighborhood is taken as the template for the normal waveform of the group. ; The dynamic time warping algorithm is used to calculate the actual curve of the current window of the target device. With template The optimal matching distance; Normalize the distance to Similarity: A second threshold of 0.4 is set, corresponding to three times the lower sigma limit, for healthy samples. The proportion is less than 3%; Determine the confidence level of topological anomalies: The overall confidence level for apparent death is obtained in the following way: Construct confidence scores including transmission volume anomalies Semantic anomaly confidence Topological anomaly confidence Equipment health status coefficient Environmental stress coefficient Traffic flow pattern coefficient and weather disturbance coefficient 7-dimensional feature vectors : The LightGBM gradient boosting tree model, which contains 128 decision trees and has a maximum depth of 5, is used as the comprehensive decision model. 7-dimensional feature vectors As input to the model, the overall false death confidence level is determined by the comprehensive judgment of the model output: Output the overall confidence level of the apparent death. .

2. The method for detecting the apparent dead state of a comprehensive testing equipment according to claim 1, characterized in that, The discrete-time process for the extended Kalman filter to update the device health status coefficients online is as follows: Equipment health status coefficient To achieve theoretical modeling in the continuous time domain, the digital system is implemented by discretizing the data once per hour and updating it at a fixed period. Its discretized representation is as follows: , denoted as the i-th in the discrete time domain The equipment health status coefficient for each hour; Based on the previous moment 1. State estimation, predicting the current moment. The prior state and the prior estimate covariance: in, These are the predicted values ​​of the prior state. To estimate the covariance a priori, The process noise covariance characterizes the natural fluctuation range of the equipment health status coefficient. At the present moment Calculate the observed values ​​of the equipment health status. : in, The measured average data transmission volume, This serves as the initial performance baseline for the device. By combining prior predictions and current observations, the current time can be calculated. The posterior state estimate and the posterior estimate covariance: Calculate Kalman gain : in, For the current moment Environmental stress coefficient, To observe the noise covariance and characterize the error level of the transmission quantity measurement; Update state estimation : Updated estimate of uncertainty : In the next update, and As a new and The prediction process, which substitutes the prior state and the prior estimated covariance, is executed iteratively.

Images