A wide-area monitoring combined risk prediction method and system

Abstract

The application discloses a wide-area monitoring combined risk prediction method and system, obtains video streams, environment data and equipment state information from multiple source heterogeneous sensors, and carries out standardization processing; a visual-language large model is used to analyze video frames, and natural language description of events is generated; based on historical normal operation data, an event causal diagram is constructed unsupervised, and online evolution is supported; according to a current abnormal event set, a two-hop risk diffusion mechanism is used to quantize combined risk; when the combined risk value exceeds an adaptive threshold value, structured early warning information is generated and pushed. The application realizes end-to-end prediction of combined risk which is independent of expert rules, independent of accident annotation and supports multiple source heterogeneous inputs.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent security and risk prediction, and particularly relates to a wide-area monitoring combined risk prediction method and system based on a vision-language large model and a dynamic causal diagram, which is suitable for a safety management system of a closed or semi-closed place (such as a production operation place, a small watershed comprehensive management area, a large construction site, a hydropower station, a park, a campus, etc.) that is deployed with video, environment and device state sensing capabilities. BACKGROUND

[0002] With the deepening of intelligent security construction, the current mainstream monitoring system generally adopts a "cloud-edge-end" collaborative architecture: edge devices (such as intelligent cameras, environmental sensors, access control controllers) are responsible for real-time collection and preliminary analysis, and the cloud platform aggregates multi-source data to provide a global view. However, major security risks in actual operation are often not caused by a single device failure, but by the coupling, interaction and even amplification of multiple seemingly isolated abnormal events under certain conditions, resulting in combined risks. Compound risk refers to the coupling of two or more independent risk factors in a specific space-time, resulting in a significantly higher overall risk than the sum of each factor acting alone.

[0003] The current wide-area monitoring system mainly relies on the following three types of technical strategies to identify combined risks (i.e., systemic risks caused by the coordination of multiple abnormal events): correlation engines based on expert rules, multi-alarm fusion methods based on statistical learning, and semantic perception methods based on vision-language large models (VLM) that have emerged in recent years. However, these three strategies have significant shortcomings in terms of dynamicity, causality and engineering deployability, making it difficult to meet the real-time combined risk prediction needs in complex engineering scenarios.

[0004] (1) Correlation engine based on expert rules: static, difficult to maintain

[0005] Early systems generally use a pre-set rule base (such as "access control offline + video obstruction → illegal intrusion") to correlate events. This method relies on human experience and cannot cover unknown abnormal combinations (such as "rain gauge offline + turbidity surge + power fluctuation"), and the rule maintenance cost is extremely high in dynamic environments such as water conservancy and construction sites, and is prone to missed reports in the face of new coupling patterns.

[0006] (2) Multi-alarm fusion based on statistical learning: only correlation, no causal inference

[0007] Some platforms use clustering, association rule mining (such as Apriori), or weighted scoring mechanisms to determine the "co-occurrence frequency" or "number of superposition" of multi-source alarms. However, such methods only capture statistical correlations and cannot distinguish between cause and effect directions (such as A→B or B→A), making it difficult to model "nonlinear amplification effects" - that is, three low-risk anomalies coupled together may produce high systemic risk. The output of these methods is usually a black box score, lacking in interpretability and business guidance value.

[0008] (3) Semantic perception based on visual-linguistic large models (VLM): stronger than single-point understanding, weaker than system deduction

[0009] In recent years, with the development of artificial intelligence, some city-level platforms have introduced visual-linguistic large models (such as CLIP, Qwen-VL, LLaVA, etc.) to convert video streams into natural language events (such as "person gathering" and "camera obstruction"), significantly improving the semantic understanding ability of single-point events. Visual-linguistic large models are a class of multi-modal artificial intelligence systems that can understand both image content and natural language. Their core ability is to align visual signals with semantic concepts, enabling cross-modal reasoning from pixels to human-readable text.

[0010] Representative models include OpenAI's CLIP, Google's ALIGN, Salesforce's BLIP-2, Alibaba's Qwen-VL, Microsoft's joint UW-Madison's LLaVA, Shanghai Artificial Intelligence Laboratory's InternVL, and DeepMind's Flamingo. These models are pre-trained on large-scale image-text pairs, enabling cross-modal mapping from pixels to natural language, and perform well in image classification, image-text retrieval, and event preliminary screening tasks.

[0011] However, such methods still have fundamental limitations:

[0012] Only processing video single modal, rarely integrating structured data such as device status and environmental sensing;

[0013] Output is a static semantic label, unable to adapt to new anomaly combinations online;

[0014] Lack of causal modeling ability, unable to deduce the dependence and propagation path between events;

[0015] High computational overhead, difficult to implement second-level risk diffusion on cloud platforms.

[0016] In summary, neither traditional rule engines, statistical fusion, nor emerging large model semantic perception can establish a dynamic causal deduction mechanism from multi-source anomalies to combined risks. SUMMARY

[0017] Invention purposes: In view of the problems and deficiencies in the prior art, the present application provides a wide-area monitoring combined risk prediction method and system based on visual-linguistic large model and dynamic causal diagram, to solve the limitations of existing monitoring systems in combined risk identification. The present application realizes end-to-end prediction of combined risk by unsupervised construction of dynamic causal diagram + lightweight two-hop risk diffusion, without relying on expert rules, without relying on accident annotation, and supporting multi-source heterogeneous input, effectively filling the gap in the prior art. Currently, there is no public scheme that simultaneously has the complete technical chain of "VLM semantic event + dynamic causal diagram + two-hop combined risk deduction + cloud native deployment".

[0018] Technical scheme: A wide-area monitoring combined risk prediction method, comprising the following steps:

[0019] Step 1, data acquisition and preprocessing: obtaining video stream, environmental data and device state information from multi-source heterogeneous sensors, and performing standardization processing;

[0020] Step 2, semantic understanding: using a visual-linguistic large model to analyze video frames and generate natural language descriptions of events;

[0021] Step 3, dynamic causal diagram construction and update: based on historical normal operation data, unsupervised construction of event causal diagram, and support for online evolution;

[0022] Step 4, combined risk value calculation: according to the current set of abnormal events, quantifying the combined risk through a two-hop risk diffusion mechanism;

[0023] Step 5, generating an early warning: when the combined risk value exceeds the adaptive threshold, generating structured early warning information and pushing it.

[0024] In step 2, event semantic vectorization, using a visual-linguistic large model to analyze video frames and generate natural language descriptions of events;

[0025] Let the natural language description of the i-th abnormal event be Through the visual-linguistic large model , it is mapped to a semantic vector:

[0026]

[0027] Where is a d-dimensional semantic vector used for causal diagram node initialization. is a d-dimensional real number vector space; d

[0028] is the event index, ​​​where is the total number of abnormal events detected within the current time window.

[0029] In step 3, in the dynamic causal graph construction, based on the abnormal event stream within the sliding time window , an unsupervised causal discovery algorithm is used to construct a directed graph , the edge weight in the directed graph represents the event causal strength of the event . respectively: graph, vertex set, edge set; represents the index of the cause event, corresponding to the semantic vector , representing a node in the graph; j represents the index of the result event, corresponding to the semantic vector , representing another node in the graph; is the edge weight of the directed edge from node i to node j , indicating "to what extent can event i cause event j "; if : no causal relationship; if : strong causal drive; Each node is a semantic vector of an event. , is a threshold value, such as 0.1.

[0030] In step 4, the combined risk value calculation (two-hop risk diffusion), assuming that the set of abnormal events detected at the current time is , and its initial risk value is:

[0031]

[0032] The propagation risk is calculated by two-hop causal diffusion:

[0033]

[0034]

[0035] The final combined risk value is the weighted sum:

[0036]

[0037] The superscripts (0), (1), (2) represent "stages" rather than variables; the upper limit of the summation should be the total number of events n (not just events in α, β, γ ), ensuring full graph diffusion.: attenuation coefficient (scalar), representing the i abnormal event.

[0038] In step 5, the adaptive threshold determines the combined risk early warning trigger condition:

[0039]

[0040] wherein: is a threshold function, is a sliding mean value of the historical combined risk value; is a sliding standard deviation; is a sensitivity parameter (default ).

[0041] The application also provides a wide-area monitoring combined risk prediction system, comprising the following modules:

[0042] A data acquisition module: used for acquiring video streams, environmental data and device state information from edge devices (multi-source heterogeneous sensors), and performing standardized processing;

[0043] A semantic understanding module: using a visual-linguistic large model to analyze video frames and generate natural language descriptions of events;

[0044] A dynamic causal diagram engine: based on historical normal operation data, an event causal diagram is constructed unsupervised, and online evolution is supported;

[0045] A risk deduction module: according to the current set of abnormal events, two-hop risk diffusion calculation is performed;

[0046] An early warning management module: when the combined risk value exceeds the adaptive threshold, structured early warning information is generated and pushed. According to the comparison result of the combined risk value and the threshold function , an early warning is generated.

[0047] The system implementation process is the same as the method, and will not be repeated here.

[0048] A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor executes the above-mentioned computer program to realize the steps of the wide-area monitoring combined risk prediction method as described above.

[0049] A computer readable storage medium having a computer program / instruction stored thereon, wherein the computer program / instruction is executed by a processor to realize the steps of the wide-area monitoring combined risk prediction method as described above.

[0050] Beneficial effects: Compared with the prior art, the present application can accurately capture scene information through multi-source data collection and processing. The visual-language large model, dynamic causal diagram engine, risk deduction module and early warning management module proposed by the present application can accurately discover and warn combined risks. The present application has performance advantages in preventing wide-area monitoring combined risks. In addition, the method proposed by the present application supports high-availability and scalable wide-area monitoring services, ensuring that the system can efficiently complete multi-source heterogeneous data fusion, combined risk prediction and structured early warning generation without the need for self-built machine rooms, and has good engineering landing and cross-scene promotion value. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 is a system structure diagram in specific embodiments;

[0052] Figure 2 is a method flowchart in specific embodiments. DETAILED DESCRIPTION

[0053] The present application will be further illustrated below in conjunction with specific embodiments, and it should be understood that these embodiments are only used to illustrate the present application and not to limit the scope of the present application. After reading the present application, those skilled in the art can modify various equivalent forms of the present application, which all fall within the scope defined by the claims attached hereto.

[0054] The wide-area monitoring combined risk prediction system is realized based on a cloud-edge-end collaborative architecture, and is independently designed and developed by the applicant as an Independent Software Vendor (ISV), and does not depend on specific hardware manufacturers. Unlike self-developed cloud or private cloud infrastructure, such as Figure 1As shown, the system is uniformly deployed on a third-party public cloud platform (such as Ali Cloud, Huawei Cloud). In a typical cloud service ecosystem, the cloud vendor provides virtual machines, containers, storage, and other infrastructure as a service (IaaS), while the ISV is responsible for the implementation and deployment of the upper-layer application logic. Among them, the "end" side is an intelligent sensing terminal deployed at water conservancy sites, along roads, or construction sites, responsible for collecting video streams, environmental sensing data, and device status logs; the "edge" side is a regional edge gateway that performs key frame extraction, data cleaning, and local caching; the "cloud" side includes unified access services, visual-language large model inference engines, dynamic causal graph construction modules, and early warning generation centers, and other core software components, which are independently developed by the applicant and deployed in the form of an application program in virtual machines or container instances provided by the public cloud platform. The above cloud service runs on a general x86 server cluster in the cloud vendor's data center, communicates with edge devices through standard network protocols, and the physical infrastructure is operated and maintained by the cloud service provider, while all business logic and risk prediction algorithms are implemented by the present application. This mode fully leverages the advantages of ISV in industry algorithm and system integration, combined with the elastic resource capabilities of cloud vendors, supports high-availability, scalable wide-area monitoring services, and ensures that the system efficiently completes multi-source heterogeneous data fusion, combined risk prediction, and structured early warning generation without the need for self-built machine rooms, with good engineering landing and cross-scenario promotion value.

[0055] As shown in Figure 1 , the wide-area monitoring combined risk prediction system, the system faces wide-area monitoring scenarios such as water conservancy, construction sites, and campuses, and includes the following modules:

[0056] Data acquisition module: used to obtain multi-source data streams from edge devices (including video cameras, environmental sensors, and device status monitors), including video streams, environmental data, and device status information, and to perform standardized processing;

[0057] Semantic understanding module: calls a visual-language large model to analyze the input video frames and outputs a natural language description of the event;

[0058] Dynamic causal graph engine: based on historical normal data, constructs an event causal graph unsupervisedly and supports online updating of the directed graph ;

[0059] Risk inference module: performs two-hop risk diffusion calculation based on the current set of abnormal events and outputs a combined risk value ;

[0060] Early warning management module: generates structured early warning information and pushes it when the combined risk value exceeds the adaptive threshold. Generates an early warning based on the comparison result of the combined risk value and the threshold function , and if , generate structured early warning (including events, level, recommendations).

[0061] As shown in Figure 2 , the wide-area monitoring combined risk prediction method comprises the following steps:

[0062] Step 1, data acquisition and preprocessing: obtain video stream, environmental data and equipment state information from multiple source heterogeneous sensors, and perform standardization processing.

[0063] Step 2, semantic understanding: input video frames to visual-language large model ; output natural language description of events .

[0064] Step 3, dynamic causal diagram construction and update: based on historical normal operation data, unsupervised construction of event causal diagram, and support for online evolution;

[0065] Based on the historical normal event stream in the sliding time window; unsupervised learning to construct the causal diagram ; online receiving new events, updating edge weight .

[0066] Step 4, combined risk value calculation: according to the current abnormal event set, quantifying the combined risk through two-hop risk diffusion mechanism;

[0067] Initialize the abnormal event set ; execute two-hop risk diffusion:

[0068] ; ; .

[0069] Step 5, early warning generation: when the combined risk value exceeds the adaptive threshold, generate structured early warning information and push.

[0070] Adaptive threshold determination: calculate , judge whether it is greater than , if not, no operation, if greater, generate and push structured early warning.

[0071] One embodiment of the wide-area monitoring combined risk prediction system comprises:

[0072] (1) Data acquisition module

[0073] For wide-area monitoring scenarios such as water conservancy and construction sites, three types of heterogeneous data are collected from the edge: video streams (such as RTSP video), environmental sensor data (such as time-series values ​​of rainfall, water level, turbidity, etc.), and device status logs (such as camera online status, power supply voltage, and communication latency). All data carries a high-precision timestamp (UTC, accuracy ≤100ms) for subsequent cross-modal alignment.

[0074] On the edge device or edge gateway side, preliminary preprocessing is first performed: key frames are extracted from the video stream as needed (1 frame every 5 seconds by default) and scaled to a uniform resolution; sensor and status data are accessed via Modbus, MQTT or HTTP protocols, filtered for outliers (such as removing water level readings that exceed twice the historical standard deviation) and interpolated for missing values, and then compressed together with video metadata (using Gzip and JPEG quality 80%), and securely uploaded to the cloud platform via MQTT over TLS or HTTPS.

[0075] A unified access service is deployed in the cloud to receive data streams from multiple edge nodes and buffers and smooths out peak loads using a Kafka message queue. The system uses a 10-second basic time window to aggregate video frame links, sensor values, and status information from the same device within the same window into a standardized event package. This package includes structured data objects containing the start time of the time window, device identifier, video frame storage address, sensor readings, and device operating status. Invalid or expired data (e.g., timestamp deviations exceeding 5 minutes) is discarded during this stage.

[0076] Standardized event packets are written in real-time to a time-series database (such as TDengine) for querying and distributed to downstream semantic understanding modules via an internal message bus. Simultaneously, raw video frames and complete logs are archived to object storage. The entire data chain supports resume transmission after network outages; edge devices locally cache the most recent hour of data and automatically retransmit it upon network recovery, ensuring data integrity. The cloud-side service can be deployed on general-purpose cloud servers (such as 4 vCPU / 16 GB RAM instances), relying on basic components including a Java runtime environment, Kafka client, Python data processing libraries, and a secure transmission protocol stack. Highly reliable, low-latency multi-source data fusion input can be achieved without dedicated hardware.

[0077] (2) Semantic understanding module

[0078] (21) Basic principles and functional positioning

[0079] The semantic understanding module utilizes a visual-linguistic large model (VLM) to convert raw video frames into human-readable natural language event descriptions, achieving cross-modal mapping from "pixels" to "semantics". This module does not rely on predefined alert rules, but rather utilizes open-vocabulary understanding capabilities to identify complex or never-before-seen abnormal patterns such as "person loitering around the gate station" and "camera lens dust", providing a unified semantic input for subsequent risk analysis.

[0080] (22) Processing flow and implementation

[0081] The core goal of the semantic understanding module is to automatically identify early warning events related to operational safety (such as "river water level approaching warning line", "cracks appearing around the foundation pit", and "construction personnel not wearing safety helmets") from surveillance videos, providing high-level semantic input for combined risk prediction. After receiving key video frames from the data acquisition module, the system first normalizes their resolution (e.g., scaling to 448x448) and then inputs them into a pre-trained visual-linguistic large model for semantic analysis. The Qwen-VL-Chat model, which is open-source and supports Chinese, is recommended as it can directly generate free-text event descriptions (e.g., "people gathering near the gate station" or "there is obvious standing water on the road"). Alternatively, the CLIP model can be used in conjunction with a pre-set candidate label set (e.g., ["normal", "slope slip signs", "distribution box smoke", "video stuttering", "lens obstruction"]) to select the most matching label by calculating the image-text similarity.

[0082] At the same time, the system integrates a lightweight image quality assessment algorithm as an auxiliary judgment: if there is no significant change in consecutive multiple frames, it is determined to be "video stuttering"; if the BRISQUE blur score exceeds the pre-set threshold, it is labeled as "picture blur". Finally, the module outputs standardized event objects, including event descriptions, confidence levels, timestamps, and device identifiers, for use by the downstream risk deduction module.

[0083] (23) Cloud platform deployment and operating environment

[0084] The semantic understanding module is deployed in the form of a microservice on a cloud platform GPU instance (i.e., a virtual computing resource provided by a cloud service provider such as Alibaba Cloud, equipped with a graphics processing unit (GPU), suitable for deep learning inference tasks; for example, an instance configured with an NVIDIA A10 graphics card, 8 virtual CPU cores, and 32 GB of memory). The module relies on open-source software libraries such as PyTorch, Transformers, and OpenCV, and after starting, it receives image requests pushed by the unified access service through a standard HTTP interface (a network communication method based on the Hypertext Transfer Protocol). After inference by the vision-language large model, the natural language description of the event is returned, including the structured results of the event description, confidence, and other fields. The entire service supports Docker containerization packaging and can be deployed on a Kubernetes orchestration platform to achieve on-demand elastic scaling and effectively cope with high-concurrency access pressure in wide-area monitoring scenarios.

[0085] (4) Dynamic causal graph engine

[0086] The system includes a dynamic causal graph engine, which is implemented based on an unsupervised causal discovery algorithm (such as NOTEARS), but supports online evolution in wide-area monitoring scenarios through a sliding time window mechanism and an incremental update strategy.

[0087] (41) Basic concepts of causal graph

[0088] The dynamic causal graph is a directed graph structure used to represent the causal dependency relationship between events: the nodes represent standardized event types (such as "rainfall increase"), the directed edges represent the causal direction, and the edge weights quantify the causal strength (values 0-1). This graph is constructed unsupervised based on historical normal operation data, does not require expert rules, and can continuously evolve with new data, making it suitable for scenarios such as water conservancy where the operation mode slowly drifts.

[0089] (42) Construction and update mechanism

[0090] The system takes the normal event stream within a sliding time window (such as the last 30 days) as input, aligns the events by 10-second windows to form multivariate time series. The unsupervised causal discovery algorithm NOTEARS is used to learn the initial causal structure from time series data, outputting the causal weight matrix between events.

[0091] When new events continuously flow in, the system periodically (e.g., every hour) detects whether the data distribution has a significant deviation (through the Kolmogorov-Smirnov test); if the deviation exceeds the threshold, an incremental update is triggered: only the affected subgraph is reconstructed, avoiding full graph reconstruction, ensuring efficiency. For example, in the water conservancy scenario, the system can automatically learn the causal chain of "rainfall increase → water level rise → gate opening increase → downstream turbidity rise" and dynamically adjust the weights of each link.

[0092] (43) Cloud deployment and data management

[0093] The causal graph engine is deployed on a general CPU type cloud server (refers to a standard virtual machine provided by a cloud vendor's data center, with a central processing unit (CPU) as the main computing unit, without the need for special acceleration hardware; for example, an instance with a configuration of 4 vCPU / 16 GB RAM), and its running environment relies on open source algorithm libraries such as NumPy, Pandas, and NOTEARS for performing causal structure learning and updating. The completed dynamic causal graph is stored in a database in JSON format (JSON is a lightweight data exchange format, facilitating structured reading and writing; "persistent storage" refers to long-term storage of data in a relational or document-oriented database to prevent data loss due to service restart), including node list, directed edge weight, and latest update timestamp. At the same time, this module subscribes to the real-time event stream output by the semantic understanding module through a message queue (such as Kafka or RabbitMQ, an asynchronous decoupling message middleware), triggering incremental evolution of the causal graph. Its design is not bound to specific risk prediction logic, and can serve as a general causal knowledge base, flexibly supporting upper-level analysis applications in various monitoring scenarios such as water conservancy and road.

[0094] (5) Risk inference module

[0095] The risk inference module, as the core analysis unit of the system, runs in the form of an application on a general CPU instance on the cloud platform, relying on numerical calculation libraries such as NumPy and Pandas, and receives structured event streams from the dynamic causal graph engine and the semantic understanding module, achieving millisecond-level risk inference.

[0096] When the system receives a new abnormal event, it performs risk diffusion inference based on the current dynamic causal graph, quantifying the systemic risk caused by the coordination of multiple sources of abnormalities. The specific process is as follows:

[0097] First, abnormal events are mapped to nodes in the causal graph and assigned an initial risk value (usually set to 1.0 or weighted based on confidence). Second, two-hop risk propagation is performed along the directed edges of the causal graph: the first hop propagates direct causal impact, and the second hop propagates indirect cascading effects, with risk contribution attenuated by edge weights at each hop. Then, the combined risk value is obtained by weighted summation of the risk values of affected nodes , where

[0098]

[0099] is the initial abnormal risk, and are one-hop and two-hop propagated risks, respectively, and satisfy (defaultly take ).

[0100] The system uses an adaptive threshold for early warning judgment, which is dynamically calculated based on the sliding mean and standard deviation of historical combined risk values:

[0101]

[0102] where and are the sliding mean and standard deviation of the past 24 hours, is a sensitivity parameter (default 1.5) that can be adjusted according to the scene. If the current combined risk value

[0103] , the early warning mechanism is triggered; otherwise, only log is recorded, no alarm. For example, in a construction site, the system detects “tower crane video blur”, “foundation pit displacement out of limits”, “distribution box high temperature”. According to the dynamic causal graph, the combined risk value is calculated, if exceeds the set threshold, an early warning information is generated and pushed to the operation and maintenance platform.

[0104] (6) Early warning management module

[0105] When the combined risk value exceeds the adaptive threshold , the system automatically generates a structured early warning information and pushes it to the relevant operation and maintenance personnel through multiple channels. This early warning information contains the following core elements:

[0106] (61) Abnormal event list: standardized event description output by the semantic understanding module (such as “tower crane video blur” “foundation pit displacement out of limits”);

[0107] (62) Combined risk level: according to​​ The interval is divided into three levels of "low", "medium" and "high" (for example: Low, Medium, High);

[0108] (63) Risk cause analysis: extract the main transmission path based on dynamic causal diagram (such as "high temperature of distribution box may cause abnormal power supply of video");

[0109] (64) Suggested countermeasures: combined with the preset knowledge base, recommend disposal actions according to the scene (such as "check the slope support", "review the power supply line", "start emergency drainage").

[0110] The warning content is dynamically filled in natural language templates to ensure that the semantics are smooth and have business guidance. For example, for the construction site case, the system outputs:

[0111] "Detecting that the tower crane video is blurred, the foundation pit displacement alarm, the distribution box is high temperature, the combined risk level is high, please check the drainage system, slope stability and on-site power safety immediately."

[0112] The generated warning information is issued through a multi-channel cooperative pushing mechanism:

[0113] High-risk events (level "high"): trigger SMS, APP pop-up window and email alarm at the same time to ensure timely reach;

[0114] Low-risk events: only push to the operation and maintenance APP message center to avoid excessive disturbance.

[0115] The pushing strategy supports configuration according to roles, regions, and device types, for example, a water reservoir administrator only receives hydrological related warnings, and a power patrol employee only receives power distribution related alarms. All warning records are stored in a log database for subsequent review and causal diagram optimization.

[0116] One embodiment of the wide-area monitoring combined risk prediction method includes:

[0117] Step 1, data acquisition and preprocessing: obtain video streams, environmental data and device state information from multiple heterogeneous sensors, and perform standardization processing;

[0118] Step 2, semantic understanding: use a visual-language large model to analyze video frames and generate natural language descriptions of events;

[0119] Let the natural language description of the first abnormal event be , the visual-language large model is mapped to a semantic vector:

[0120]

[0121] wherein is a semantic vector for causal graph node initialization. is d a d-dimensional real number vector space;

[0122] : event index, wherein is the total number of abnormal events detected within the current time window.

[0123] Step 3, dynamic causal graph construction and update: based on historical normal operation data, unsupervised construction of event causal graph, and support for online evolution;

[0124] Based on the abnormal event stream within the sliding time window , an unsupervised causal discovery algorithm is used to construct a directed graph , the edge weight of the directed graph represents the causal strength of event to event . respectively represent: graph, vertex set, edge set; represents the index of the cause event, corresponding to the semantic vector , representing a certain node in the graph; j represents the index of the result event, corresponding to the semantic vector , representing another node in the graph; is the edge weight, from node i to node j , representing "to what extent can event i cause event j " ; if : no causal relationship is considered; if : it represents a stronger causal drive; Each node is a semantic vector of an event. , is a threshold value, such as 0.1.

[0125] Step 4, combined risk value calculation: according to the current abnormal event set, the combined risk is quantified through a two-hop risk diffusion mechanism; let the set of abnormal events detected at the current time be , and its initial risk value is:

[0126]

[0127] The propagation risk is calculated by two-hop causal diffusion:

[0128]

[0129]

[0130] Final combined risk value is the weighted sum:

[0131]

[0132] Superscripts (0), (1), (2) denote "phases" rather than variables; summation upper limits should be total number of events n (not just intermediate events), ensuring full-graph diffusion; α, β, γ : decay coefficient (scalar), denotes the i th abnormal event.

[0133] Step 5, alert generation: when the combined risk value exceeds the adaptive threshold, generate structured alert information and push.

[0134] Adaptive threshold determination, combined risk alert triggering condition is:

[0135]

[0136] where: is the threshold function, is the sliding mean of historical combined risk values; is the sliding standard deviation; is the sensitivity parameter (default ).

[0137] See Table 1 and Table 2 for symbol explanations involved in the formulas in the method.

[0138] Table 1 Symbol explanation table

[0139]

[0140] Note: all summation ranges i,j,k = 1 to n refer to the total number of nodes in the causal graph (i.e., the total number of event types or instances); in actual implementation, only non-zero n and its neighborhood nodes can be calculated sparsely to improve efficiency. Table 2 Symbol explanation table

[0141]

[0142]

[0143] ​Obviously, those skilled in the art should understand that each step of the wide-area monitoring combined risk prediction method of the above-mentioned embodiments of the present application or each module of the wide-area monitoring combined risk prediction system can be realized by a general computing device, which can be centralized on a single computing device or distributed on a network composed of multiple computing devices, and optionally, each step or each module can be realized by program codes executable by the computing device, so that each step or each module can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in different orders, or each step can be made into an individual integrated circuit module, or multiple modules or steps can be made into a single integrated circuit module. Thus, the embodiments of the present application are not limited to any specific combination of hardware and software.

Claims

1. A method for predicting combined risks through wide-area monitoring, characterized in that, Includes the following steps: Step 1, Data Acquisition and Preprocessing: Acquire video streams, environmental data, and device status information from multi-source heterogeneous sensors, and perform standardized processing; Step 2, Semantic Understanding: Use the visual-language big model to parse video frames and generate natural language descriptions of events; Step 3, Dynamic Cause-Effect Graph Construction and Update: Based on historical normal operation data, an unsupervised cause-effect graph of events is constructed and online evolution is supported; Step 4, Combined Risk Value Calculation: Based on the current set of abnormal events, the combined risk is quantified through a two-hop risk diffusion mechanism; Step 5, Warning Generation: When the combined risk value exceeds the adaptive threshold, a structured warning message is generated and pushed out; In step 2, the event semantics are vectorized, and the video frames are parsed using a large vision-language model to generate a natural language description of the event. Let the first The natural language description of an abnormal event Through the visual-language big model Mapped to semantic vectors: in for A 3D semantic vector is used for initializing causal graph nodes; for d 3D real vector space; It is an event index. ,in This represents the total number of abnormal events detected within the current time window. In step 3, the construction of the dynamic cause-effect graph is based on the abnormal event flow within the sliding time window. An unsupervised causal discovery algorithm is used to construct a directed graph. Edge weights in a directed graph Indicates an event Regarding the event The causal strength; They represent: graph, vertex set, and edge set, respectively. and Indicates an event and events semantic vector; As edge weight, from node i Pointing to node j The directed edge weights, representing "events" i To what extent could the event have occurred? j ”; A graph is a set of nodes, where each node is a semantic vector of an event; , The threshold value is used.

2. The wide-area monitoring combined risk prediction method according to claim 1, characterized in that, In step 4, the combined risk value is calculated, assuming that a set of abnormal events is detected at the current moment. The initial risk value is: Calculate propagation risk using two-hop causal diffusion: Final portfolio risk value For weighted sum: This represents the one-hop propagation risk value of node j. This represents the two-hop propagation risk value of node k; the upper bound of the summation is the total number of events. n To ensure full map coverage; α, β, γ The attenuation coefficient is... Indicates the first i An abnormal event.

3. The wide-area monitoring combined risk prediction method according to claim 1, characterized in that, In step 5, the adaptive threshold determination and the combined risk warning triggering conditions are as follows: in: For threshold function, This is the moving average of the historical portfolio risk values; The moving standard deviation; This refers to the sensitivity parameter.

4. A system for implementing the wide-area monitoring combined risk prediction method as described in claim 1, characterized in that, Includes the following modules: Data acquisition module: Used to acquire video streams, environmental data and device status information from multi-source heterogeneous sensors, and perform standardized processing; Semantic understanding module: Uses a large vision-language model to parse video frames and generate natural language descriptions of events; Dynamic cause-effect graph engine: Based on historical normal operation data, it constructs event cause-effect graphs in an unsupervised manner and supports online evolution; Risk simulation module: Performs two-hop risk propagation calculation based on the current set of abnormal events; Early warning management module: When the combined risk value exceeds the adaptive threshold, a structured early warning message is generated and pushed.

5. A computer device, characterized in that: The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the wide-area monitoring combined risk prediction method as described in any one of claims 1-3.

6. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that: When the computer program / instruction is executed by the processor, it implements the steps of the wide-area monitoring combined risk prediction method as described in any one of claims 1-3.

Images